1. What data is involved
- Live video & audio from the bystander's glasses or phone — the clinician's working picture during a call.
- Location of the scene (GPS / approximate position) to place the case on a map and route help.
- Case information a clinician records — assessment, guidance sent, timestamps, operator actions.
- Account data for operators (username, hashed password, session) — never the bystander.
Special-category (health) data is inherently involved. It is treated as the most sensitive class of data throughout.
2. How it is protected
- End-to-end encryption. Live video and guidance run over the Matrix protocol (Olm/Megolm). The server relays ciphertext it cannot read.
- Self-hosting. The whole system runs on infrastructure you control, in your jurisdiction. Casualty data does not have to leave your organisation or your country.
- Encryption in transit. All connections use TLS/HTTPS.
- Data minimisation. Only what is clinically necessary is stored, and history is capped. No third-party advertising, analytics, or tracking is present.
- Access control & audit. Operator actions require authentication; state-changing actions are recorded in a tamper-evident audit log.
- Human-in-the-loop. Nothing is sent to the person on the scene without an explicit clinician decision.
3. Roles under the GDPR
Because SaveVision is self-hosted, the deploying organisation (e.g. an emergency service, a Red Cross society, or a volunteer organisation) is the data controller for the data it processes. SaveVision's makers act as a software provider / processor only to the extent agreed in a Data Processing Agreement for a given pilot.
| Role | Who | Responsibility |
|---|---|---|
| Controller | Your organisation | Purpose & lawful basis, consent, retention, data-subject rights. |
| Processor / provider | SaveVision | Secure software, support, no use of your data beyond the agreement. |
4. Lawful basis & consent
In a life-threatening emergency, processing is typically grounded in vital interests and the provision of healthcare (GDPR Art. 6(1)(d)/(c) and Art. 9(2)(c)/(h)), within the controller's own policies. Where practical — for example in training, events, or non-urgent follow-up — explicit informed consent is obtained. The final lawful basis is determined by the controller and its DPIA.
5. Sub-processors
A SaveVision deployment can run with no third-party data processors at all. Two optional integrations, only if you enable them:
- AI guidance (optional). If an AI key is configured, a single point-of-view frame is sent to the vision provider only when the clinician asks for a suggestion, and the suggestion is reviewed before use. Disable it and no frames leave your server.
- Map tiles (optional). Map imagery is fetched from a tile provider; this can be self-hosted for fully offline operation.
6. Retention
Retention periods are set by the controller. By default the prototype keeps only recent case state and a bounded event/audit history; live media is not recorded by the system unless the controller explicitly enables and justifies recording.
7. Your rights
Data subjects have the rights granted by the GDPR — access, rectification, erasure, restriction, portability and objection — exercised through the controlling organisation. Because data is held on the controller's own infrastructure, these requests are fulfilled directly by them.
8. Contact
Questions about SaveVision's data-protection design, or to arrange a DPIA workshop for a pilot: hello@savevision.io. (Add your organisation's Data Protection Officer contact here for a live deployment.)