Privacy policy

1. Who is responsible for this data?

The controller is the publisher of the Vigeos service: VIGEOS, a single-shareholder simplified joint-stock company with variable capital, with an initial capital of €1, whose registered office is at 71 avenue des Trois Lucs, 13012 Marseille, France, registered with the Marseille Trade and Companies Register under number 107 608 655, represented by its president Romain Dellamonica.

Contact for any question or request about your data: [email protected], or by post to the address above. You can write to us in English or in French.

No data protection officer (DPO) has been appointed to date. Your requests are handled by the company’s president, who is today the only person with access to the back office. This situation will be reviewed as soon as the regular and systematic monitoring of people grows in scale (article 37(1)(b) of the GDPR); if an officer is appointed, their name and contact details will appear here and will be notified to the CNIL (the French data protection authority).

Care homes. When Vigeos equips a residence or a care home, the care home is the controller and Vigeos acts as a processor, on its instructions and under a separate contract. This policy describes the service offered to families at home.

2. Who are the data subjects?

• The monitored person: the older person whose home is equipped. It is their images, their movements and sometimes their health information that are processed. They have their own rights, independent of those of their family (see §9).
• The subscriber: the family member who pays the subscription and manages the household in the app.
• Invited family members: the other household members who receive the alerts and can decrypt the videos.
• Emergency contacts: the people whose name and phone number are entered so they can be reached in case of an incident.
• Website visitors to vigeos.fr and professionals who contact us through the dedicated form.

3. What data, for what purpose, and for how long

3.1 Subscription and account

• What is collected: first name, last name, email address, phone number, postcode and town when subscribing; a delivery address when equipment has to be shipped; email address, name and password (stored as a bcrypt hash, never in plain text) for the app account; notification preferences and quiet hours; your phone’s notification token; your device’s public encryption key.
• Why: to create and manage your subscription, authenticate you, contact you, send you the alerts, ship the equipment.
• Legal basis: performance of the contract (art. 6(1)(b)) and pre-contractual steps.
• Retention: as long as the account exists, then erasure (see §8). Requests from professionals received through the professional form are kept for at most 3 years after the last contact.

3.2 Household and monitored person record

• What is collected: identity of the monitored person, date of birth, address of the equipped home, emergency contacts (name, phone number, relationship).
• No medical data: the record contains no regular doctor, no medical conditions and no medical points of attention. These two optional fields were removed on 7 October 2026 and the values already entered were erased.
• Why: to identify the equipped home in the app and in alerts, and to let family members reach the emergency contacts in case of an incident.
• Legal basis: performance of the contract (art. 6(1)(b)): without this information, the alert service ordered cannot be provided.
• Hosting: in France, like the rest of your account data.
• Retention: as long as the household exists.

3.3 Images and video clips

• The continuous video stream never leaves the home, except during a live view opened by a family member (see below). Image analysis runs on the box installed in your home, not on our servers.
• A local backup recording is kept on the box, at home, and automatically overwritten after 24 hours. It is never sent to us. Depending on the camera model, it may contain the stream’s sound track, but Vigeos offers no listening feature: neither the app nor our servers give access to the sound.
• When a fall is detected, a short clip is encrypted on the box and then sent. The encryption is end-to-end: a unique key is generated for each clip, then sealed separately for each household member with their public key. Our servers hold no private key and cannot decrypt the file (limit of this encryption in §7).
• Where: the encrypted clips are stored with Cloudflare (R2 service), see §6.
• Retention: 30 days, then automatic daily deletion. A household member can decide to keep some of them (for example to show them to a doctor), up to 20 clips per household: beyond that, the app refuses and asks you to free one up. A warning is sent 3 days before a clip is deleted, so that no video disappears by surprise.
• Legal basis: performance of the contract, and explicit consent of the monitored person to images being captured in their home.
• Live view: from the app, the account holder and the invited family members can watch a camera’s image live, without sound. The app closes live view after 5 minutes; if it does not close it, our relay cuts the image at the latest about ten minutes after it was opened. The image is encrypted from the box to the phone and is never recorded by our servers. It goes through a relay run by Vigeos on the server that hosts your account data, which passes it on without being able to decrypt it. The relay sees the IP addresses of the box and the phone, the time and the volume of the exchanges; it keeps them in a technical log of limited size, erased as it goes. To connect the box and the phone, our server receives their IP addresses and the technical details of the connection; it erases them at the end of the live view. The box screen does not show that a live view is in progress. Each opening is written to the household’s live view log (who, when, which camera, how long), visible to all family members and included in the export of your data. Retention: 365 days, then automatic deletion. Legal basis: performance of the contract. Live view only opens if the consent of the person being filmed has been stated in the app and has been neither withdrawn nor suspended at their request (§9). Limit of this encryption in §7.
• Camera pause: the app lets you set a daily time slot (for example the night, or washing time) during which the home’s cameras are paused: the box neither analyses nor records any image during that slot, live view does not open, and fall detection does not work during that time.

3.4 Events, alerts and activity

• What is collected: type of event (movement, fall detected, prolonged inactivity), room concerned, time stamp, status of the alert, acknowledgement, and your “real fall / false alarm” feedback.
• Why: to trigger and follow the alerts, produce the activity summary, improve the reliability of detection.
• Legal basis: performance of the contract.
• Retention: 30 days, automatic daily purge. An alert whose video clip has been deliberately kept survives this purge as long as the clip is kept: deleting the alert would destroy the keys that make it possible to read the video.

3.5 Improving the AI, strictly optional

• What is collected: only when Vigeos detects a fall and sends an alert, the trace of the movement that triggered that alert, that is the position, frame by frame, of a rectangle drawn around the person’s outline: a series of numbers, not an image. It comes with the type of room, the date and time, the confidence score computed by the AI, the image format and frame rate of the camera, and your answer “Real fall” or “False alarm” if you give one. No image, no video, no sound, no face. Outside of alerts, nothing is kept for this purpose.
• Nature: this trace describes the movements of the monitored person at the time of fall alerts; it is data concerning their health (article 9 of the GDPR). It carries no name, no address and no face: it is pseudonymised, and stays linked to the monitored home, which makes it possible to erase it.
• Why: to improve Vigeos fall detection, miss fewer falls and send fewer false alarms. This data is used for nothing else.
• Legal basis: explicit consent (art. 6(1)(a) and 9(2)(a)), off by default, never pre-ticked, with no consequence for the service if you refuse. It applies to the whole family account and to every home it monitors; each family member on the account can give or withdraw it. The family member who gives it confirms that the monitored person, or their legal representative, has been told about this use and has agreed to it.
• Where, and who can access it: on the Vigeos server, in France. Only the Vigeos team looks at it. It is never sold or passed on.
• Copies for training: to train the AI, the Vigeos team makes copies of it, in which the home only appears as a code and the time is rounded. These copies are made and used only by the Vigeos team, on its own computers, in France; they are never handed to a contractor. Each copy is erased no later than 180 days after it was made. A home’s data is erased from them no later than 30 days after consent is withdrawn, the household’s data is erased or the home is deleted, the home is assigned to another account, or this data is erased because the consent that covered it is no longer valid. A version of the AI that has already been trained is not changed.
• Retention: on the server, each record is kept for 180 days, then erased automatically during the next daily clean-up. This data also appears in the server backups, from which it disappears no later than 14 days after being erased from the server (§7).
• Withdrawal: at any time, in a single step in the app, without giving a reason. Withdrawal erases from the server, in the same operation, all the data kept for this purpose for the household; it disappears from the backups no later than 14 days after, and from the training copies no later than 30 days after the withdrawal. This data is included in the export of your data (§8).

3.6 Payment

• Vigeos never sees your bank card number. Payment is handled by Stripe; we only keep technical subscription identifiers and the billing history.
• Legal basis: performance of the contract; legal obligation for accounting records.
• Retention: invoices and accounting records are kept for 10 years, as the law requires.

3.7 Technical and security logs

• What is collected: technical logs of the server and the app (IP address, date and time, request made, type of browser or app, error messages) and the technical status of the box and the cameras (device online or not, software versions).
• Why: security, detecting abuse, diagnosing failures.
• Legal basis: legitimate interest (art. 6(1)(f)) and security obligation (art. 32).
• Retention: the time needed for diagnosis, and at most 12 months.

4. What we do not do

• We do not sell, rent or exchange any personal data.
• We do no facial recognition, no biometric identification and no advertising profiling.
• We show no advertising and set no cookies on vigeos.fr. The site’s traffic is measured with Cloudflare Web Analytics, as aggregated statistics, with no cookie or identifier (see the legal notice, §7). We consider that this measurement falls under the consent exemption for audience measurement (article 82 of the French Data Protection Act, CNIL guidelines): you are therefore not shown any banner, and you can object to it at any time.
• We do not automatically pass alerts on to the emergency services. Vigeos alerts your family members; they decide whether to call the emergency services (112, or 15 in France).
• No decision producing legal effects is taken about you in a fully automated way (art. 22).

Every page of the site serves its fonts from vigeos.fr, with no call to a third-party service. In addition, all the traffic of the site and the app goes through the proxy of Cloudflare, Inc. (see §6), and your browser may send it network error reports when a page does not load.

5. Who has access to your data?

• You and the members of your household: access to the alerts, the activity, live view and its log, and the video clips, which only you can decrypt (limits in §7).
• The Vigeos team: administrative access to the account and billing data and to the technical status of your installation, for support and operations. This access does not make it possible to decrypt your video clips (see also, in §7, the limit of the traceability of administrative access). The team is currently limited to its founder.
• Our technical processors, listed in §6, who act only on our instructions.
• The authorities, only on a legal requisition. As regards stored video clips, we could only hand over encrypted files that we are unable to open.

6. Processors and transfers outside the European Union

Provider	Role	Location
Hostinger International Ltd	Hosting of the servers, of the database and its encrypted backups, and of the live video relay, which passes the encrypted image on without being able to read it	Servers in France / EU
Cloudflare, Inc.	Reverse proxy, content delivery network and web application firewall of vigeos.fr and of the programming interface: connection data (IP address, headers, address requested), browser network error reports; cookieless audience measurement of vigeos.fr (Web Analytics), as aggregated statistics	US company; edge processing on European nodes
Cloudflare, Inc.	Storage of the encrypted video clips (R2 service). The encrypted database backups were copied there until 10 August 2026; no copy has been made there since	US company, distributed storage
Stripe Payments Europe Ltd	Payment and subscription management	EU (Ireland) and United States
Expo (650 Industries, Inc.)	Technical relay of the family app’s notifications (device token, message title and body)	United States
Apple Inc.	Final delivery of notifications to your iPhone (APNs)	United States
Google (Google Workspace)	Email (Google Workspace): @vigeos.fr mailboxes and sending of the service’s emails (verification codes, invitations and other account-related messages), since 23 September 2026	US company; Google data centres, including outside the European Union

Transfers to the United States are governed by the European Commission’s standard contractual clauses and, where applicable, by the provider’s participation in the Data Privacy Framework.

This table only lists real processors, in service today. Any new recipient will be added before it is used, and you will be informed.

The content of notifications is deliberately minimal (“alert detected”, with no medical detail), precisely because it goes through third-party providers.

7. How your data is protected

• End-to-end encryption of the video clips, with one key per clip sealed for each household member. A 12-word recovery phrase lets you recover your videos on a new phone: we do not know it and cannot regenerate it.
• Limit of this encryption: our server is what tells the box the public keys of the household’s phones, and the box encrypts for each of them without being able to check that it really belongs to a household member. Our servers cannot read the clips they store; but a compromised server, a third party able to change its answers, or we ourselves by changing it, could add a key and read the clips recorded afterwards. Clips already stored remain unreadable. We plan for every new key to be countersigned by the household’s phones already registered, and checked by the box; until this is the case, this limit remains.
• Limit of the live view encryption: the live view image is encrypted from the box to the phone, but the connection is set up through our server, which gives each side the details needed to check the other. A compromised server, a third party able to change its answers, or we ourselves by changing it, could step in between the box and the phone and see the image of a live view opened afterwards. The approval of new phones by the household’s phones, planned for video clips, will also cover live view; until it is in place, this limit remains.
• Database hosted in France, with restricted and authenticated access.
• Encryption in transit (HTTPS/TLS) for all communications.
• Hashed passwords (bcrypt: we never know your password) and time-limited session tokens. Deleting an account immediately revokes its access.
• Encrypted backups (AES-256) of the database, kept on our server, in France. Each backup is erased before it reaches 14 days: data erased from the database disappears from the backups no later than 14 days after. The copies taken before a server update are encrypted in the same way and follow the same rule. Since 11 August 2026, no copy has been made outside this server: the off-site copy is suspended until its destination is guaranteed within the European Economic Area.
• Automatic daily purges of data that has reached its end date, with actual deletion of the corresponding files, and a weekly sweep that checks that no encrypted file survives the row that referenced it.
• Administrative access by cryptographic key only, never by password.

One point we prefer to write down: there is not yet a structured log recording each time the administrator looks at a record. The server’s technical logs exist, but they are not a complete audit trail. Putting this traceability in place is open work, a priority as soon as a second person has access to the back office.

No system is infallible. In the event of a data breach presenting a risk to your rights, we notify the CNIL within 72 hours and inform you directly when the risk is high.

8. Your rights

You have the following rights over your data:

• Access (art. 15): obtain a copy of the data about you.
• Rectification (art. 16): correct inaccurate information, directly in the app for most fields.
• Erasure (art. 17): delete your account and your data. This deletion is available directly in the app (Account → Delete my account). If other family members remain members of the household, only your account is deleted: the household’s data remains available to them, and the consent given to improving the AI stays in place until a family member withdraws it. The account holder who pays the subscription first removes the other family members, or writes to us to transfer the subscription. If you are the last family member of the household, deletion erases in cascade the events, the alerts, the stored video clips, including those you had chosen to keep, the live view log and the training trajectories. This data disappears from the backups no later than 14 days after, and from the training copies no later than 30 days after (§3.5). Only the accounting records that the law requires us to keep remain, together with the home’s code used to remove its data from the training copies: it is kept for 210 days, then erased during the next daily clean-up.
• Restriction (art. 18) and objection (art. 21).
• Portability (art. 20): receive your data in a machine-readable format. An export feature is available in the app (Privacy → Download my data); if your version does not offer it yet, ask for it by email and we will send it to you within one month. Video clips are not in the export: our servers cannot decrypt them. They remain readable in the app for as long as they are kept.
• Withdrawal of consent (art. 7(3)): at any time, as simply as you gave it. Withdrawal does not affect what was done before.

To exercise these rights: [email protected], or by post to VIGEOS, 71 avenue des Trois Lucs, 13012 Marseille, France. We may ask you to prove your identity if there is reasonable doubt. Answer within one month, which may be extended by two months for complex requests, in which case we inform you.

If our answer does not satisfy you, you can complain to the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or cnil.fr/fr/plaintes. If you live in another country of the European Union, you can also contact the data protection authority of your country. Complaining to the CNIL is free and does not deprive you of any other remedy.

9. The monitored person: their rights first

By subscribing, the subscriber undertakes to have informed the monitored person and obtained their consent, and to be able to prove it. This person has all the rights listed in §8, including the right to require the service to stop, and can write to us directly at [email protected], without going through their family.

The subscriber also tells them about live view: family members can watch a camera’s image, without sound, without the box screen showing it, for 5 minutes each time it is opened (about ten minutes at most if the app does not close live view), and each opening is written to the household log (§3.3).

If the person is not able to give informed consent (cognitive impairment, legal protection measure), consent must be sought from the person in charge of their protection, and their agreement sought as far as possible. In practice, this means: explaining it to them, and respecting their refusal.

Our installation recommendations, to limit intrusion:

• Never a camera in the bathroom or the toilet, nor, unless there is a clearly expressed need, in the bedroom.
• Frame the walkways where falls happen (hallway, living room, kitchen).
• Do not film public space or the neighbours’ homes: it is forbidden.
• Use the camera pause (see §3.3) when the person has visitors or wishes for privacy.
• Tell regular visitors (home helps, nurses) that there is a camera.

10. Minors

The service is neither intended for nor offered to minors. No account may be created by a person under 18.

11. Changes

This policy may change with the service. Any substantial change (new purpose, new recipient, longer retention period) will be reported to you by email or in the app before it takes effect. The date of the last update is shown at the top of the page.

Update of 12 October 2026: cookieless audience measurement of vigeos.fr (Cloudflare Web Analytics, §4 and §6); fonts of every page served by vigeos.fr. Version 1.8 of 8 October 2026: the monitored person record no longer contains medical data (regular doctor, medical conditions), removed from the service on 7 October 2026 (§3.2 and §7). Version 1.7 of 7 October 2026: live view described as it works, with its log and the limit of its encryption; video clip and camera pause described as in service; AI improvement aligned with the consent text of the app (training copies made in France, erased no later than 180 days after being extracted and no later than 30 days after a withdrawal or an erasure); backups erased before 14 days; account deletion clarified. Version 1.6 of 2 October 2026: retention period of events and alerts corrected to 30 days, email, backups, and features still in development flagged as such. Version 1.5 of 28 September 2026: limit of the encryption of clips described in §7. English translation published on 7 October 2026.