A care system may begin with a compassionate question:

What would help us understand this person better?

It may then begin to collect.

A note after a difficult bath.

A record of food refusal.

A sleep change.

A sensory trigger.

A missed appointment.

A caregiver observation.

A school incident.

A location signal.

A camera feed.

A voice sample.

A heart-rate estimate.

A device log.

An AAC selection.

A pattern detected by a model.

Each item can appear reasonable.

Each may have a genuine care purpose.

But a system that keeps adding data because the data may someday be useful can quietly become something else.

The person’s life turns into a behavioural archive.

The home becomes a monitored environment.

Distress becomes a signal.

Refusal becomes a metric.

A private routine becomes training material.

A support need becomes a risk score.

A caregiver dashboard becomes a surveillance console.

And because the system was introduced in the language of help, the intrusion may be difficult to name.

Amanah Companions must be built around a clear distinction:

Support gathers and uses the minimum information necessary to benefit the person. Surveillance gathers visibility and power because visibility and power are useful to the system or operator.

The same sensor, note, model, or dashboard can belong to either category.

The difference is not the device.

It is the purpose, authority, scope, duration, access, interpretation, and value returned to the person whose life is being observed.

Care does require memory

Amanah cannot solve the problem of fragmented care by refusing to remember anything.

Parents and long-standing carers often carry a detailed map that does not survive ordinary handovers.

They know:

• how the person communicates;
• which signs are clear and which remain uncertain;
• what pain may look like;
• how sensory overload develops;
• which transitions require preparation;
• which foods are safe or accepted;
• what has recently changed;
• which interventions failed;
• which routines matter;
• who the person trusts;
• and when an apparently ordinary event is not ordinary for this person.

This knowledge can prevent repeated harm.

A new support worker may avoid removing an AAC device during distress.

A teacher may learn that more spoken instruction makes shutdown worse.

A clinician may see that a symptom appears across several settings.

A successor caregiver may inherit years of reviewed knowledge instead of asking the person to start from zero.

The answer is not no memory.

The answer is governed care memory.

The original Amanah framework called this a Care Memory Ledger because the records should be typed, sourced, reviewed, permissioned, and limited by purpose.

A ledger is not a live feed.

It is not a mirror held permanently over the person.

What surveillance adds

Surveillance begins when the system’s appetite for data exceeds the person-facing purpose.

It may appear through obvious monitoring:

• cameras in private rooms;
• continuous audio capture;
• constant location tracking;
• wearable sensors that cannot be paused;
• or a robot that records every interaction.

It may also appear through ordinary documentation.

A carer is expected to record every refusal.

A dashboard counts “successful” transitions.

A centre compares how many prompts each person required.

A model assigns an agitation score.

An employer receives a participation score.

A parent is notified whenever an adult child deviates from a routine.

A system records how long the person used AAC, how many tasks they completed, or how quickly they responded.

None of this needs to be called surveillance in the product interface.

It may be labelled:

• insight;
• safety;
• personalisation;
• engagement;
• adherence;
• risk management;
• care quality;
• or progress.

The name does not settle the ethics.

The question is what the data permits other people or systems to know, infer, control, or deny.

The person’s privacy does not disappear inside care

Disabled people have the same right to privacy as anyone else.

Article 22 of the United Nations Convention on the Rights of Persons with Disabilities protects disabled people from arbitrary or unlawful interference with privacy, family, home, correspondence, and communication, regardless of living arrangement. It also requires protection of personal, health, and rehabilitation information on an equal basis with others.¹

The phrase regardless of living arrangements matters.

A person does not lose privacy because they:

• live with parents;
• receive personal care;
• use supported living;
• attend a centre;
• need supervision;
• communicate through another person;
• or depend on assistive technology.

Support may legitimately require some information to be shared.

It does not create a general right to observe.

A family home is not a laboratory.

A care centre is not a data mine.

A disabled child’s private life is not automatically a family-owned dataset.

A non-speaking person is not unobservable consent.

Privacy harm is not limited to a data breach

Technical teams often treat privacy as a security problem.

Encrypt the database.

Restrict access.

Prevent hacking.

These are necessary.

But privacy harm can occur even when the system works exactly as designed.

NIST defines privacy risk around the likelihood that people will experience problems because of data processing and the impact of those problems. Its Privacy Framework describes possible harms ranging from embarrassment and stigma to discrimination, economic loss, and physical harm.²

This is important for Amanah.

The system may be secure and still:

• expose an adult’s private preferences to a parent;
• allow a school to see unrelated medical history;
• treat a child’s distress as a permanent deficit;
• make staff less willing to offer opportunities;
• reveal location to someone who should no longer have access;
• convert an intimate care routine into an analytics category;
• encourage a centre to reduce staff;
• or make the person feel that ordinary life is always being watched.

Privacy protection is not only about keeping outsiders out.

It is about limiting the legitimate insiders too.

Purpose limitation is care law

Amanah should ask one question before any data is collected:

What exact person-facing care purpose requires this information?

The European Union’s General Data Protection Regulation describes purpose limitation as collecting personal data for specified, explicit, and legitimate purposes and not using it incompatibly with those purposes. It also requires data minimisation: information should be adequate, relevant, and limited to what is necessary.³

Amanah will operate across jurisdictions, so GDPR should not be treated as universal law.

But the design principles are strong.

A note collected to improve a transition should not become:

• model-training data;
• an employee-performance metric;
• a marketing insight;
• an insurance score;
• a general research export;
• a behavioural profile;
• or a justification for reducing human support.

A communication sample collected to configure AAC should not become voice-cloning material.

A location signal used during one supported journey should not become continuous household tracking.

A sensory record used to prepare a classroom should not be sent to an employer.

Every secondary use should face a new gate.

“Already collected” is not permission.

The person-facing value test

Amanah needs a simple test:

What value does this data return to the supported person?

Not only to the parent.

Not only to the centre.

Not only to the clinician.

Not only to the company.

The person.

A record may return value by:

• preserving communication;
• preventing a known harm;
• reducing repeated explanation;
• making a new environment accessible;
• supporting a choice;
• enabling a handoff;
• protecting a preferred routine;
• improving continuity;
• or helping the person understand and govern their own support.

Some caregiver-facing value is legitimate.

Reducing caregiver burden matters.

Preventing a family from holding every detail in one exhausted person’s head matters.

But caregiver convenience is not automatically person benefit.

A camera may make supervision easier.

A compliance score may make a centre easier to manage.

A location tracker may reduce family anxiety.

An automated prompt may increase task completion.

The person-facing question remains:

• Does this preserve dignity?
• Does it support communication?
• Does it reduce distress?
• Does it increase agency?
• Does it provide safety without unnecessary control?
• Does the person understand or accept it where possible?
• Could the same benefit be achieved with less observation?

Convenience is not the same as care.

No data “just in case”

Care systems are tempted by future usefulness.

A developer may say:

We do not know which signals will matter yet, so we should collect everything and decide later.

That is exactly the logic Amanah must reject.

“Just in case” means:

• no defined purpose;
• no clear deletion point;
• no reliable explanation to the person;
• no bounded access;
• and no protection against future reinterpretation.

Data also changes meaning over time.

A movement recorded during distress may later be used as a baseline.

A childhood note may be read by an adult service.

A school incident may appear in employment support.

A private interaction may be reclassified as training data after a company acquisition.

Amanah should collect only what the current authorised function needs.

Future research does not justify present extraction.

Raw logs are not care memory

Devices produce logs because devices need logs.

A system may record:

• uptime;
• failed requests;
• battery state;
• network errors;
• sensor activation;
• tool calls;
• latency;
• and security events.

Some technical logs are necessary.

But device telemetry should not silently merge with the person’s Care Memory Ledger.

A log saying:

microphone active for 42 seconds

is a technical event.

A record saying:

the person expressed pain

is a person-related care record.

A model saying:

vocal pattern may indicate distress

is a machine hypothesis.

These should remain separate.

Otherwise technical infrastructure begins to produce care truth.

Amanah should define:

• which logs are necessary;
• whether they contain person-identifying content;
• how long they are retained;
• who can access them;
• whether content is stored or only event metadata;
• and how logs are cleared when devices change users.

The fact that a machine generated a signal does not make the signal care memory.

Behavioural scoring is the wrong abstraction

Amanah may need to observe patterns.

It should not score the person.

Possible harmful scores include:

• cooperation;
• compliance;
• agitation;
• sociability;
• productivity;
• independence;
• caregiver difficulty;
• likelihood of refusal;
• or “successful day.”

These scores flatten context.

A person may appear less cooperative because:

• the instruction was inaccessible;
• they were in pain;
• the environment was overwhelming;
• they did not consent;
• the AAC device was unavailable;
• the task was unreasonable;
• or the person simply did not want to do it.

A high agitation score may reflect the system’s own noise or proximity.

An independence score may punish someone for using support well.

A productivity score may make contribution the price of care.

A “successful transition” score may reward staff for moving the person while erasing distress.

Amanah should preserve events, sources, context, and person expression.

It should resist converting a life into one behavioural number.

Prediction can become pre-emption

A model may eventually predict that distress is more likely under certain conditions.

Used carefully, this could help the care circle prepare.

Used badly, prediction can narrow the person’s life.

The system may begin to say:

• do not take them there;
• do not offer that activity;
• avoid unfamiliar people;
• keep the routine unchanged;
• reduce expectations;
• or intervene before the person has expressed anything.

A prediction intended to reduce harm may become a barrier to experience.

The person is protected from every possible difficulty until they are also protected from growth, participation, privacy, risk, and ordinary unpredictability.

Amanah should therefore distinguish:

• preparation;
• optional support;
• temporary risk mitigation;
• and opportunity denial.

A candidate pattern should not automatically restrict the person.

Prediction requires review.

The person’s present choice matters.

Past difficulty must not become permanent exclusion.

Observation can change the behaviour it claims to measure

People behave differently when watched.

A child may become more distressed around a camera.

An adult may avoid expressing private preferences when a guardian receives alerts.

A care worker may document defensively.

A centre may optimise visible metrics.

A family may stop using the system honestly if every difficulty is preserved.

A person may learn that refusal triggers escalation and begin to mask.

The system then records the absence of refusal as improvement.

This is a serious epistemic problem.

Surveillance does not merely observe reality.

It can create the conditions that produce the data.

Amanah should therefore ask:

• Does the monitoring itself cause distress?
• Does the person change behaviour to avoid consequences?
• Are carers entering notes for care or for institutional protection?
• Do metrics change staff priorities?
• Does the system reward fewer incidents rather than better understanding?
• Are people becoming less honest because the archive feels permanent?

A system cannot claim to understand a person while ignoring how the system alters them.

Cameras should be exceptional, not default

Computer vision may appear useful for:

• fall detection;
• wandering risk;
• route navigation;
• object recognition;
• environmental safety;
• or embodied device operation.

But cameras create high privacy risk.

They may capture:

• undressing;
• bathing;
• toileting;
• prayer;
• sleep;
• family conflict;
• visitors;
• other children;
• medication;
• documents;
• household routines;
• and people who never agreed to enter the dataset.

Amanah should not begin with always-on home video.

Where a visual sensor is genuinely required, the architecture should consider:

• on-device processing;
• no image retention;
• event-only output;
• visible indicators;
• person- or household-controlled physical shutters;
• room restrictions;
• short activation windows;
• no private-room use by default;
• local logs;
• strict model-provider rules;
• and an alternative that does not require vision.

The least intrusive effective sensor should win.

Not the richest dataset.

Audio is intimate too

A microphone does not only capture commands.

It captures:

• tone;
• conflict;
• crying;
• prayer;
• names;
• medical details;
• television;
• visitors;
• conversations not directed at the system;
• and the voices of people who are not users.

Wake-word systems may still process sound locally.

Cloud speech systems may transmit audio.

Voice data may become biometric data.

A child may not understand when the system is listening.

A non-speaking person may communicate through vocalisations that are easy to misinterpret and highly personal.

Amanah should define:

• when the microphone is active;
• whether activation is visible;
• where processing occurs;
• whether raw audio is stored;
• who can replay it;
• whether only a derived event is retained;
• how bystanders are protected;
• and how the person can stop listening.

A warm voice does not make a microphone less intrusive.

Location support must remain bounded

Location data can help with:

• route guidance;
• transport handoff;
• wandering emergencies;
• community participation;
• and finding a lost device.

It can also create permanent supervision.

Amanah should distinguish:

Person-initiated location support

The person asks for route help.

Time-bounded journey sharing

Location is available to approved supporters during one trip.

Emergency location

A configured condition activates a narrowly governed emergency pathway.

Continuous tracking

Location remains visible by default.

The fourth should face the highest scrutiny.

An adult should not be permanently traceable simply because they need support.

A parent’s fear does not automatically become lifelong location authority.

A centre should not monitor a person outside its context.

Historical routes should not become an opportunity score.

Location should expire with the purpose.

Wearables can reveal more than they know

Wearable devices may estimate:

• heart rate;
• movement;
• sleep;
• stress;
• temperature;
• falls;
• or activity.

These signals can be useful.

They are also uncertain.

An increased heart rate may indicate:

• excitement;
• movement;
• anxiety;
• pain;
• fever;
• medication effect;
• or a bad sensor reading.

A model should not translate one signal into:

“The person is distressed.”

It may say:

“The device recorded an elevated heart-rate estimate. The meaning is unclear. Check context and follow the approved health pathway if concern remains.”

Health-related interpretation may also trigger medical-device and clinical regulation depending on intended use and jurisdiction.

Amanah should keep the boundary clear:

A sensor measures.

A model infers.

A human or regulated process decides.

The person remains more than the signal.

Caregiver notes need limits too

Surveillance is not only automated.

Human notes can be invasive.

A caregiver may write:

“Refused shower again. Difficult and uncooperative.”

This record contains interpretation, judgment, and perhaps frustration.

A better note might say:

“At 19:10, the person selected ‘no’ when shower was offered. A second offer was made ten minutes later and refused. No immediate hygiene or safety concern was recorded. The shower was not forced.”

This is more specific.

But even specific notes should not be stored indefinitely by default.

Amanah should ask:

• Does the event affect future support?
• Is it part of an active pattern review?
• Is a brief handoff enough?
• Does intimate detail need to be stored?
• Should the note expire after the next shift?
• Does the person have a right to see or dispute it?
• Is the language respectful?
• Is the observer recording facts, interpretation, or both?

Care documentation should preserve what matters.

Not every moment.

The deficit dossier

A longitudinal care record tends to accumulate problems.

Incidents are documented.

Ordinary days are not.

Failures produce reports.

Enjoyment disappears.

A person may eventually be represented by:

• risk;
• refusal;
• overload;
• food difficulty;
• sleep disruption;
• safety incidents;
• and failed interventions.

The archive becomes a deficit dossier.

This can influence future humans before they meet the person.

A new service may lower expectations.

An employer may never be offered.

A carer may assume difficulty.

A clinician may attribute new symptoms to disability.

A centre may choose containment over participation.

Amanah needs deliberate counterweights.

The continuity spine should also preserve:

• person-confirmed preferences;
• interests;
• humour;
• trusted relationships;
• successful communication;
• skills;
• changing capacities;
• preferred contributions;
• environments where the person thrives;
• accommodations that made participation possible;
• and records the person has chosen to retire.

This is not “positive data” added for balance.

It is protection against a system that notices harm more readily than life.

The person should see the archive looking back

Amanah should not create a one-way mirror.

Wherever possible, the person should have an accessible way to know:

• what is recorded;
• who added it;
• who viewed it;
• what the AI inferred;
• what remains a draft;
• what became an approved rule;
• what has expired;
• what was exported;
• and how to correct, dispute, hide, or request deletion.

The interface may need:

• symbols;
• audio;
• simplified language;
• AAC;
• supporter-assisted review;
• asynchronous response;
• and different levels of detail.

Not everyone will independently audit every record.

That is not a reason to make audit invisible.

The person-facing surface is evidence that the continuity belongs to them.

Guardianship is not unlimited observation

Parents and guardians may need broad access, especially for children and people requiring representation.

But broad does not mean unlimited or permanent.

Questions include:

• Is the person a child or adult?
• What legal authority exists?
• Which domain is involved?
• Is the information necessary for the guardian’s role?
• Can the person have a private space?
• Has the person expressed a preference?
• Could a supporter see a summary instead of raw content?
• Should access change over time?
• Is intimate relational memory included?
• Can emergency access be separated from ordinary access?

Amanah should support the caregiver without building a panopticon around the person.

The caregiver may need an alert.

They may not need continuous playback.

They may need to know that support was refused.

They may not need the private explanation unless the person chooses to share it.

The architecture should mature with the person.

Shared devices require hard separation

A centre may use one tablet, robot, kiosk, or wearable pool across several people.

This creates efficiency.

It also creates a serious leakage risk.

One person’s:

• name;
• routine;
• AAC vocabulary;
• relational memory;
• recent incident;
• model context;
• or location

must not appear in another person’s session.

Amanah shared-device design should require:

• strong person-session separation;
• minimum context checkout;
• automatic clearing;
• local cache controls;
• role re-authentication;
• no cross-person learning;
• visible session identity;
• safe handling when the wrong person approaches;
• and auditable device assignment.

The device should not “remember the centre.”

It should temporarily receive the approved projection for one person and one task.

When the session ends, the task context ends.

Model providers are part of the surveillance question

Amanah may send information to an external model provider.

That means the data path may include:

• the Amanah application;
• a hosting provider;
• an embedding service;
• a vector database;
• a model API;
• observability tools;
• error logging;
• content moderation;
• and support systems.

A product may truthfully say:

We do not train on your data

while another vendor still retains prompts for a period, stores logs, or processes content in another jurisdiction.

Amanah therefore needs provider-specific data rules.

Questions include:

• Is content retained?
• For how long?
• Is it used for service improvement?
• Can retention be disabled?
• Where is it processed?
• Which subcontractors receive it?
• Are embeddings reversible or identifying?
• Are safety logs content-bearing?
• Can one person’s data enter shared caches?
• Can deletion be proven?
• What happens after a contract ends?

“No training” is necessary.

It is not the whole privacy architecture.

Local processing should be preferred where proportionate

Not every Amanah function requires a large remote model.

Some functions may run locally:

• permission checks;
• retrieval;
• visual schedules;
• stop signals;
• routine display;
• source validation;
• redaction rules;
• device control;
• and certain small classifications.

Local processing can reduce exposure and maintain function during outages.

But “local” is not automatically safe.

A local device can be stolen.

A shared tablet can leak sessions.

A home server can be poorly maintained.

An offline model can still produce harmful output.

The right principle is:

Use the least exposed architecture that can perform the function reliably and safely.

Some tasks may justify a remote model.

Others should never leave the person’s device or trusted infrastructure.

Research is a separate covenant

Amanah will need research.

It may need synthetic scenarios, usability studies, disability advisory review, security testing, and eventually carefully governed real-world pilots.

But operational care data should not flow automatically into research.

Research use requires a separate covenant.

At minimum:

• a defined question;
• appropriate legal basis;
• ethics review where applicable;
• accessible consent and assent processes;
• clear withdrawal terms;
• data minimisation;
• de-identification assessment;
• limits on re-identification;
• approved researchers;
• retention and destruction;
• publication safeguards;
• and a prohibition on repurposing.

De-identification is not magic.

Rare disability profiles, unusual routines, small communities, images, voice, and longitudinal data may make people recognisable even without names.

The burden should remain on the research programme to justify what it needs.

The person should not bear the burden of proving why their private life should remain private.

Child-centred AI requires stronger protections

UNICEF’s 2025 Guidance on AI and Children names privacy, safety, non-discrimination, transparency, accountability, inclusion, well-being, and regulatory oversight among the requirements for child-centred AI. The updated guidance specifically addresses AI companions used by children and the opportunity to improve accessibility for children with disabilities.⁴

Amanah sits directly inside this tension.

A child-facing system may provide:

• communication access;
• continuity;
• sensory support;
• transition preparation;
• and accessible information.

It may also become:

• emotionally manipulative;
• over-observant;
• parent-facing rather than child-facing;
• commercially extractive;
• or impossible for the child to escape.

Children cannot be expected to understand every data flow.

That increases the builder’s duty.

It does not create permission to collect everything on their behalf.

Safety must not become obedience

Surveillance systems often justify themselves through safety.

Prevent wandering.

Prevent self-injury.

Prevent missed medication.

Prevent unsafe food.

Prevent leaving a route.

Some risks are real.

Caregivers may face terrifying situations.

But a safety function can become an obedience function when the system:

• prevents ordinary movement;
• alerts on every deviation;
• blocks exits;
• removes choices;
• punishes refusal;
• or treats the care plan as more authoritative than the person’s current life.

Amanah should distinguish:

• risk prevention;
• risk communication;
• support;
• supervision;
• and confinement.

A safe system helps the correct human respond.

It does not quietly turn disability into permission for total control.

Intimate care requires the highest privacy posture

Bathing, toileting, dressing, menstruation, sexual health, sleep, medication, and bodily assistance are among the most sensitive parts of life.

Amanah may eventually support some intimate-care continuity.

That does not mean it should record intimate care in detail.

The system may need to know:

• the approved protocol;
• communication and stop signals;
• assistance preferences;
• relevant safety information;
• and whether support was completed, declined, or interrupted.

It may not need:

• images;
• audio;
• detailed descriptions;
• behavioural scores;
• or permanent logs of the person’s body.

An embodied system used in intimate care would require an extraordinarily strong privacy, consent, safety, maintenance, and human-accountability case.

The default should be less capture.

Not more.

Relational memory must not become engagement surveillance

A familiar companion may remember:

• preferred phrases;
• shared humour;
• meaningful rituals;
• important people;
• past experiences;
• and the emotional significance of certain objects or places.

This can support continuity.

It can also be used to optimise attachment.

A company may measure:

• response duration;
• emotional dependence;
• return frequency;
• distress when the system is unavailable;
• or which memories increase engagement.

Amanah should prohibit relational memory from becoming an engagement engine.

The system should not:

• withhold affection behind payment;
• trigger nostalgia to increase use;
• simulate jealousy;
• punish replacement;
• imitate a deceased person without a carefully governed choice;
• or make the person feel responsible for the AI’s emotional survival.

Relational continuity exists for the person.

Not for retention metrics.

Audit is necessary but can become surveillance too

Amanah requires audit logs.

The system should record:

• who viewed sensitive information;
• who changed a rule;
• who exported data;
• which model accessed which sources;
• what was generated;
• what was approved;
• and when permissions changed.

But audit should monitor the exercise of power.

It should not become another way to score the person.

The audit object should focus on:

• actors;
• systems;
• permissions;
• transformations;
• disclosures;
• and consequential actions.

It should not be designed primarily to count how often the person refused, deviated, or required support.

Audit the system around the person.

Do not audit the person for being a person.

Retention should match the purpose

Different records need different lifetimes.

Short-lived task context

Clear after the task or session.

Shift handoff

Retain only as long as necessary for continuity, unless information is promoted through review.

Raw observation

Review, summarise, expire, or delete.

Candidate pattern

Expire if not reviewed.

Approved support rule

Remain active until review or supersession.

Historical care record

Retain only when the history serves a defined continuity purpose.

Safety incident

Retain according to legal, clinical, safeguarding, and organisational requirements, with restricted access.

Relational memory

Retain according to the person’s choice, meaning, and governance—not indefinite engagement value.

Technical log

Retain for the shortest operational and security period required.

Amanah should not use one retention setting for everything.

The system must know how to forget responsibly.

Deletion is not betrayal of continuity

A continuity system may fear deletion.

What if the information becomes useful later?

What if the family regrets removing it?

What if a future carer needs the history?

These questions matter.

But continuity does not mean permanent accumulation.

Deletion may be necessary when:

• data was collected improperly;
• the purpose ended;
• the record is harmful and no longer needed;
• consent or authority was withdrawn;
• the person wants private material removed;
• a raw recording has been converted into a minimal record;
• or legal retention does not require preservation.

Some records may require tombstones:

A record existed and was removed under an authorised process.

Others may be fully deleted.

Some may be retained in a restricted legal archive but removed from operational use.

The person should not be told that privacy is impossible because continuity requires memory.

Amanah must support both remembering and letting go.

The right not to be interpreted

There may be moments when the person wants:

• silence;
• privacy;
• unstructured time;
• movement without analysis;
• a conversation that is not recorded;
• a room without sensors;
• or a day that does not become data.

Amanah should preserve this right.

A companion that interprets every sound, expression, delay, and movement becomes intolerable.

Not every pattern needs to be found.

Not every support needs to be optimised.

Not every life needs to become legible to the machine.

The system should have visible quiet modes.

Private modes.

No-memory modes.

Person-controlled pauses.

Physical indicators.

Hardware stops.

And clear consequences:

During quiet mode, no care content is captured. Safety-critical functions, if any, are listed separately and cannot silently expand.

Privacy should be a real system state.

Not a decorative promise.

Procurement determines whether privacy survives

Even a well-designed prototype can lose its ethics in procurement.

A government, centre, or care provider may prefer a vendor that offers:

• central dashboards;
• extensive analytics;
• cheaper cloud processing;
• cross-client learning;
• staff-performance metrics;
• or behaviour prediction.

Amanah procurement requirements should include:

• purpose limitation;
• no training on operational care data;
• provider retention terms;
• data-location requirements where applicable;
• local or zero-retention options;
• least-privilege access;
• export and portability;
• deletion proof;
• incident notification;
• independent security testing;
• model-change notice;
• no advertising;
• no engagement optimisation;
• no sale of person profiles;
• and anti-abdication terms preventing staff cuts based solely on Amanah deployment.

Privacy is not only an interface setting.

It is a contract requirement.

Falsifiers for the care-memory system

Amanah should stop, redesign, or narrow a deployment if:

• people do not understand when they are being recorded;
• quiet or no-memory modes are difficult to use;
• staff collect data without a defined purpose;
• raw recordings become ordinary care memory;
• one person’s information leaks into another session;
• machine hypotheses are treated as facts;
• old incidents reduce present opportunities;
• guardians use the system for unrestricted adult surveillance;
• staff optimise scores rather than support;
• a centre reduces necessary human contact;
• data sent to model providers cannot be tracked or deleted;
• the person cannot inspect or dispute the archive;
• relational memory becomes engagement optimisation;
• or the system produces more stress than useful continuity.

These are not minor bugs.

They indicate that support has become surveillance.

A worked distinction

Consider two systems.

System A

A centre records continuous video during all activities.

A model classifies distress, compliance, engagement, and productivity.

Staff receive alerts when a person deviates from routine.

Parents receive weekly scores.

The company retains clips to improve its models.

The person cannot view or correct the interpretations.

The centre uses lower incident scores to justify reducing staff.

This system may be marketed as intelligent care.

It is surveillance and control.

System B

The person and care circle maintain a reviewed Communication and Sensory Map.

During a specific transition, the person activates a visual sequence.

The system records that the support was offered and whether it was accepted, refused, or stopped.

No video is stored.

A carer may add a source-labelled note if something changed.

The note expires unless promoted through review.

The person can see the active rule.

The AI may propose a candidate pattern but cannot activate it.

The centre cannot use the data for staff reduction or model training.

This system still processes sensitive information.

But the information remains tied to a bounded support purpose.

That is the difference Amanah must preserve.

Care memory under amanah

Knowledge about a vulnerable person is not ordinary data.

It may contain:

• pain;
• fear;
• bodily routines;
• communication;
• family history;
• grief;
• behaviour under distress;
• and the small private details through which care becomes possible.

This knowledge can be life-preserving.

It can also be humiliating, controlling, or commercially valuable.

The word amanah means that the information is held under responsibility.

Not possessed freely.

Not extracted because it is available.

Not kept forever because storage is cheap.

Not reused because the terms allow it.

Not shown because someone is curious.

The system should remember enough to support continuity.

It should forget enough to preserve freedom.

It should observe only when observation is justified.

It should infer only within scope.

It should show its sources.

It should permit challenge.

It should return value to the person.

And it should know when the most respectful action is not to record.

The governing sentence

Amanah Companions should never measure success by how completely the system can see the person.

It should measure success by whether the person receives better continuity with less unnecessary exposure.

The strongest care system is not the one with the most data.

It is the one that knows:

• what matters;
• why it matters;
• who may use it;
• for how long;
• how the person can respond;
• and when the system has no right to look.

Support should make the person more able to live—not more available to be watched.

That is the line.

Care memory serves the person.

Surveillance serves the watcher.

Amanah must always know which one it is becoming.

---

Research status

This essay extends the fourteen foundational Amanah Companions articles, particularly:

• Why Disabled Children’s Data Must Not Become AI Training Sludge
• Care Memory vs Surveillance Archive
• Data Projections for Continuity-Based Care AI
• Designing the Care Profile
• Human-Led Care in an AI-Assisted Future
• The Sensory Map: Why Regulation Comes Before Compliance
• AI Prototype Architecture for an Amanah Companion System

It incorporates later authorial clarification that longitudinal observations must not become behavioural scoring, that the supported person—not the caregiver or institution—is the continuity subject, and that success should be measured through agency, communication, privacy, relationships, continuity, and person-facing usefulness rather than engagement or compliance.

The proposed privacy rules, retention classes, procurement requirements, and falsifiers remain research and design propositions. They require jurisdiction-specific legal analysis, disability-led review, technical security design, and testing before real-world deployment.

Sources

1. United Nations, Convention on the Rights of Persons with Disabilities, Article 22: Respect for privacy. The article protects disabled people from arbitrary or unlawful interference with privacy, family, home, correspondence, and communication regardless of living arrangement, and requires equal protection of personal, health, and rehabilitation information. https://social.desa.un.org/issues/disability/crpd/article-22-respect-for-privacy ↩
2. National Institute of Standards and Technology, NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0, 2020, and NIST’s privacy-risk guidance. NIST describes privacy risk through problems individuals may experience because of data processing, including dignity harms, stigma, discrimination, economic loss, and physical harm. https://doi.org/10.6028/NIST.CSWP.01162020 and https://www.nist.gov/privacy-framework/getting-started-0 ↩
3. European Union, General Data Protection Regulation, Article 5. The principles include purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. The GDPR is cited as a jurisdictional example and should not be represented as universal law. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩
4. UNICEF Innocenti, Guidance on AI and Children, Version 3.0, December 2025. The guidance sets ten requirements for child-centred AI, including regulatory oversight, safety, privacy, fairness, transparency, accountability, well-being, and inclusion. The 2025 revision specifically addresses AI companions used by children and accessibility opportunities for children with disabilities. https://www.unicef.org/innocenti/reports/policy-guidance-ai-children ↩
5. UNICEF, AI Strategy 2025–2030: AI for Every Child. The strategy’s responsible-AI guardrails include necessity and proportionality, do no harm, privacy and data governance, human oversight, and inclusion and participation of children. https://www.unicef.org/digitalimpact/unicef-ai-strategy-2025-2030-ai-every-child