Video time studies and employee privacy

Short answer

Yamazo Studio can blur the faces in a recording before analysing it, and it can switch off the views that show individual people. Your team chooses both; neither happens by itself. Neither replaces informing the people who are filmed. Filming employees to monitor their performance or behaviour is prohibited or restricted in some countries. Depending on the country and the case, prior approval or co-determination by a works council, union or employee representative may be required; such approval does not replace the legal basis for filming; the in-app status record, warnings and choices do not verify that this requirement is met and do not block any action. Whether and how a video time study can run in your company is a question to settle with your own legal adviser. This guide only describes what the software does, so that you can ask the right questions.

What the software does with video

Blurring faces is a choice made at import

The analyst ticks the face blurring box when selecting videos. If it is not ticked, import runs as usual.

Blurring is done on a separate copy; the pixels are replaced, not hidden

Studio decodes the video, replaces each detected head region with a coarse mosaic and a black bar, and encodes the video again. This is not an overlay; the details of the covered region in the copy are permanently changed. The original file is never touched and, by default, stays where it is. Blurring does not mean the person can no longer be recognised. The blurred copy can still count as personal data; voice, body and surroundings can still identify the person.

How faces are found

A body-pose model looks at every fifth frame. A head is covered if at least one shoulder is visible and at least two face points are recognised, so a hand holding a part is not mistaken for a face. Between those frames, and for a short time after a person leaves the picture, the covered area stays in place and grows. Some regions can be missed.

If it cannot run, it refuses

If the model files are missing, the option is not offered and nothing is written. If encoding stops halfway, the unfinished file is deleted.

It runs on the same computer

The model files ship with the application; for this step the video is not sent anywhere.

The original record stays unless you delete it

The blurred copy is saved next to the original file and added to the project. A separate box, off by default, deletes the original file once the copy exists. Keeping or deleting the original file is the responsibility of the company using the software. A deleted original cannot be restored.

Privacy mode

A switch in Settings, off by default. When on, the Skill Matrix, the list of eligible operators and the per-operator yamazumi are closed. In the project export file, in facility and snapshot packages, and in standard work (SOT) and yamazumi exports, the operator's register number is written instead of the name; names stay on the Operators screen, and other reports may show names.

Employee representative status record

Studio keeps one record per company: no works council, works council but no approval, or approval given (date, document number, scope, who entered it). Before person-level views, video capture, time studies and named exports, if the answer is open or "no approval", it asks about the company's status once per session and action. It never blocks the work. If the user continues anyway, that choice is written to the audit trail, and every change to the record is also logged. The record stores the statement that was entered and the choice that was made; it does not verify that a valid approval was obtained. The audit trail helps in noticing inconsistencies in the record chain; it does not prove who performed an action or that the records are complete.

What leaves the computer

In ordinary local use, video, study and operator data are not sent to the vendor; licence data is processed separately. There are two exceptions: videos you upload on the review page at yamazovas.com and support files you send by e-mail (both fall under the data processing addendum). Also, if you enter a server address in Settings and start an optional analysis job, the video is sent to that address. If you choose to e-mail a backup file for support, it is kept in the vendor's mailbox and on disk while your request is open; when the request is closed it is deleted from there, and the deletion is logged. The licence mechanism sends a short background message at most once an hour, on by default: the licence e-mail domain, hardware ID, app version, operating system and number of customer records. This information is sent for licensing and may count as personal data. The update check is on by default (off in air-gapped mode). Error reports are off until a user agrees; when on, they carry technical error data together with organisation, user and hardware IDs and the licence e-mail domain; the consent text says the reports contain no study, video, name or measurement.

Storage and deletion

The application database is encrypted with a key tied to this computer; this makes it harder to open the file on another computer, but it does not stop someone who has access to the computer. Video files are not encrypted. Deleting a project also deletes the copies the application made: uploads, blurred copies, the conversion cache and thumbnails. An original file kept elsewhere, and files another project still uses, stay. Freed disk blocks are not overwritten; managing backups and disk remnants depends on the employer's IT processes, and the software cannot give any assurance about them.

What the software does not do

• It does not promise that every face will be found; a person who does not meet the rule above is not covered.
• It does not remove the voice: the audio is copied into the blurred copy as it is.
• It does not stop a person from being recognised from their surroundings. Even with a blurred face, a person can be recognised. At a single-operator station, blurring does not hide who the person is: the setting, the shift roster or a visible time stamp can still point to the person. The appropriate legal basis for filming, prior notice and any other applicable requirements must be assessed separately.
• Privacy mode does not change the video; it limits person-level screens and exports.
• There is no retention period; it does not delete videos by age.
• The status record, warnings and choices do not verify that a legal basis for filming or representative approval exists, and they do not block actions; whether these exist and are valid is the responsibility of the company using the software. The name in the audit trail is typed text, not a verified identity.
• It does not encrypt video files; the database key is tied to this computer and does not prevent access to the computer.

What the employer still has to arrange

All of this is to be settled with your own legal adviser; the guide draws no conclusions.

• Informing the people who are filmed before recording; details differ by country.
• The purpose, the legal basis, who sees the recording and how long it is kept.
• Whether the blurred copy is enough, whether the original recording is deleted, and when.