Care Robot Privacy: Staff Access and Family Deletion Rights
Recording Is Not Inherent—It Is Integrated
A companion robot does not record by default. The K1 AI companion robot contains no microphone array firmware for continuous audio capture, no onboard flash memory for saving clips, and no pre-installed cloud API keys for streaming. Recording capability arises only when deployed within a certified care platform—such as a facility-managed telehealth system or domiciliary support app—that adds its own audio/video ingestion layer. This means the responsibility for defining what is recorded, where it resides, and how it is governed rests with the platform integrator—not WingPhoenix. Buyers must confirm in writing whether their chosen platform has completed its own Data Protection Impact Assessment (DPIA) covering the robot’s role as a peripheral input device.Staff Access Must Be Defined by Policy, Not Assumption
Staff access to any recordings is not a technical feature of the robot, but a contractual boundary set between the care provider and the platform vendor. WingPhoenix supplies no admin dashboard, role-based access control (RBAC) module, or audit log for playback events. Instead, the factory policy requires that every hardware revision booked for care use carries a documented test scope for CE RED (EN 301 489), which verifies electromagnetic compatibility during wireless transmission—but says nothing about access permissions. Therefore, procurement teams must obtain written confirmation from the platform vendor specifying who may initiate, view, download or share recordings—and whether those permissions are time-bound, location-restricted or tied to job function. This cannot be deferred to “future firmware updates”.The Family Right to Delete Is a Platform Obligation
The right to delete personal data captured via the robot belongs to the individual or their legal representative—but WingPhoenix does not hold, process or route that data. Deletion is executed only by the platform hosting the recordings. Our factory policy does not include a built-in deletion API, remote wipe command or local cache purge function. If a family submits a deletion request, the platform must locate and erase all copies—including backups, transcripts and metadata—across its infrastructure. WingPhoenix can supply firmware logs showing no local persistence, but cannot guarantee end-to-end erasure. For due diligence, importers should review the platform’s ISO/IEC 27001 certificate and ask for evidence of annual penetration testing covering data lifecycle controls.What This Process Cannot Do
This process cannot validate or enforce the completeness of a third-party DPIA. WingPhoenix does not assess, sign off on or retain copies of customer DPIAs. We do not audit platform vendors’ data handling practices, nor do we certify that their deletion workflows meet GDPR Article 17 or UK DPA 2018 Schedule 1 Part 3 requirements. A buyer who accepts a supplier’s claim that “the robot is DPIA-ready” without verifying the platform’s independent assessment is exposing their organisation to regulatory risk. Always require the full DPIA document—not a summary—from the platform vendor before signing integration contracts.Compliance Documentation You Receive Per Build
Every production run ships with documentation aligned to the exact hardware revision. No documents are generic or reused across models. This includes CE RED test reports covering EN 300 328 (radio), EN 301 489 (EMC), and EN 62368-1 (safety); RoHS 3 and REACH SVHC screening reports; UN38.3 battery test summary and SDS; and—for skin-contact items like rings—the EN 1811 nickel release report. These are supplied per build, not per model line, and reflect the configuration shipped. For details on lead times and sampling, see MOQ, sampling and lead times. For CE RED specifics, refer to the CE RED document checklist.| Requirement | Supplied By WingPhoenix | Not Supplied By WingPhoenix |
|---|---|---|
| CE RED Report (EN 300 328, EN 301 489, EN 62368-1) | Yes, per hardware revision | DPIA, platform-level security audit |
| RoHS 3 / REACH SVHC Screening | Yes, per build | Data processing agreement (DPA) with platform vendor |
| UN38.3 + SDS for batteries | Yes, with watt-hour rating printed on unit | Recorded data retention schedule or deletion SLA |
| EN 1811 Nickel Release (for rings) | Yes, for skin-contact builds | Role-based access control matrix for staff playback |
| Firmware logs proving no local storage | Yes, on request for K1 companion robot | End-to-end encryption key management documentation |
| Toy Safety Directive (EN 71, EN 62115) | Booked per age grade on packaging | Consent mechanism for minors’ voice data capture |
How to Vet Your Supplier Before Committing
Procurement teams should treat recording capability as a red flag requiring cross-functional validation—not a feature to be enabled later. Start with the how to vet a supplier guide, then request firmware binary hashes and signed logs confirming zero local audio buffer. Confirm whether your platform vendor has already engaged WingPhoenix for OEM/ODM services via OEM/ODM services, as joint certification reduces integration risk. Review the full how we build and test process to understand QC gate timing, and compare against other devices in our product catalogue, including the R1 AI health ring, H3 health smartwatch, and P1 AI learning padQuestions buyers ask
What are the three access questions a care deployment must answer in writing?
Who may access recordings, under what conditions; how long recordings are retained; and how families exercise the right to delete personal data captured by the device.
What does finance or compliance need to verify before approving purchase?
That the supplier provides auditable evidence of CE RED and RoHS 3 compliance per hardware revision, plus documentation of the recorded data retention period and deletion workflow—not just policy statements, but test reports and firmware logs showing implementation.
What happens if a distributor receives a sample that fails a local privacy audit?
The unit is reconfigured or replaced at no cost if the failure stems from unmet factory policy (e.g., missing EN 301 489 clause in CE RED report); however, custom access logic or deletion UI changes require an ODM project quote and new certification scope.
What do most suppliers avoid naming directly?
That no WingPhoenix AI companion robot includes built-in recording storage, cloud sync, or user-accessible playback—so “recording” only applies when integrated into a third-party care platform, and deletion rights depend entirely on that platform’s architecture, not the robot itself.
Related: more on ai companions · buyer guides · customisation tiers