A family privacy agreement for sensors, cameras, and location sharing

01

Know what this agreement can—and cannot—do#

Start with the person whose home, body, routine, or location will generate information. Describe the concern in plain language and ask what support would feel useful. A person can agree to an emergency button and decline a camera, agree to a door alert and decline an activity dashboard, limit location sharing to one trip, or change their mind after living with a device.

Do not infer inability from age, diagnosis, disability, refusal, or a decision the family dislikes. Decisional capability may vary by decision, time, context, and available support. A trusted supporter may help the person understand options and communicate a choice, but this worksheet does not assess capacity, appoint a surrogate, create a power of attorney, or extend anyone’s legal authority.

Revisit the agreement when the technology, health situation, home, care setting, family roles, subscription, privacy policy, or data use changes. If meaningful choice, coercion, capacity, or authority is disputed, pause and seek appropriate local clinical, legal, advocacy, or safeguarding guidance.

02

Map collection, inference, sharing, retention, and deletion#

For every product, list what it collects directly and what it may infer. This can include video, audio, motion, door activity, appliance use, sleep, location, contacts, voice recordings, device identifiers, account activity, health-related patterns, and the absence of an expected event. Separate raw data, derived history, notifications, downloads, and the narrow alert the family actually needs.

Use the current privacy notice, account settings, official support documentation, and actual plan or checkout terms. Record where information is processed, every recipient, each viewer role, retention, advertising or model-improvement use, export, provider-held backups, and the deletion request path. NIST’s Privacy Framework treats data processing across its lifecycle as something to identify and manage; a generic security checklist alone does not answer those questions.

Do not assume HIPAA protects data from a consumer sensor, wearable, phone, or app. HHS explains that HIPAA generally applies when protected health information is handled by covered entities or business associates; information on personal devices and many independent third-party apps can fall outside those rules, although other law may apply.

03

Choose the least intrusive useful signal#

Ask the narrow operational question first. If the family only needs to know that a morning check-in happened, a scheduled call or button may be enough. If the concern is an exterior door left open, a door state may be more proportionate than indoor video. A product should not become continuous observation simply because continuous observation is technically available.

Treat a live feed, a motion alert, a stored clip, continuous audio, a recorded call, and downloaded history as separate permissions. Define camera-free rooms, audio-free areas, private times, visitors who should not be captured, and how the person pauses or covers the device. Before recording, check applicable federal, state, facility, lease, employment, and provider rules; a family signature does not waive them.

FTC guidance highlights camera placement, feed security, account access, updates, and privacy in sensitive areas. A voice assistant should have a visible, reachable physical mute control, clear listening indicators, and a reviewed recording history. Disable collection that is not part of the agreed purpose.

Collecting less is a reliability choice too: fewer signals can mean fewer alerts to interpret, fewer accounts to secure, and clearer responsibility.

04

Separate live access, recordings, and location history#

For location sharing, decide whether the family needs precise or approximate location, continuous or event-triggered access, current position or history, and a fixed end time. List recipients, arrival or departure notifications, downloads, refresh limits, the off switch, and what happens when the phone is offline, left behind, or reporting stale information.

Apple and Google both provide person-specific location-sharing controls and ways to stop sharing, but the visible effects and available features can vary by service, account, device, operating system, and region. Confirm the current controls on the exact device instead of assuming a family group creates permanent permission.

A map pin is not proof of location or safety, and a missing pin is not proof of an emergency.

05

Give each viewer an identity and a reason#

Use individual invitations or roles where the product supports them, enable multifactor authentication, and record the account owner and recovery path. If a product requires shared credentials or prevents resident-controlled removal, record that as a material limitation. List every viewer, including relatives, paid caregivers, installers, monitoring services, landlords, clinicians, vendors, and people who receive exported copies.

Review access on a schedule and immediately after a relationship, employment, device, or living arrangement changes. Remove old users, revoke old sessions, update recovery information, and check for unfamiliar account activity. Disable remote viewing, microphones, integrations, or cloud storage when they are not part of the agreed purpose.

06

Account for visitors, shared homes, and care settings#

A resident’s agreement does not answer every question when a spouse, roommate, visitor, tenant, employee, paid caregiver, or clinician may also be captured. Define notice, camera and audio boundaries, temporary pauses, who handles objections, and which setting-specific rules apply before installation.

In a Medicare- or Medicaid-certified nursing facility, federal rules protect resident privacy, self-determination, and participation in care and limit a representative to the authority granted by state law. Other facilities and shared homes may follow different laws and policies. Confirm the exact setting rather than transferring a home agreement unchanged.

07

Connect permission to the communication and response plans#

Use three separate records because they answer different questions. The privacy agreement says what may be collected or shared and who may access it. The family communication plan says when ordinary contact happens and what follows a missed call. The family response plan says who receives an alert, how it is verified, when a nearby person becomes involved, and where professional or emergency responsibility begins.

Link the records by role and trigger, not by copying every detail into every page. A nearby helper may need the parent's contact method, an agreed reason to call, and a limited entry instruction without receiving account passwords, full health history, location history, or continuous device access. A remote technology helper may need one-time screen access without becoming an emergency contact or permanent account administrator.

• Privacy agreement: purpose, data, viewers, private spaces, pause, retention, and removal.
• Communication plan: routine, channel, owner, backup, missed-contact ladder, and review date.
• Response plan: alert recipient, verification, nearby action, home access, escalation, and outage backup.
• Credential record: passwords, recovery keys, and one-time codes stay outside these shared worksheets.

Permission to receive an alert is not permission to inspect the account, enter the home, or monitor the person continuously.

08

Write the emergency-response rule, pause, and exit#

The person should know how to pause collection or revoke family access without needing the person being removed to cooperate. Define a narrow family emergency-response rule: the factual trigger, verification step, contact sequence, permitted family action, local emergency route, information recorded, and point when ordinary boundaries resume. The rule cannot create legal authority, authorize home or account access, waive recording law, or guarantee that an app reaches 911.

Document what happens when the technology is no longer wanted: cancel service, remove viewers and integrations, export only what is genuinely needed, request account or cloud-data deletion, factory-reset hardware, remove it from the router, and dispose of it safely. A reset or deletion request does not prove that provider backups, recipient downloads, exports, or records retained under applicable rules disappeared. Record what was requested, what the provider confirmed, and what could remain.

Set a review date and make disagreement, changed consent, an inaccessible pause control, unauthorized access, or a failed response path a reason to pause and reassess—not to expand surveillance quietly.