# Privacy and security

> Three sensitive kinds of data at once, and a clear rule for each.

Source: https://farolacare.com/en/datenschutz-und-sicherheit · As of: 2026-10-26

## Clients' health data (Art. 9 GDPR)

- Processing only for care. The care service is the controller; Farola acts as a processor.
- Database and files are in the EU; AI features run exclusively via Vertex AI in the EU region, without training on your data.
- No health data in error logs, file names or address lines.

## Caregivers' location data

- Tracking only during an active round, visible in the app.
- No evaluation of individuals: location serves dispatch, not monitoring of behaviour.
- Tracking is subject to co-determination (Section 87 BetrVG, the German Works Constitution Act): Farola is built so that a works agreement can clearly limit it.

## Conversation recordings

- Only with documented consent that can be withdrawn, checked in the app and on the server.
- Audio is the kind of data kept for the shortest time: after transcription and analysis it is deleted automatically once its period expires.
- Analyses are suggestions and are approved by a person before they are adopted.

## Tenant separation and access

- Each care service is a separate tenant; database policies keep the data apart.
- Roles in the dashboard: Admin, Dispatch, Read-only. Caregivers see only their own round.
- App sessions are bound to one device and can be revoked individually; access tokens are stored only as a hash.