How Deep Care’s AI health coach prioritizes privacy 

Workplace AI creates a dilemma. Employers want information that can improve employee well-being, but continuous data about how people sit, move and work can also be used to monitor them.

Deep Care, a German startup now expanding in the US, built its Isa desk coach to give feedback on posture, hydration and focus without a camera. The device uses a depth sensor and processes data on the device itself.

Co-founder and CEO Milad Geravand said it was designed to collect little, send no user data over Wi-Fi, and let employees choose whether to share monthly statistics with their company. Deep Care says it has grown to more than 300 enterprise clients across the EU and US, with more than 40 additional US companies in advanced discussions.

This story looks at how Isa tries to limit what an employer can learn about any one worker, and what three privacy takeaways business leaders can draw from it.

Takeaway 1: Collect less before you anonymize

The safest data is data that never exists. Isa’s depth sensor measures distances instead of taking pictures. “The sensor is unsuitable for identifying people, because it’s a 240×320 depth sensor,” Geravand said. He said an iPhone pairs a camera with a depth sensor for Face ID, while Isa “lacks the hardware needed to achieve that level of fidelity.” The sensor cannot see through glasses or beyond 1.5 meters, he said.

Less data collected does not prove that nothing can be learned from it. Geravand said independent reviewers judged the sensor’s resolution unsuitable for identifying anyone, but the methods behind that judgment are not public. That conclusion rests on the company’s account.

Takeaway 2: Removing names is not the same as anonymity

Isa lets employees share monthly posture, hydration and focus trends through a QR code. Geravand said the code holds one paragraph of encrypted text, shown on the employee’s own screen in a browser and added to company-wide statistics only if the employee chooses. It contains no personal information or location, he said. “It cannot be connected to a person, even if it was decrypted.”

Encryption keeps data private while it is locked. Whether numbers stay anonymous once opened is a separate question, and Geravand said a 2020 outside review looked at it directly. The reviewers examined whether individuals could be picked out of company statistics, and whether someone’s presence at a desk could be read from daily figures. For this, the design rule was to “keep the employer at arm’s length from individuals,” Geravand said. That meant individual figures stored where the employer cannot reach them, and statistics grouped in sizes that keep anyone from standing out.

Those are design rules, not mathematical proof. NIST’s guidelines on differential privacy, finalized in March 2025, describe a way of defining privacy with mathematical rigor. Geravand did not say Isa uses differential privacy or offers a formal guarantee against re-identification.

Takeaway 3: Make “voluntary” real

Isa’s data sharing is optional and can be withdrawn. Geravand said the reviewers set a standard that the device must never offer “an easier way to monitor someone than what already exists.”

An opt-in button does not settle the matter on its own. The European Data Protection Board has said that because of the imbalance of power between employers and staff, employees can give free consent only in exceptional circumstances, where refusing carries no adverse consequences at all. For employers, that puts the weight on how a program is run: whether declining is truly free, and whether sharing is tied to evaluations, pressure from managers or team expectations.

What is not known

Fraunhofer IOSB and the FZI Research Center for Information Technology reviewed Isa’s planned design in 2020, through the CyberProtect program, Geravand said. The review was an architecture workshop and a written analysis finalized in September 2020, while Isa was still in development. He said the reviewers concluded the concept met privacy and security requirements.

The findings are in German and contain product roadmap details, so Deep Care cannot share them. Their conclusions cannot be checked independently, and a review of the planned design does not show that later production changes were assessed.

For business leaders weighing any workplace device, the questions are plain. What does it collect? What could be worked out from its outputs? Who can see individual records? Is declining free of consequences? And what evidence supports the vendor’s claims?