If nothing happens, nobody sees where you are
A watch that knows where you are is a control tool until proven otherwise. That is why how much the dashboard sees is a setting, and at the strictest level it sees nobody: whoever asks for help appears for as long as they need it. If someone wants to see you with no alarm raised, they ask, another person approves it, it is on record, and your watch tells you.
configurable privacy leveleverything seen, on record
It’s the top objection, and it comes before the budget
It always comes through the health and safety committee or the union representatives, and it comes with good reason.
It isn’t answered with a signed policy. It is answered with four specific questions that have to be answered before the first watch is issued.
Who can see me?
A dot per person on a screen, eight hours a day, is the definition of control even if nobody is watching it. The question isn’t whether the dashboard can, it’s whether it does when nothing is happening.
And when?
Knowing where you are when you’ve pressed SOS is one thing; knowing it at lunchtime is another. Without that difference written down, the safety tool and the surveillance tool are the same.
Who decides?
If seeing someone depends on a single person with access to the dashboard, the policy is only as good as that person is that day. What reassures is not the rule, it’s that it takes more than one person.
And how do I check it myself?
Everything above is the company’s promise. The only one that isn’t is the one the worker can see on their own wrist, without asking anyone for it.
You choose the level, and the rules engine watches the same way at all of them
How much the dashboard shows of where each person is when nothing is happening is a plant setting, not a condition of the product. On “continuous supervision” it shows the position of the workforce throughout the working day. On “emergencies only” it shows nobody. The rules are evaluated in exactly the same way at every level: seeing less doesn’t mean protecting less.
The difference isn’t in what the system knows, which is the same, but in what it shows and to whom. This page describes the strictest level, because that is the one that answers the objection, and there every time the dashboard shows something, a written reason sits beside it.
The plant sets the level, and the change is written down
It is a setting in the initial configuration, and it is decided with the employee representatives in mind. It can be changed later, but not quietly: who changed it, when and to which level is recorded in the log. It is the most serious entry in the log.
If an alert goes off, that person appears
An SOS, a fall, an evacuation, a permit to work that has expired with someone inside. The rules engine watches in exactly the same way at every level, and when it opens an alert, that person, and only that person, appears on the map while the alert lasts. When it’s resolved, they disappear from the map; what remains is the alert record, with the route they took while it was open.
Seeing someone when nothing is happening has to be requested
For one person, a group or the whole workforce. With a written reason, for a limited time, and approved by someone other than the person asking. When the time runs out, it expires on its own.
And the watch tells the person being seen
The status ring on their watch face turns blue with an eye inside, and under their name it shows who is watching and how many minutes are left. Nobody can be watched in secret or even with permission without them finding out: the worker learns at the same moment as the control room.
It disappears from the map; from the alert record, not entirely. The route taken while it was open stays there, and how much of it stays depends on how serious the alert was: for a warning it is cut off at the moment the alert opens; for a critical alert it is kept in full as evidence of the incident. For critical alerts, it also notes who was within a hundred metres, and the distance, but not where each of them was.
Privacy zones marked on the map, such as changing rooms and canteens, are not recorded at any level. The level decides what the dashboard sees; no one sees those zones, they don’t appear on an alert’s route, and they don’t count when working out who was nearby.
The only thing that isn’t a promise
Everything above is said by the company. This is said by the watch, on the wrist of the person being seen, without them having to ask anyone for it.
When a request to see someone is approved, the status ring on their watch — the same one that turns green, amber or red depending on what’s happening — turns blue with an eye inside, and under their name it shows who can see them and how many minutes are left. Blue, not amber or red: it isn’t a risk warning, it’s information. And the SOS button stays where it was.
There is no way to see you without your knowing. With permission, the watch tells you. For an alert, you already know: you’ve pressed SOS or you’ve fallen, and the control room seeing you is exactly what’s needed.
It is the piece that turns a policy into something you can check. A workers’ representative with a watch on their wrist doesn’t have to take anyone’s word for it.
And your vital signs are yours
Heart rate works the same way as position, and it was designed earlier. The worker sees their vital signs on their wrist, at all times. The company doesn’t: in normal operation the watch evaluates the health rules on the device itself and sends only the alert, so the vital signs never leave the wrist.
Only when there is an active emergency, an SOS or a detected fall, the response team sees that person’s vital signs, for as long as the alert lasts, only that person, and every access is logged. When the alert is resolved, the transmission is cut off.
A heat warning says that someone has to stop, not how long they have stopped for. The system doesn’t record performance, pace or break times, at any level.
Everything that has been seen, in writing
Every request to see someone is logged, with who asked, who it was for, the reason, who approved it, how long it lasted and how it ended. Every change of level, with who made it and when. And every access to someone’s vital signs during an alert.
It isn’t a report that gets generated when someone asks for it. It is the list itself, and it is what is shown to the representatives when they ask. If a month’s log says “nobody has asked to see anyone’s position”, that is what happened.
A privacy policy is signed once. A log can be read every month.
What this doesn’t promise
It doesn’t promise the company can’t see you. It can choose continuous supervision, and it can ask to see you at the strictest level. The law permits it with conditions, and the conditions are exactly the ones above: prior information, a reason, proportionality and a record. What it does promise is that it cannot do so without it being on record and without you knowing.
It is designed to pass the GDPR screen and the committee’s, not to replace them. What the law asks in order to geolocate a workforce — prior notice, a reason, seeing no more than necessary and keeping a record — the system does by default, without anyone having to remember. The impact assessment is signed by your company, and when the time comes to do it the answers are already in the system.
And it doesn’t replace the representatives. Nothing the system does exempts you from informing and consulting those the law says must be informed and consulted before the first watch is issued.
Look at it with your committee in front of you
The best thing to do with this page is not to read it: take a watch to the meeting, ask to see the person wearing it, and let them tell you what showed up on their wrist.