Privacy & Trust
People should not have to accept being watched in order to be safer at home.
Ilonai is designed to learn as little as possible about a person's life while still detecting a possible fall. Formal legal or security audits have not been completed. The promises below are product boundaries we are building toward.
The privacy promise
If nothing happens, no image leaves the system.
No live camera access. No audio. No daily activity profile. No Ilonai staff viewing rooms.
We are designing around Swiss FADP privacy-by-design principles: purpose limitation, data minimization, restricted access, and short retention. Formal validation will be published when it exists.
The Swiss FDPIC notes that recognizable video is personal-data processing even if images are not saved, and that where post-incident viewing is sufficient, images should not be viewed unless an incident occurs. That is the posture we want.
What the cameras can send
Normal operation
What leaves: health/status metadata only.
What does not leave: images, video, audio, routine or activity history.
Possible fall
What Ilonai never provides
- no live camera page
- no surveillance dashboard
- no vendor camera access
- no audio
- no facial recognition
- no daily activity log
- no sleep or bathroom-behavior reports
- no staff or family surveillance of ordinary life
Image privacy is necessary and not sufficient. We also refuse behavioral privacy leakage: not reconstructing someone’s day while deleting pixels.
The rolling buffer
Video is not retained during normal operation. A short encrypted rolling buffer exists locally and is continuously overwritten. If a possible fall is detected, that short window can be preserved as an incident clip.
That is why we do not say “never stored even for a millisecond” and also “we can show ten seconds before the fall.” Both are true only because of the buffer.
Emergency exception
A designated person — named in advance — can receive a confirmation image when the system believes help may be needed. That is the moment a human may need to look, not during the rest of the day.
An optional short incident clip remains on the local computer: encrypted, access-controlled, with a deletion policy. It is not ordinary cloud video.
System diagnostics vs. watching a life
Ilonai can know (design): camera 4 offline, software version, heartbeat missing, extended power loss.
Ilonai cannot know remotely: what the resident is doing in the room.
Training-data policy
Customer footage is not used to improve models unless we have separate, explicit permission. A safety installation is not a data-collection pipeline.
What we will not claim
We will not say “GDPR certified,” “no cloud vulnerabilities,” or “no compliance issues.” A local system can still have security bugs. Better: no cloud video exposure, and no wearable-compliance dependency.