1. Why this policy exists
ANDITO helps a family caregiver look after a bed-ridden adult with dementia by analyzing a camera feed in the person's home and reporting what it sees. Some of what it reports is information about a person's health and daily condition. Laws such as Washington's My Health My Data Act call this consumer health data and give you specific rights over it.
This policy is published by Sahlware LLC, the company that provides the ANDITO service ("ANDITO," "we," "us," or "our"). It applies to everyone who uses the Service, wherever they live, and it supplements our general Privacy Policy at https://andito.sahlware.com/privacy. Where the two overlap, this policy controls for consumer health data.
Two people are involved in the Service: the caregiver, who holds the account, and the monitored person, whose health-related information the Service collects. The rights described here belong to the monitored person. Because the Service is designed for a person who cannot manage their own affairs, the caregiver exercises those rights on the monitored person's behalf, under the authority the caregiver confirms when setting up the Service (Section 4).
2. Consumer health data we collect, and why
| Category | What it is | Why we collect it and how we use it |
|---|---|---|
| Bed and position observations | Whether the monitored person appears to be in bed or out of bed, and their approximate posture (for example, lying, sitting up, at the edge of the bed) | To show the caregiver a timeline of the day, to send safety alerts for events the caregiver chose (for example, leaving the bed), and to produce the morning and evening summaries |
| Activity and condition observations | Approximate activity (for example, resting, restless, eating), apparent mood, whether bedding or covers are in place, and whether another person is present | Same purposes: timeline, alerts, and summaries |
| Confidence and privacy labels | How confident the software is in each observation and whether a frame passed our privacy checks | To decide what to keep and what to discard, and to show the caregiver how reliable an observation is |
| Still snapshots | Up to five still images per day that pass our fail-closed privacy checks | To let the caregiver see the care scene a few times a day without any video being recorded |
| Caregiver feedback and acknowledgements | The caregiver marking an observation as right or wrong, and acknowledging an alert | To improve the accuracy of the caregiver's own timeline and to keep the alert history correct |
| Mobility profile | The caregiver's description of how mobile the monitored person is (for example, bed-ridden, can sit up, can leave the bed) | To decide which bed events should trigger an alert |
We use consumer health data only to provide the Service the caregiver requested: the timeline, alerts, and summaries; the security and operation of the Service; and compliance with law. We do not use it for advertising, and we do not use it to train general-purpose AI models.
What we do not collect. We do not record, transmit, or store video. We do not capture audio. Camera images are analyzed on the device in the home and are not sent to us or to anyone else for analysis. We do not collect precise location, and we do not use geofencing of any kind.
3. Where consumer health data comes from
- The camera and home device the caregiver installs, which produces the observations and snapshots described above.
- The caregiver, who enters the mobility profile, gives feedback on observations, and acknowledges alerts.
We do not obtain consumer health data from data brokers, health-care providers, or any other outside source.
4. Consent
Collection requires your specific consent. Before monitoring begins, the caregiver is asked, during setup, to give separate, specific, opt-in consent to the collection of the monitored person's consumer health data. This consent is presented on its own, is not pre-checked, and is not part of accepting the Terms of Service. In the same step the caregiver confirms that they have the legal authority to consent on the monitored person's behalf (for example, as legal guardian, health-care agent, or power-of-attorney holder, or with the monitored person's own informed consent where they can give it).
What we record. We keep a record of each consent: what was consented to, the version of this policy shown, the date and time, and the network address the consent came from.
Withdrawing consent. Consent can be withdrawn at any time, in either of two ways:
- delete the account from Settings → Account → Delete account, which ends monitoring and deletes the data (Section 7); or
- email privacy@sahlware.com.
Monitoring stops when the home device is disconnected or the account is deleted. We do not continue collecting consumer health data after consent is withdrawn.
Changes need new consent. If we ever want to collect additional categories of consumer health data, use it for a new purpose, or share it in a new way, we will ask for your consent again before doing so.
5. Sharing of consumer health data
We do not share consumer health data with third parties. In particular:
- We do not sell it, and we will never ask for authorization to sell it.
- We do not share it with affiliates. We have none that receive personal information.
- We do not share it for advertising, analytics, research, or any purpose of our own beyond providing the Service.
Service providers (processors). To operate the Service we rely on companies that process data strictly on our behalf, under written contracts that forbid them from using it for their own purposes or to train their own models. The categories of consumer health data involved are those in Section 2. The categories of service providers are:
| Category of service provider | What they do with consumer health data |
|---|---|
| Cloud hosting and data storage | Store the observations, snapshots, feedback, and mobility profile, and serve them to the caregiver's dashboard |
| Text-message delivery | Transmit the alerts and daily summaries the caregiver asked for; these messages describe the monitored person's status in a few words |
Email and payment providers receive account and billing details, not consumer health data. We keep a current list of our service providers, with a contact address for each, and will send it to you on request at privacy@sahlware.com.
Other disclosures. We may disclose consumer health data if required by law or legal process, or to protect the safety of the monitored person, our users, or the public, and only to the extent necessary.
6. Your rights
You (or, for the monitored person, the caregiver acting for them) have the right to:
- Confirm whether we are collecting, sharing, or selling consumer health data about the monitored person, and access that data;
- Receive a list of all third parties and affiliates with whom we have shared or to whom we have sold consumer health data, with an active email address or other online contact for each (today, that list is our service providers, because we do not share with anyone else);
- Withdraw consent to the collection and sharing of consumer health data (Section 4);
- Delete the consumer health data we hold, including from our backups and from our service providers (Section 7); and
- Appeal if we decline a request.
How to make a request. Use the controls in Settings, or email privacy@sahlware.com from the email address on the account. A request may also be made by an authorized agent with your signed permission.
Verification. We verify a request made in the product by the signed-in account. We verify an emailed request by matching the sending address to the account and confirming by reply; we may ask for one additional piece of account information if the match is unclear. We never ask for a password.
Timing. We acknowledge every request within 10 business days and respond within 45 days of receiving it. When reasonably necessary, we may extend once by a further 45 days; if so, we will tell you before the first 45 days end and explain why.
Appeals. If we decline all or part of a request, our response will explain why and how to appeal. Send an appeal to privacy@sahlware.com with "Appeal" in the subject line. Within 45 days of receiving the appeal we will tell you, in writing, what we did or did not do and why. If we deny the appeal, we will also tell you how to submit a complaint to the Washington Attorney General (https://www.atg.wa.gov/file-complaint) or to the attorney general of your state.
No discrimination. We will not deny the Service, charge a different price, or provide a different level of service because you exercised any of these rights.
7. Deletion and retention
Consumer health data is deleted automatically on a schedule, and immediately on request:
| Data | Kept for | Then |
|---|---|---|
| Snapshots | 30 days | Deleted from storage and from the timeline |
| Observations, alerts, feedback, and summary-send records | 90 days | Deleted |
| Mobility profile and consent records | Life of the account | Deleted with the account |
On request. Deleting the account from Settings removes all of the above from our live systems immediately, and our service providers are instructed to delete what they hold (for example, the delivery records of text messages). An emailed deletion request is completed within 45 days as described in Section 6. In every case, backup copies expire within 30 days after deletion from live systems and are never restored to production. We keep a record that a deletion request was received and completed, without the deleted data, for 24 months, because the law permits and in some cases requires it.
8. Contact
- Sahlware LLC · 33819 NE 52nd Way, Carnation, WA 98014
- Email: privacy@sahlware.com · Website: https://andito.sahlware.com