“I Don’t Want to Become a Number’’: Examining Different Stakeholder Perspectives on a Video-Based Monitoring System for Senior Care with Inherent Privacy Protection (by Design).

Active and Assisted Living (AAL) technologies aim to enhance the quality of life of older adults and promote successful aging. While video-based AAL solutions offer rich capabilities for better healthcare management in older age, they pose significant privacy risks. To mitigate the risks, we developed a video-based monitoring system that incorporates different privacy-preserving filters. We deployed the system in one assistive technology center and conducted a qualitative study with older adults and other stakeholders involved in care provision. Our study demonstrates diverse users’ perceptions and experiences with video-monitoring technology and offers valuable insights for the system’s further development. The findings unpack the privacy-versus-safety trade-off inherent in video-based technologies and discuss how the privacy-preserving mechanisms within the system mitigate privacy-related concerns. The study also identifies varying stakeholder perspectives towards the system in general and highlights potential avenues for developing video-based monitoring technologies in the AAL context.

video-based technologies and discuss how the privacy-preserving mechanisms within the system mitigate privacy-related concerns.The study also identifes varying stakeholder perspectives towards the system in general and highlights potential avenues for developing video-based monitoring technologies in the AAL context.

INTRODUCTION
The global population is experiencing a signifcant aging trend, leading to an increased demand for technologies for care.Active and Assisted Living technologies enable older adults to maintain their independence, well-being, and overall quality of life [75,77].Recently, advancements in computer vision techniques have given rise to AAL solutions stemming from their visual sensing, detection, and recognition capabilities.Examples include video monitoring systems (VMS) in care homes or private households of older adults with diferent features: health parameters detection, emergency event detection (e.g.falls), videoconferencing to support care tasks, etc.These camera-based solutions ofer superior information capture compared to other solutions based on typical smart home sensors.Coupled with contemporary activity recognition algorithms, camera-based systems can analyze and accurately detect not only intricate situations (e.g., emergencies) but also everyday activities at home (e.g., resting, exercising, cooking) [67].These capabilities make camera-based technologies particularly versatile and adaptable for providing care [18] -they ofer an enhanced sense of safety and reassurance for both older adults and their caregivers [17].However, the considerable advantages of processing visual data are accompanied by numerous concerns about privacy and data security, particularly given the sensitive nature of visual information.
In response to privacy threats, already over two decades ago, researchers proposed the concept of Privacy by Design (PbD) in ubiquitous systems as a means of safeguarding data through inherent technological design [53].Since then the PbD practices have been actively detailed, extended, and contextualized by researchers of many disciplines, including legal studies (e.g., [43,90]), Human-Computer Interaction (HCI) (e.g., [99]) and assisted living system design (e.g., [13]).Specifcally, researchers developed various privacy preservation techniques tailored to visual data for video-based AAL technologies [16,30].Most recently, Ravi et al. [78] ofered a review of the existing visual privacy protection methods for active and assisted living under the PbD framework.On the whole, researchers concluded that these techniques aim to improve the safeguarding of privacy and minimize users' perceived barriers to the adoption and use of AAL technologies [59].
However, despite the technological and conceptual advancements in this area, the real-life user experiences associated with the aforementioned technology are often overlooked by researchers.While privacy seems to be a pivotal concern for older adults in the process of adopting assistive technologies (AT) [100], little empirical evidence is available specifcally about video-based AAL technologies [64].With the rapid advancement and adoption of AAL systems, we see a need for in-depth empirical studies that explore user experiences for these specifcally targeted technologies.This becomes particularly evident when considering vision-based systems with inherent privacy-protection design, given the lack of empirical studies regarding user experiences with such systems, encompassing both the overall system usage and its privacy aspects in particular.
Against this backdrop, we adopted a PbD paradigm and further advanced it to a "privacy-by-context" approach [14], which involves tailoring privacy measures based on specifc contextual factors, such as the environment, situation, or user preferences.Instead of applying a uniform privacy standard, this approach adapts privacy settings dynamically to align with the varying conditions and requirements of diferent contexts [14].Based on this approach, we report on the development, deployment, and evaluation of a video monitoring system prototype with an inherent privacy preservation model.Inspired by participatory and contextual research traditions, we conducted a qualitative study in an assistive technology center in Italy to understand the perspectives of diferent stakeholders involved in the process of care provision and reception.We included three stakeholder groups in our study: older adults as primary stakeholders of the VMS system, healthcare professionals from an assistive technology center as secondary stakeholders and technologists of the assistive technology center as facilitating stakeholders.Following a human-centered design approach, we aim to inform the next iteration of the VMS prototype towards designing a video-based AAL system that efectively addresses privacy concerns while catering to the distinct needs of the target user groups.
In this paper, we set the following research questions: (1) What are the diferent stakeholder perceptions and experiences of the system in general and, specifcally, when it comes to privacy? (2) What are the design opportunities for the further development of the system?This paper ofers three principal research contributions.First, by addressing the emergent need for privacy-preserving solutions in the feld of active and assisted aging, we report on the development of a novel privacy-by-context-inspired video-monitoring system for the caregiving setting.Second, responding to the lack of empirical research in the state of the art concerning vision-based systems in the AAL context, we ofer comprehensive qualitative accounts of older adults and other stakeholders engaged in care provision and reception regarding video-monitoring technology, especially focusing on privacy.Third, our empirical observations equip researchers, designers, and practitioners with contextualized insights for design opportunities of technology solutions that genuinely resonate with the needs and expectations of the involved stakeholders within the caregiving ecosystems that rely on video-based AAL (monitoring) technologies.

RELATED WORK
Our work lies at the intersection of the following principal research areas: (i) user needs for video-based AAL technologies, privacy, and beyond; (ii) the development of video-based AAL technologies; (iii) and their privacy-preserving mechanisms.

User needs for video-based AAL technologies, privacy, and beyond
With the rapid development, proliferation and adoption of ubiquitous computing technologies, researchers aim to understand older adults' needs and requirements for successful aging in those technology-laden ambient computing environments.In the early 2000s, user studies in a living lab setting already explored the potential of aging-in-place technology [65].They emphasized the advantages of such ambient computing systems in supporting the life of older adults in recognizing and averting crises, assisting their daily routines, and supporting peace of mind for adults' children.
A decade ago, a review of 25 years of Computer-Supported Cooperative Work in healthcare suggested that the adaptation of AAL systems would involve intricacies far beyond their intended purpose to routinely recognize or infer activities of daily living [33].Specifcally, privacy and security concerns seem to be substantial aspects that impede the successful adoption of AAL technology in everyday settings [63,73,83,98].Nevertheless, it would be a misrepresentation to oversimplify the discourse on privacy concerns related to AAL technology in general without considering additional variables [5].Researchers particularly emphasize a multifaceted interplay of human factors, psychological and cultural determinants as an important consideration for older adults' use of emerging technologies [62,91].Almost two decades ago, Caine et al. with their empirical study on visionbased systems provided the frst evidence, that certain privacy concerns are intricately linked to situational variables.Their fndings proposed that factors like device type and the level of older adults' functionality impact privacy concerns across various contexts.Importantly, when benefts are signifcant, privacy concerns can often be downplayed, even when it comes to camera-based systems [10].These ideas of context-dependency are shared in the later body of literature as well.Namely, Mitzner et al. demonstrated that despite prominent security and reliability concerns, older adults reported more positive than negative attitudes about the technologies [63].Jaschinski et al. in a recent study concluded that participants appraise aging in their preferred home environment as a valid trade-of for some loss of privacy, despite having signifcant privacy concerns [49].Schomakers et al. further delved into the trade-of of Privacy versus Security, indicating that when technologies for aging-in-place provide essential life-saving security advantages during critical moments, worries about privacy are overshadowed [84].They also argued that in such contexts, privacy concerns are not as prominent as the benefts of assistive technology use and revealed that these concerns may impact technology acceptance to a lesser degree [83].Despite recognizing the conditionality and tradeability of privacy in the aforementioned and numerous further studies, there is a notable gap in progressing beyond privacy threats and exploring the contexts where these technologies achieve their aim -successful ageing and improved care of older adults.
Hence, we identifed two main shortcomings based on the current body of literature: (1) Overall lack of empirical studies on actual use of video-based AAL systems (2) Inability to progress from privacy concerns to successful video-based system implementation First, there is a signifcant lack of user studies that focus specifcally on video-based systems.In a recent literature review on the acceptance of video-based AAL systems, only 22 empirical studies were identifed with a specifc focus on vision-based systems out of numerous ones on general AAL technology [64].The review also highlights methodological weaknesses in the existing studies, coupled with the fact that in nine of the 22 studies, participants did not have any direct contact with the proposed technology when answering questions about privacy considerations and its acceptance.The authors concluded that empirical research in this domain seems to be in an exploratory stage and called for more context-specifc studies to comprehensively address actual users' experiences with video-based AAL.
Second, most of these existing empirical studies on vision-based systems delve into privacy issues only, which is certainly the most important aspect of these systems, given the sensitive nature of surveillance.However, this has led to overlooking broader aspects of user experiences in video-based systems in the care context.We consider that the lack of user studies in the feld further backfres on this challenge.There is a need to advance the implementation of fndings on privacy considerations to additional system characteristics that cater to the needs of older adults.Given the substantial body of literature suggesting the contextual dependency of privacy trade-ofs, it is time to take a step forward in the development and deployment of these technologies based on user contextual preferences.Iliev et al. [48] provided a successful example of these eforts with their preliminary study.They proposed a privacy-preserving design of a video-monitoring system that emphasizes user autonomy by enabling individuals to easily control video monitoring when possible, ofering a personalized choice based on the user's assessment of their condition.
Drawing on the aforementioned research in the area, our work addresses the pressing need to conduct user research on visionbased AAL systems.We suggest a privacy-by-context approach, which takes into account holistic user experiences, incorporating contextual factors like environment, situation, and user preferences, to address users' privacy needs and take a step forward in tailoring video-based technologies to actual user needs.

Video-based monitoring systems in AAL
AAL technologies have been rapidly advancing throughout the last decades.Common home automation sensors, such as pressure mats on beds, motion detectors, and contact sensors on doors, along with wearable sensors, have formed the foundation of monitoring systems aimed at aiding individuals and enhancing their well-being.Nevertheless, the usefulness of binary sensors is rendered suboptimal when complex scenarios necessitate a more comprehensive understanding of the environment and an individual's activities [67,74].In such instances, the integration of visual sensors, coupled with pattern recognition and machine learning approaches, can yield intricate insights into both the environment and the users.This synergy drives the growing popularity of computer vision technologies for assisted living solutions [60].
One practical application stemming from these technological advancements is the development of video healthcare monitoring systems, with telehealth serving as a prominent example, enabling users to connect with caregivers or physicians through audio and video calls via smart devices [87].At the same time, advancements in machine learning and the evolution of image processing techniques have played a pivotal role in enhancing video monitoring.Artifcial intelligence (AI) integration into video monitoring systems has empowered them to monitor crucial vital signs, including heart rate, respiratory rate, oxygen saturation (SpO2), cough analysis, and blood pressure [80].For example, Bousefsaf et al. [7] monitored pulse rate patterns in a video frame region of interest based on movement fuctuations during breathing.Kidziński et al [50] developed a deep learning model capable of analyzing human gait in a given video.
However, these approaches require user interaction to initiate the system, and this poses a limitation during emergency situations.Conversely, automated video surveillance systems provide a solution to this.Originally designed for security purposes, these systems have undergone signifcant developments and adaptations, transitioning from frst-generation analog cameras to contemporary smart cameras employing AI.Signifcant leaps in development hardware for faster processing, data compression methods for rapid video transfer, and computer vision for automatic video interpretation have enabled smart cameras to be employed for context recognition from the scene [21].
Real-time surveillance systems based on fxed cameras rely on background suppression, i.e., segmenting out individuals [29].While prior research primarily focused on handcrafted features such as Histogram of Oriented Gradients [23] and traditional classifers like Support Vector Machines, their limited performance in real scenarios and complex backgrounds prompted a shift with the advent of deep learning technologies.New methods within this paradigm have shown substantial improvements and widespread applicability in various tasks such as action detection [89], pose estimation [12], anomaly detection [1], and fall detection [69].These present promising opportunities for adoption and use in AAL environments.

Privacy-preserving video monitoring in AAL
However, the use of visual sensors and cameras in private places brings concerns about privacy, especially when bystanders are involved, which hinders the acceptability of these technologies [32,51].To counter this, researchers have come up with several solutions that can be classifed according to the diferent levels at which data can be protected.This is studied in the work by Colonna and Mihailidis [19] that explores the derivations of EU data protection regulations, and how these afect privacy mechanisms.Once the necessary mechanisms are established, the authors then explore the diferent levels at which privacy mechanisms can be implemented, according to a PbD framework.These levels are identifed as: sensor, model, system, 'user interface' (UI), and user.
In some occasions, data is not to be captured under certain conditions, set up by the observed person (sensor level); in other cases, data is to be stored only if relevant and not interfering with thirdparty rights (system level); or must be processed securely (model level); fnally, data is not to be visualized by unauthorized individuals (UI level).
Several examples of each category exist.For instance, at the sensor level, by automatically disabling data capture when users wear certain types of clothing or tokens on them [82], or when they perform certain gestures [52,88] and also by hindering the capability of cameras to capture video, using a source of infrared light on a wearable device that renders images unusable [22].
Examples from the model and system levels (regarding processing and storage) also exist.Minneman et al. [61] examined the utility of the Where-Were-We application, which captures video during structured activities and meetings, allowing users to access data in real-time or later.Similar applications, using SenseCam [35] and StartleCam [44], emphasize the bufering of video content for selective archiving based on triggers like emotional changes.Hayes et al. [41] developed an extensible model for selective archiving called Experience Bufers, aiming to leverage various media types and adapt to specifc application needs and domain sensitivities.The Experience Bufers Architecture (EBA) involves capture services within an environment that temporarily store information based on user-defned timeframes.These privacy protection techniques were used in diferent applications, such as memory recall tools [46] and as behavioral monitoring tools to capture eating patterns [15].
Regarding visual protection at the UI level, researchers have developed automated data obfuscation methods that can protect non-consenting individuals in the image, as well as sensitive parts of it, such as credit card details and other private information.This has led to the concept of privacy-protecting cameras [79], and the use of so-called data obfuscation flters [32,71].These are image flters that reduce the image information by means of a simplifcation of color information, removing excessive detail in the image and causing small details, such as prints in e.g.credit cards or phone screens, to be rendered unreadable, thus protecting its contents.They can also be used on the appearance of people, to hinder recognition of individuals, while keeping an understanding of their range of movement, or the actions performed.These flters can include 'classical' variants, such as Pixelating and Blurring, but also more advanced ones, such as Cartooning [32] and replacement by Avatars [16,71].However, it is not always clear whether masking the images or otherwise obfuscating the information can retain the image utility since overly redacted data is difcult for humans to understand [2].It is, therefore, imperative to fnd solutions that remove the visual information that is unnecessary to understand the user's interactions with the environment, while keeping a high degree of utility and image interpretability [30,39].
Padilla-López et al. [71] established a privacy-by-context framework in which the observed person is able to decide the type of visual protection required, or perceived as necessary, depending on variables of the context, namely: the relationship with the observer, the time of day, the level of nudity, the activity being performed, the room in which it happens, as well as the level of emergency (i.e.presence of falls or accidents).Some parts of this context can be derived from external variables (time, date, sometimes location), whereas others need to be detected by automated detection systems (e.g.nudity, activity, level of emergency).Furthermore, the authors provided an implementation of a series of visual protection flters, that could dynamically adapt according to some contextual cues, with some limitations, and using the technologies that were available at the moment [14,71], such as RGB-D devices that facilitated the task of human body segmentation in order to more easily apply the visual protection flters envisaged in the work.
Recent advancements in deep learning (DL) in the felds of human and object segmentation [42], body part detection, and pose estimation [11,37], have facilitated the task of human segmentation for privacy-preserving methodologies.This progress marks a signifcant leap, enabling the development of more versatile and accurate VMS solutions aligned with the requirements of AAL environments [94].Building upon [71], Climent-Pérez et al. [16] developed an RGB-only system that capitalized on the use of ofthe-shelf DL-based segmentation and pose estimation algorithms.
Regarding the selection of privacy flters, and the level of protection provided as perceived by the users, Padilla-López et al. [71] also performed a survey on users, regarding their views on each of the proposed flters.This was to validate flter choice, given that the flters implemented were based on methods commonly used in media, but had not been validated for AAL scenarios.Questions included whether the interviewees could still determine who the person was, the level of nudity, or clothing choices.The design of flters for the proposed VMS prototype was based on this feedback.
In what follows next, we describe our developed video-based monitoring system.

VIDEO MONITORING SYSTEM DESCRIPTION
As seen in the previous section, privacy protection mechanisms can be implemented at diferent levels.In our study, the focus is brought to visual data protection at the visualization layer (UI level).This enables the user to determine not just 'if' they want to be seen, but also 'how' they want to be seen.The hypothesis here is that users might choose diferent options for visualization by others depending on who is the observer, when are they accessing the feed, as well as other contextual cues.So this is not just about making decisions regarding which data is to be kept, and which to be destroyed, like in solutions regarding secure storage and processing (selective archiving or EBAs, seen above), but also, how the data is travelling via the network (and is made leak-proof), and how the context determines what will be seen at the other end.While these techniques align with our goal of maximizing user privacy by enabling individual choices, our unique contribution lies in using context as a relevant cue for deciding the appropriate visualization flter, as well as addressing the specifc domain of senior care, providing distinctive perspectives within this context.We frst describe a scenario of use and the rationale of our privacy-by-context video-monitoring system before overviewing its implementation.

VMS use scenario.
The idea is relatively simple: older adults (i.e. the systems' primary users) living in their preferred environment may opt to install cameras in their homes to support their well-being.These cameras have the intent of detecting situations that might pose a danger to them or otherwise provide caregivers with relevant information on the users' health status.These caregivers are often family members, professional caregivers, healthcare providers, or alike.However, not every observer who uses the system to check on the user has the same relationship with them, therefore, diferent privacy protection modes are applied depending on the context (e.g.privacy-by-context).Furthermore, other contextual cues (e.g., time of day, room observed, nudity level, activity performed) may vary the level of protection the user deems necessary.To illustrate our point, consider the following fctional situation: "Mary, the daughter of Julie, can access the video unrestricted at all times, given their close relationship; but her caregiver, Fred, can only see an avatar replacement unless a fall is detected."In this situation, the system needs to: 1) detect where a person is present in order to provide a protected view of Julie and 2) detect falls by being context-aware so that Fred can see if Julie is hurt badly after a fall.
Figure 2 shows an overview of the whole system.The video monitoring system includes a series of cameras in the primary user's home, as well as an automated context extraction module.This module extracts cues about the context that will be used, combined with the primary users' preferences, to determine the visualization (type of fltered video) that will be provided to the caregiver on their interface.In the example in Figure 2, the daughter of the observed person is logged in (as user_01) at 2 pm and is watching the living room.The observed person is dressed, walking, and no emergency has been triggered.Therefore, with this contextual information, the observer can only see the avatar replacement flter, as this is the preferred view for this scenario, as set by the observed person.
The system therefore provides an interface for the caregivers, where notifcations, access to the protected visualizations, as well as communication with the primary users are possible.
In our study, we have gathered insights from various stakeholders involved in the care process, obtaining their perspectives on the entire system, privacy flters implemented, and the fall detection application, which is discussed in the following section.o ..." (changes to link new content to existing) 3.0.2Implementation of the VMS.We will now provide an overview of the implementation of our video monitoring system.
This VMS has a focus on privacy preservation, and exclusively relies on RGB data, without the need for additional inputs.We, therefore, eliminated previously existing constraints on the use of specialized sensors (i.e.RGB-D cameras) for person detection, segmentation, and pose estimation.Historically, the requirement for depth information was a challenging constraint.RGB-only methods were inefcient when it came to achieving robust visual privacy preservation.Their accuracy lagged behind systems using depth information as an additional cue.It was not until the advent of 'deep learning '-based methods for human pose estimation [11,37] that this was made possible.However, the system described by Climent-Pérez et al. [16] was not tested at interactive frame rates (i.e.'realtime' performance), as data was processed ofine, due to the large size of the models employed, and slow inference speeds, particularly that of DensePose [37].Considering the advancements in embedded hardware, their computational power, and the increase in the use cases, in order to provide online video processing, a lighter pose estimation is thus necessary.Rakhimov et al. [76] undertook this challenge, and, by using DL advancements since the publication of DensePose, were able to reduce the required resources and latency drastically.We therefore use their 'fast and light' DensePose (FL-DP) model in the prototype as an alternative to the one proposed by Climent-Pérez et al. [16].
Figure 3 presents the overall process employed for the transformation of the input image in the privacy-preserving VMS.The system frst receives a video input and utilizes the FL-DP model to extract pose and body information efciently.It subsequently applies various flters shown in Figure 1 (Blurring, Pixelating, Avatar, Elimination) to safeguard sensitive information, such as the appearance of humans in the image.As displayed in Figure 3, we employed pose estimation (green box) and human segmentation algorithms (violet) to detect human presence and pose.In our prototype, we simplifed this process by using the method described in [76] for both tasks.
The initial step involves modelling the background of the scene, what produces an empty image of the environment, ensuring the user's elimination from the video by overlaying the protected visualization only when necessary.Starting with the Elimination flter is crucial to prevent revealing any identifable clothing or limbs missed by the FL-DP model (mask errors, i.e., false negatives), which would undermine the system's purpose.Blurring and Pixelating flters use the original foreground mask (identifed person) and reduce the data, which is then drawn on top of the elimination mask from the previous step.Similarly, the Avatar flter is overlaid onto the background (elimination mask) using pose information from the FL-DP algorithm.This concise sequence of steps efectively preserves privacy while concealing sensitive information.Ultimately, we deployed the VMS system on an NVIDIA Jetson Xavier NX device due to its optimal combination of computational power, power efciency, portability, and cost-efectiveness.For recording purposes, an RGB camera with high-defnition (HD) resolution was employed.We now describe diferent visualization methods illustrated in Figure 1.
Pixelating and Blurring.These two flters both work similarly.First, the Elimination flter is applied, and the foreground mask undergoes a transformation to reduce visual information to an extent in which the person's pose is still recognizable, but their identity is not.These two flters are part of an "intermediate" level of protection since gender, nudity, ethnicity, or hairstyle might still be recognizable, but specifc and highly sensitive body parts or details of them are not (e.g.tattoos, breasts, genitals, etc).
Replacement by Avatar.This is carried out using the output information from the FL-DP algorithm.Its output consists of a pixelaccurate body part map, including their 2D coordinates.This map can be used to draw an avatar with the correct pose on top of the body parts identifed, covering the original appearance of a person, in the area of the image where a human was detected.This allows for a highly anonymized visualization of the person's movements and actions while removing all other visual features (gender, ethnicity, nudity, recognizable traits, etc.).This level of privacy protection can be used by observers needing to see the range of motion of the user while preserving the identity of the observed individual.
The Elimination Filter.The background model, therefore, serves as the elimination.This is the highest level of visual privacy preservation.It only allows the observer to get certain contextual cues of the environment (e.g.lighting conditions), without any representation of the observed subjects.This level of data protection could potentially be used for observers who do not have a close relationship with an observed individual, or when an individual wishes for a maximal level of privacy.
Apart from the proposed four flters, we have implemented a context-aware Fall Application model (Figure 4) based on the concept of "privacy-by-context" frst introduced by Padilla-López et al. [71].In this approach, privacy protection is not considered as a rigid set of rules, but rather, depends on several factors that can impact whether a privacy protection level is appropriate in a given scenario.An example of this could be an emergency situation, such as falls happening in the home environment.If a person falls, it might be desirable to disclose certain otherwise protected areas of their body appearance, since visualization in these cases could be of interest to emergency response teams that could be provided with the images to identify wounds or certain conditions of the person that is being monitored.Apart from the proposed four flters, in order to validate this "privacy-by-context" approach, we have implemented a fall detection application in which the visualization changes in real time to facilitate the understanding of the situation.This is based on a neural network [56] that has been trained with "fallen" and "non-fallen" human images, to learn to detect this particular case [40].If a fall is detected, the privacy flter override is activated, and the real appearance of the person is revealed (see Figure 4), we hereby propose this ffth visualization -a context-aware Fall Application model.

STUDY METHODOLOGY
In order to explore user perceptions of the VMS, we adopted qualitative research methodology [70,92] and conducted an empirical evaluation of our designed system involving people.This comprised of user testing sessions with follow-up interviews in a realistic environment.All study procedures were approved by the Ethics Committee of the University of the frst author.

The sample
A total of 32 individuals participated in user testing sessions.The recruitment of the participants was organized with the eforts of an independent member-driven association of persons with disabilities, their family members and friends, AIAS Bologna Onlus[6], located in Bologna, Italy.With the main focus on people with disabilities and older adults, among other numerous activities, the aforementioned center networks with educational establishments and other public and private service providers in the region, provides day care and residential care and operates a leading center for assistive technology.The assistive technology team of the AIAS Bologna Onlus is one of the largest independent (non-commercial) AT teams in Europe.
With the help of an experienced occupational therapist at AIAS Bologna Onlus, a purposive sampling technique was used to identify respondents in a way that ftted diferent sociodemographic profles of older adults and other stakeholders involved in the process of care provision.We conducted an empirical evaluation with a total of 32 participants.Due to the incompleteness, we decided to discard the data points from three participants.We, therefore, use the data from 29 participants in our subsequent analysis.The remaining 29 users represent two main user groups: older adults as primary stakeholders and direct potential users (N=13), and other stakeholders (N=16) of the VMS.1).We use pseudonyms when referring to the participants.Sheltered Housing is a type of housing built for the provision of community services for people in the later stages of life.SHH generally has a partially self-managed maintenance model and is intended to create independent and safe living spaces for older adults.As part of the sociodemographic questionnaire, older adults were asked if they had any previous experience with Active and Assisted Living Technologies (AALT experience in the Table 1) and which Information and Communication Technologies they currently owed (ICT owned in the Table 1).We also measured their attitudes towards technology in general (TechPH in Table 1) and their level of care dependency (CDS in Table 1).
Older People's Attitudes Toward Technology Score (TechPH) is a novel instrument for measuring older people's attitudes and enthusiasm for technology, which is based on relevant existing instruments for measuring technophilia [3].It is particularly wellftted for this context due to its brevity and simplicity, making it suitable for assessing health technology for older adults.We opted to present the participants' TechPH index, as one could assert that basic attitudes and feelings towards technology (such as technophilia) impact diferent attitudes, behaviors of adaptation as well as usage of new ATs [86].TechPH Score ranges from 1 to 5, from lowest to highest technophilia.
Care Dependency Scale (CDS) is an internationally recognized scale to measure dependency on care in medical, nursing, or research settings [26,101].We present this score to show diversity in the need for care among the older adult participants of the study.A cut of point, ≤ 68 classifes persons as care-dependent, all others as independent [27].
4.1.2Other stakeholders.Other stakeholders were recruited from the personnel of the AIAS Bologna Onlus center, and were comprised of fve occupational therapists, two educators, four psychologists, two leads of the center, and three technology designers from the AT team of AIAS Bologna Onlus (Table 2).They represent secondary and facilitating stakeholder groups of a care provider segment and have a diverse length of work experience in the care sector.Among other characteristics, we measured their afnity for technologies, with the Afnity for Technology Interaction scale (ATI owned in Table 2), ensuring a diverse representation of technological backgrounds among the participants.ATI scale is shown to be a valid and reliable instrument recommendable for research in the area of HCI and accounts for the individual aspects of users' interaction with technology [55].ATI score ranges from 1 to 6, from lowest to highest afnity for technology [34,81].

The study procedure
Healthcare professionals and technologists from the AIAS Bologna Onlus Center and older adults from private households were contacted by the occupational therapist of the AIAS Bologna Onlus and were informed about the aim of the study.Those who agreed to participate were followed up in order to schedule user testing sessions in the smart home environment of the AIAS Bologna Onlus AT center (Figure 5).Apart from this, researchers visited two Sheltered Housing in the city, where further user testing sessions were conducted.Each user testing session started with the introduction of the study aim, reading the information sheet, and was followed by signing the consent form.Subsequently, participants completed the demographics survey, which led us to the VMS prototype probing process with a concurrent think-aloud method.Prototype probing consisted of participants getting acquainted with diferent visualization modes of the VMS, with applied privacy flters, projected live on a large screen.The users probed four main flters: Blurring, Pixelating, Avatar, and Elimination (Figure 5a).Moreover, the Fall Application, as a privacy-by-context approach, was also tested.Users were asked to lean over in a falling manner in order to see how the flter is removed to see the actual image without any coverage if a person falls or is at risk of falling.
Participants were requested to engage with the flters through simple activities, such as moving around the room, transitioning between standing and sitting, using the phone, etc.. Additionally, study users were prompted to vocalize their cognitive process, to think out loud as they completed these tasks.Special emphasis was placed on the signifcance of verbalizing and sharing their experiences while experimenting with the various flters.
VMS prototype probing with concurrent think-aloud was followed by semi-structured interviews of retrospective probing for each user testing session.The semi-structured interview guide consisted of three main parts designed according to the research questions.Users were inquired about their experiences with the VMS and its envisioned applications, proposed flter perceptions and privacy protection mechanism of the system, and lastly about future design recommendations for the VMS development.Subsequent to the semi-structured interviews, participants completed simple questionnaires, which involved ranking their preferences for the diferent visualization modes and indicating where each of these flters would be acceptable for them (e.g.living room, kitchen, bedroom, bathroom.).Moreover, the older adult users group was requested to indicate with whom they would be willing to share information regarding each flter (e.g.family members, health professionals, technology developers, researchers.).User testing sessions lasted from 45 to 90 minutes.They were audio-recorded and transcribed verbatim using Dovetail software [28].Six interviews were conducted in English, and the remaining 23 took place in the local

Data analysis
We employed the afnity diagramming technique to analyze the interviews [4], as this method is widely used in HCI studies to organize large amounts of unstructured qualitative data [31,36,97].At the inception, the main author adopted a descriptive coding strategy and independently coded approximately 10% of the entire dataset and created the initial coding tree.Subsequently, we met to discuss the coding tree, resolve any ambiguities and agree on the fnal coding book.Next, we wrote data items on the Post-it notes and, with the help of digital whiteboarding software, established loose clusters based on their semantic afnity.We, then, created higher-level clusters by relating them to the lower-level ones.During several analysis meetings, we collaboratively and iteratively added meaningful labels to clusters, where we "walked the afnity wall".We repeated this process until we reached a consensus on the naming and labeling of the clusters.To ensure the result's methodological accuracy, we used a triangulation strategy, where two researchers traversed the wall with the specifc goal to identify spatial "buckets" of individual participants' data and re-organize them according to the semantic meaning as needed.Whenever necessary, we created additional annotations to expand insights and adjusted upper-level categories based on the insights.Guided by  3) design opportunities (Figure 6).We additionally added representative quotes from our participants to the notes to ground our fndings.We also held meetings with researchers outside of the project to challenge our assumptions about the clusters' composition.

FINDINGS
We now present our empirical fndings, outlining viewpoints from diverse stakeholders regarding their experiences with the video monitoring system and delving into their perceptions of the privacy protection mechanism of the proposed technology.We also synthesize a set of design opportunities for further advancing the system grounded on the participants' responses.

User experiences
We aimed to gain an understanding of various stakeholders' perceptions and experiences with the system.Our specifc objectives were to gather their insights on identifed advantages and obstacles in system usage, as well as to understand how these factors shape the acceptance of the system.Additionally, we gathered participants' perceptions of the privacy protection mechanisms embedded in the system to safeguard their privacy.Furthermore, we sought to elucidate the envisioned applications of the system from the perspectives of diferent stakeholder groups, namely older adults as primary stakeholders and users of the VMS system, healthcare professionals from an assistive technology center as secondary stakeholders, and technologists of the assistive technology center as facilitating stakeholders.

Advantages.
Older Adults.Privacy preservation while remote monitoring was among the most valued features of the system among older adult participants.After which, immediate fall detection and potential fall prevention were undoubtedly the biggest potential advantages of the proposed system: ... as you age, even if you're fne you can stumble, something can happen.I'm fne but I can stumble on a carpet while rushing to answer the phone.It happened to me at home and I fell" (Chiara, 69).The immediate feedback mechanism was valued among older adults as a way of providing safety and being more autonomous, and staying at their preferred place longer "...autonomy, you can be alone knowing that if needed, someone can intervene in some way immediately so autonomy increases" (Fiona, 74).Interestingly enough, contrary to the intrusive feelings of surveillance, some older adults felt more interconnected having a system at home "... well, feeling more connected.For instance, if this system is monitored and checked, yes, I feel more connected, someone is watching over me" (Antonella, 69).Importantly, the simplicity of the use of the proposed technology was a highlight point among older adult participants: "I don't have to intervene, I don't have to do anything ... it´s very easy" (Ginerva, 86).
Other Stakeholders.Most healthcare professionals emphasized the system's ability to ease up healthcare facility workloads and provide more efective service: "In my opinion, it would lighten the workload of the primary care doctor who is very busy and overloaded with work.But also residential facilities.Sometimes at night, there is only one operator for the entire facility who struggles to monitor all situations.The facility might not be able to aford many operators, even though it would be useful." (Antonio, psychologist).Healthcare sector representatives also stressed the possibility of a safe transition from autonomy to dependence using the VMS: "it covers the transition from autonomy to dependence, and perhaps it can be done a little safer" (Gemma, educator).However, some health professionals prompted doubt about the functioning of the fall detection system: "Fall detection would certainly be very useful if it worked really well, but it´s difcult to work well ... It will be even more useful as it gives you the possibility to have immediate feedback" (Sofa, occupational therapist).
All three technology makers who participated in the study, together with the lead of the AT center, accentuated the advantage of the VMS over the traditional sensors by providing richer information and ensuring the safety of the users: "Seeing an image would make me feel more sure about what's happening because I'm actually seeing it.While with a system with sensors, yes, I could have data, I could interpret it, but maybe, I'm not sure if the sensors are working or not.One can have a house full of sensors, but at a certain point, say there is no more data, instead I turn on the camera and see if they have fallen" (Luna, occupational therapist).The ease of use of the system was another important point stressed by the technologists: "... so say it's a passive system in a sense that they [users] do not need to do anything, and technology use difculty matters so much" (Rosa, technical team).

Obstacles.
Older Adults.The potential cost of the system installation and maintenance turned out to be the major obstacle to the adoption of the proposed VMS for older adults of the study.This was added up by the need to have a camera in every room: "Well, I don't think it's going to be super easy to install it into people's homes as you need cameras in every room" (Leonardo, 67) and the technical maintenance of all the system, together with having "someone who reads the data" collected.On the human factors level, older adults voiced their worries about explaining the system to their potential visitors: "But maybe the person might not want everyone to know that they use this device, to avoid stigma" (Fiona, 74).Interestingly, even if some older adults felt more connected using the system, others expressed their fear of decreased human contact: "So where is the contact point?Are you telling me that nobody will take care of me because I have to do all the job?I see that people may be afraid of being abandoned, you know?" (Gabriela, 73).
Other Stakeholders.Privacy concerns and the unfeasibility of anonymization were predominantly identifed as obstacles by stakeholders other than older adults: "It still gives me the impression of being watched, it's still a camera, it's just surveillance there" (Antonio, psychologist), "You're alone in your home.Yeah.So there's only one person, and so anonymization is not really the case" (Luca, lead of the AT center).Other stakeholders involved in the study also raised the WiFi connectivity problem for older adults: "this system has to be connected to the internet right?... So I would expect that very few people in the older age range have an internet connection or that they have properly functioning internet connection" (Matteo, lead of the AT center).Another external obstacle pointed out by the facilitating stakeholders was a home environment: "So it is that houses of people are sometimes very complicated by geometrical point of view.So furniture which comes on the way and sometimes they are very old apartments with the strange angle which would make it hard to see" (Luigi, technical team).While most of the healthcare team members appreciated VMS´s potential for monitoring vital signs, Claudia, a technical team member shared with us her experience: "So I see, the problem is that we have a lot of GP that say, okay, but I cannot rely on this data.So maybe they can accept the general trend but they will say that they will have to check with their own devices.But the single parameter, they certainly don't rely on it as it is not a medical device".Healthcare professionals also pointed out another potential barrier to system adoption, which is the limited assistive technology literacy among older adults: "Literacy is not very high, this might create resistance or low interest, ... even fear you know" (Matteo, lead of the AT center).

Acceptance.
We chose to approach the acceptance of the VMS system from a preliminary exploratory perspective, instead of employing established models for quantifying technology acceptance.We made this decision based on the sensitive nature of vision-based systems, particularly regarding privacy invasion possibilities, which are not accounted for in the existing Technology Acceptance Models (TAMs) [66].However, in compliance with the TAMs [24,95,96], Perceived Usefulness and Perceived Ease of Use were indeed facilitating factors for participants' acceptance of the proposed system.On the other hand, users were always contrasting usefulness (expressed mostly in safety) with the privacy invasion element of the VMS, leading to the privacy vs safety trade-of.In contrast to other stakeholders' expectations, most older adults stated that the benefts of the system outweigh privacy concerns, and they would accept such a system: "It serves the purpose, isn't it useful for your own health, I mean, for my physical health, then it is better than no intrusion so I would accept it" (Chiara, 69).Only Maria (87 years) opposed the acceptance of the system "So frankly, I don't see this great utility in this system, I never had this, I never saw it, I don't need it.... I would like there to be more doctors, not cameras".
Other older adult participants tended to favor conditional acceptance of the proposed technology: "I would also have some difculty thinking about having a camera in my house, but if I knew that by using this system, I could continue living in my own home, maybe it would even be acceptable" (Elena, 73).Viola (73) gave us an eyeopening insight into the human sentiments associated with the AT use: "Yes, yes it is acceptable.Under the condition, I repeat, that it is not cold or purely mathematical and inhumane [...] I don´t want to become a number." Francesca (72) shared her views on the system acceptance in certain places: "I don't want to know anything about cameras at home.But one thing is a camera that records in "a real way".Another thing is fltered in this new way, so the flters make control and monitoring acceptable, but I wouldn't put it in every area of the house.Perhaps I would limit it to certain areas.I have specifc zones in mind... kitchen, living room.".Angelo (83) let us go through his thinking process of advantages vs. concerns of the VMS acceptance: "It is acceptable because the user, the recipient of the system, will evaluate it and decide its merits.Personally, I believe that as long as it enables me to be independent within the constraints of health conditions and assures me that there is someone or something that can help me in case of an emergency, the positive aspects outweigh any potential concerns".Just as Francesca and Angelo, most older adults expressed the importance of being able to have control and agency over the system "So maybe I could just have the possibility to say no.Okay.I don't need it.Or yeah.I prefer to have it" (Leonardo, 67).
Another important condition and facilitator for the acceptance of the proposed technology was self-paced adoption and the right education about it: "... but a person needs to be somewhat prepared, I say why in the end it's something that protects me, so if done in my interest yes, but one has to get into the mindset a bit, and this needs time.[I believe], it doesn't happen overnight, but it happens by going through a [specifc] process if it is proposed, giving people time to think about it, but a guided time, not a time where one goes on their own, you know" (Bianca, 65).

5.1.4
Privacy protection mechanism embedded in the system.The majority of study participants across all stakeholder groups afrmed that the system's embedded flters could contribute to safeguarding their privacy, addressing their concerns, and contributing to an increased sense of comfort and security.In the case of Paolo (78) and Antonella (69), from the primary stakeholder group, they found that the system ofered even an excessive level of privacy protection that they did not require: "I don't see the importance of exaggerating privacy too much.I am the one who needs help, and the technological support helps me live better as a patient who needs assistance, as well as my family members who may be far away and want to know how I'm doing.So, I don't see the usefulness of so many flters... Security comes frst, and then privacy" Older Adults.The frst ranking was mainly assigned to the Avatar flter by the older adult participants, primarily because of their perception of its privacy protection capabilities: "...I would buy that system on the bottom left [Avatar]... Yeah, it seems to me the most anonymizing, you know, because everybody's wearing a red shirt, everybody's just the same." (Fiona, 74).Older adult participants consented to the acceptance of the Avatar flter in the majority of proposed locations, and they also displayed a higher level of willingness to share data generated by this particular visualization mode.The Elimination flter proved to be next in preference among senior participants.Interestingly, while many participants ranked it as their frst or second choice, similar number of them placed it as their fourth choice.This divergence can be attributed mainly to participants' uncertainties regarding its efectiveness, just as expressed by Ginevra (86): "How do I know that it is really working", as there is no user image on the display of the Elimination flter, the system keeps processing the data, but without any display of the user.On the other hand, the Blurring and Pixelating visualization models were the least favored among older adults, due to their perceived lack of privacy protection.Viola (73) stated, "Maybe the two above [Blurring and Pixelating flters displayed on the screen] don't seem so diferent from a regular camera, they are a bit weak in terms of privacy... especially in the pixelated frame you can still  see that it is me".This sentiment was refected in older adults' unwillingness to use Blurring and Pixelating flters in bedrooms and bathrooms and reluctance to share data captured using these flters with stakeholders other than family members.Apart from these proposed four flters, we gather participants' opinions on the Fall Application, which is a context-aware automatic change of the visualization to show a real image once a fall is detected.Fall Application has been proven to be an extremely important and highly acceptable feature among the vast majority of older adult participants: The fall detection system is fantastic; I consider it so important to see the person if they have fallen and evaluate the severity (Gabriela, 73).They expressed a preference for its presence in all basic home environments, i.e., a living room, a kitchen, a bathroom, and a bedroom.Notably, older adults exhibited the highest level of acceptance when it came to sharing the data collected by the Fall Application with most stakeholders involved in the care process.
Other Stakeholders.: The flter preferences were quite alike among older adults and other stakeholders of the study, with the Avatar flter being ranked as the most preferred in the latter case as well.However, Fabio, an occupational therapist, pointed out anonymity challenges associated with this flter, stating: "...but, you also know what's behind it with avatars.I mean, if you put it at your parent's house, you know who are those two people, even though they are avatars, they are your parents, or if you put it on your patients, so, in the end, you know what's behind it".Just like older adults, other stakeholder participants also consented to the acceptance of the Avatar flter in the majority of proposed locations.The aforementioned trend about elimination flter was followed by other stakeholder groups as well, The Elimination flter was chosen as the 1st in rank and the last in rank by the same number of secondary and facilitating stakeholders.Luna, an occupational therapist, exemplifed this duality as she simultaneously expressed a preference for the Elimination flter and doubts about its reliability, stating: "I would prefer where the fgure is completely eliminated [the Elimination flter].Yeah, but after knowing that it really detects what it should detect, but it is hard to know".Nevertheless, it remained the favored flter among most participants for private spaces, such as bedrooms and bathrooms, owing to its ability to ofer complete privacy protection.
The opinions around blurring and pixelating flters on their perceived weakness in terms of privacy, especially where personal identifcation remains possible, resonate with other stakeholder groups as well.Secondary and facilitating stakeholders concur with the older adults' hesitancy to employ such flters in intimate spaces like bedrooms and bathrooms.In addition to the flters, participants' insights were also shared around the Fall Application of this system, which received overwhelmingly positive feedback from other stakeholder groups as well, and a high level of acceptance in all proposed locations.

Envisioned applications of the VMS.
Older Adults.: Much like our primary envisioned scenario for the proposed VMS, the consensus among most stakeholders was that the system is most appropriate for older adults, particularly those who reside on their own.Chiara (69) found the system to be: "Very useful, especially because I live alone.If something happens, they will fnd me dead at home.Eh? and, in [the city], most people live alone, widowed, never married, separated, or their children live elsewhere.In short, half of the population".
Other Stakeholders.: Healthcare professionals also highlighted care facilities as an important site for a potential system's deployment."Well, actually, residential facilities come to mind, where people live, and sometimes they do not have enough operators.So, having a system like this could be important so that, for example, the operator working at night can intervene quickly if something happens." (Luna, occupational therapist).
The other application scenarios for the system, as identifed by healthcare professionals, included its potential use in rehabilitation and posture correction; moreover, its use with "individuals with disabilities, physical disabilities, motor disabilities, certain neurological conditions that lead to wandering, for example.Even in some cases of cognitive impairment.The user base is quite diverse, in my opinion." (Antonio, psychologist).Neurodegenerative conditions have been mentioned as a potential use case for the system as well: "For all those neurodegenerative disorders could be a useful application, especially for multiple sclerosis and its progression, for all progressive conditions actually as you can also detect the progression" (Lucia, occupational therapist).
Lia, a psychologist, brought up a use case of child care in a pediatric context: "For children, we would like to use it for monitoring children.It could be used in certain ways, even in pediatric care, let's say".Fabio, an occupational therapist, extended these thoughts towards children with particular health conditions: "If you have a child with motor problems or mild cognitive impairment, and you try to give them some autonomy, you have to give them a minimum of independence, knowing that you can still keep an eye on the diferent areas of the house.Giovanni, a psychologist, corroborated: "for example, of teenagers or younger adults with cognitive and behavioral problems or autistic individuals.Because, in this case, one can create perhaps not a completely fully independent living situation, but just a possibility to leave people alone for two hours, half a day, or even I see it in educational scenarios at schools, also to monitor their interactions".

Design opportunities
Based on the experiences with the VMS, we present what diferent stakeholder groups wish to see in the system, which can then act as design opportunities for further development of video-based monitoring technologies, at large, and our system, in particular.

5.2.1
Characteristics to be added.The features that healthcare professionals most commonly desired in the system included monitoring vital parameters like temperature, blood pressure, heart rate, and respiration rate.On the other hand, older adults expressed a strong preference for a communication feature integrated into the system, enabling video and/or audio connections with family members, healthcare centers, or operators.Bianca (65), elaborated on the social opportunities of the system: "... also the possibility to connect with other older adults who are in the same situation and are using the system".The audio feature was also supported by other stakeholders in a specifc context: "Audio only in the moments of danger, like if it could detect sound peaks and alert about it.It could be useful, maybe with the option to activate and deactivate sound, as we saw in the fall mode [Fall Application] with the real image."(Linda, psychologist).
Older adults viewed the ability to power the system on and of at their convenience, along with having complete control over it, as a crucial aspect of system development.Rosa from the technical team suggested the following: "There are many ways of turning of a camera but putting a sort of slider to cover it could be an idea.Just because it makes you feel like there's a physical barrier.I'm a hundred percent sure that camera is not seeing anything.".
Other signifcant features proposed by various stakeholder groups for inclusion in the system were monitoring household appliances, detecting home accidents, and introducing night vision capability.In addition, healthcare professionals suggested less common features, such as monitoring medication intake and detecting conficts and physical confrontations.

5.2.2
Activities to be detected.Falls were unanimously identifed as the most crucial activities to be detected by all study participants.Subsequently, the primary focus of system development shifted towards various mobility and immobility-related routines, including actions like getting up and going to bed, standing up and sitting down, remaining sedentary, or staying in bed, as well as wandering behaviors.
Additionally, there was a strong consensus on the need to detect and monitor nighttime activities, such as sleep and awake times, as well as nighttime bathroom visits and all associated toileting activities.
Healthcare professionals also expressed a need to monitor cooking-related behaviors, as well as eating and drinking.Giovanni (psychologist), emphasized the signifcance of monitoring leisure activities: "... sports or physical activities, to see from a psychological and well-being perspective if they are cultivating some hobbies, ".

5.2.3
Further considerations for the system development.Both healthcare professionals and older adults highly favored the inclusion of behavioral analysis based on the collected data and the ability to detect changes over time.This feature was seen as valuable in the system development for identifying increased frailty and potential progressive disorders: "I think it is an act of love towards the care recipient to be able to understand in a timely manner that their cognitive abilities are declining, it would be great if this system could help in this.One doesn't want to believe that their mother, parent, no longer understands [their own actions].And this is a problem because the care recipient is at risk.In fact, my mother had started to fall, and before I realized that I needed to provide more personal assistance, she had fallen multiple times and sufered bruises, and was hospitalized" (Paolo, 78).Bianca (65) proposed an interesting idea of providing activity data graphs to the system's users as well: "Then, if there are, if there are graphs that show the type of activity and times, when the person has been still or active ... or heart rate and so on, but maybe on the viewer's side could be very useful".
Even though anonymity was among the key priorities for the video monitoring system, the majority of participants also expressed a desire to detect the recognition of the presence of other individuals within the household or designated space, along with the capability to diferentiate between individuals in specifc situations: "... like assigning a color to a person may be so that I know that, for example, a neighbor is here or my caregiver -a person that I know.And having a specifc color for strangers.Yeah.Maybe having a message when a stranger visits you or a care receiver because we know about issues with strangers going to elders' homes and things like that.So from a security point of view would be nice" (Elena, 73).
The integration of various sensors into the system was also suggested as a valuable resource for system development: "Combining it with a series of sensors for vital signs that can also reveal the behavioral data, behavior if it changes over time, or even ambient sensor integration could give you good results" (Luigi, technical team).
A highly emphasized aspect contributing to the advancement of the system was its adaptability: "So the idea is for the system to be fexible.Let's say one person might say, I only want to detect falls and maybe how much time I spend in bed.Maybe other people will say, I want to detect if my heartbeat goes up, if my blood pressure goes up, and so on.So the system to be fexible and the tools and the preferences can be chosen by each user" (Matteo, Lead of the AT center).
Participants also mentioned less frequently suggested features for system development, such as the potential to display actual images during moments of danger, similar to the Fall Application but applicable to any potential risk, as well as the option to show a "help is coming" sign on the screen in such situations.

DISCUSSION
Through this study, we explored the experiences, advantages, challenges, and design opportunities for the video monitoring system with inherent privacy-preserving design.In what follows, we discuss the main implications of our research fndings for the design of video-based monitoring systems in the context of Active and Assisted Living.
All the diferent stakeholders involved in the study found the proposed privacy-preserving mechanism of image obfuscation embodied in the system to be safeguarding their privacy and alleviating related concerns, aligning with prior fndings in the literature [25,32].Our participants specifcally appreciated the sense of safety our system can ofer to older adults, enabling them to maintain greater autonomy and stay in their preferred environments, such as their own homes.Despite concerns about privacy, the aforementioned aspect played a pivotal role in their acceptance of the system.This phenomenon aligns with established concepts in previous literature, often referred to as the privacy vs security [84] and privacy vs autonomy [93] trade-ofs in vision-based systems within the context of Active and Assisted Living.Participants' preferences for the diferent visualization modes of the VMS further refected the mental trade-of and duality of privacy vs. safety.Among these modes, the Avatar flter, ofering the highest degree of privacy and anonymity, emerged as the most favored one by the participants.This is in line with the previous research emphasizing the importance of anonymity in video-based monitoring systems [25].On the other hand, the Fall Application provided the greatest assurance of safety to the participants of the study and was seen as an indispensable element of the system.Hence, participants were ready to give up on privacy, given that the system could guarantee their safety.When it comes to the most personal spaces, such as bedrooms and bathrooms, many participants preferred the Elimination flter, which completely removes the person from the image.This aligns with existing literature on camera surveillance, which reports that private rooms are less acceptable to be flmed [45].However, the choice for the Elimination flter was frequently accompanied by the Fall Application choice for the same spaces.This somewhat paradoxical revelation further emphasizes the complexity of the privacy vs. safety duality for the participants and underscores the necessity for future research to explore which visualization modes better align with older adults' preferences in their most private spaces while taking into account their best interests.
Our fndings further highlight the importance of considering a range of privacy requirements when designing the VMS.Some participants expressed a desire for personal identifcation, while others preferred complete anonymity.Moreover, flter preferences varied depending on diferent household environments.These observations support the concept known as "privacy-by-context", introduced by [71], which encompasses two key aspects.First, adaptability to user needs and contexts -the system should be fexible enough to accommodate each user's preferences and adapt to various contextual situations.Second, automatic context recognitionit is crucial for the system to accurately recognize the context in which it is operating.We deem that our system can be seen as an illustrative example of "privacy-by-context", as it allows adjusting its visualization mode based on the context (e.g.whether a person is clothed or not, the severity of the event), supporting both anonymous use and diferent levels of disclosure.Furthermore, our system has the capability to obscure certain activities and display only those activities for which the user has provided consent, all within a desired visualization mode.
Apart from anonymity, the main privacy-related concern for the proposed VMS expressed by the older adult participants was the information disclosure to unwanted individuals, or misclosure [9].These fndings resonate with literature assessing fears of data hacking, data misuse, and unauthorized data access in the technology for aging in place [73,83].On the other hand, the importance of maintaining control over the system emerged as a critical factor in the acceptance process of the proposed system, seen as a means to prevent potential misclosure by the majority of participants from various stakeholder groups.An evaluation of data access revealed a consistent pattern, indicating a greater willingness to grant access to individuals with whom one has a direct relationship and contact.These points of desire to control system operation and determine who has access to the collected information are also present in the literature concerning vision-based AAL systems [25,68].Extending on those points, low technology literacy is shown to be among the main identifed barriers to technology use [98], while at the same time, our study shows there is a persistent desire among older adults to understand and control the system and the collected data.The curiosity about technology is also refected in the technophilia (TechPH) score of the senior participants.In response to this, what we learned from our study is that older adults wish for a self-paced, fexible adoption process and an understanding of the system so that they can take ownership of the proposed product.The sense of ownership itself could further reinforce positive attitudes and facilitate the system's adoption [66,72].Furthermore, in line with existing studies [98], our fndings demonstrate not only older adults' willingness to understand the technologies that would facilitate aging independently but also their desire to contribute to the design of these technologies.This insight relates to the established method of the Communities of Practice in the previous literature [47], which is a practice for technology appropriation with suitable measures for the support of successfully adapting the assistive technology use.Taking all these into consideration, we frmly advocate for enabling gradual self-paced learning processes for older adults with the AAL technologies and their continuous engagement in their technology design.
When it comes to further development and deployment of our system, healthcare sector representatives primarily aimed to enhance the healthcare monitoring capabilities of the system, such as incorporating vital parameter detection.In turn, older adults in our study emphasized the system's crucial safety features, particularly its ability to identify falls and respond to other emergency situations.Our participants especially valued that the system could potentially cater to the growing frailty in older adults.This capability, coupled with further behavioral analysis of statistical patterns, presents a prominent research opportunity.In fact, one older adult participant even suggested presenting activity data to users, a concept supported in the literature as a valuable tool for addressing long-term health deterioration and detecting changes like cognitive decline [54].
Among the various design possibilities proposed by diverse stakeholder groups, we want to highlight the human-centric aspects raised by the older adult participants.Beyond safety-related features, older adult participants emphasized the importance of making the system more human-centered.According to them, this could be achieved by increasing the opportunities for interaction with the system and by allowing interaction with the operator.Older adults also wished to have a display of the system's captured information and what others were able to see while interacting with them.These fndings stress how much human beings are inherently social creatures, and their actions are intrinsically intertwined with others.They have a need to feel connected and avoid reasons for exclusion, such as potential stigma from their peers if they were to adopt video-monitoring technologies.These human factors are accounted for in the literature on the design of technology for older adult care [91]; however, there is a need for further research considering the evolving norms that technology development posits on people in the later stages of life.Technological advancements are continually reshaping how we engage socially, and social norms change along with it [58].Hence, it is also crucial for technology designers to take these aspects into account, especially considering the sensitive nature of the care context and the pervasiveness of the technology.This is particularly pertinent since video-based Active and Assisted Living systems can signifcantly impact the private and social behaviors of older adults in their daily lives, as exemplifed by Privacy Enhancing Behaviors [8].Conversely, most existing literature primarily focuses on identifying ways to facilitate the acceptance of Assistive Technology design, which is generally regarded as a positive step toward the adoption of healthcare technologies among older adults.However, we wish to underscore the potential risk of a 'slippery slope' of privacy violation within this process [85], especially considering the heightened vulnerability of older adults.Not considering these risks could lead to an excessive reliance on technology and potentially contribute to the decline of physical or cognitive abilities.In the same way, some users noted that they would need an extended period of actual usage to formulate their opinions about the proposed flters and the system.We advocate for a closer examination of user needs and the long-term efects of deploying these systems in situ.As outlined in the report of the European Summit on Innovation for Active and Healthy Ageing [20], in the creation of novel solutions, it is imperative to actively engage users to guarantee that these solutions efectively address genuine needs in an ethical and privacy-conscious manner.To exercise that, in our future work, we see the value in employing practice-based design methods such as Living Labs when engaging older adults and other stakeholders in the AT setting [38,57].
We would like to highlight several limitations of our study.To begin with, the qualitative research methodology utilized in this study implies that the results are not meant to be generalized to other environments.Rather, our approach enabled us to gather detailed and descriptive narratives of participants' encounters with the VMS system within the specifc context of a large assistive technology center in Southern Europe.Additionally, our study is restricted to a short-term use of the system.Future investigations should include a longer duration of system usage to provide a more comprehensive understanding of it.Furthermore, forthcoming research could further beneft from controlled experiments to identify the most favored flters for older adults in diferent environments (e.g., care homes) or domestic settings (e.g., kitchen, living room, bedroom).

CONCLUSION
This paper makes three primary research contributions.First, in response to the growing demand for privacy-centric solutions in the feld of active and assisted aging, we introduce a pioneering video-monitoring system inspired by Privacy by Design principles tailored for caregiving contexts.Second, recognizing the dearth of empirical investigations within the current state of the art pertaining to vision-based systems in the context of Active and Assisted Living, we provide comprehensive qualitative insights from older adults and other stakeholders.Our focus revolves particularly around video-monitoring technology and its implications for privacy, with a novel privacy-by-context approach.Third, our empirical fndings equip researchers, designers, and practitioners with context-rich perspectives, ofering valuable insights for the creation of technology solutions that authentically align with the needs and expectations of all stakeholders participating in caregiving ecosystems reliant on video-based AAL monitoring technologies.
Our study reveals the delicate balance between privacy and safety concerns in the adoption of video monitoring systems for older adults in Active and Assisted Living contexts.It highlights the importance of aligning technology design with user preferences, emphasizing user involvement and empowerment as essential components for successful implementation.The novelty of our paper lies in the privacy-by-context approach, situated against the backdrop of privacy threats in video-based Ambient Assisted Living (AAL) technologies, emphasizing the central role of users and their context-specifc needs and decisions in system development.As we move forward, it is crucial to navigate this landscape carefully, recognizing the evolving technological norms and the innate social nature of individuals while prioritizing their autonomy, security, and well-being in an increasingly digital world.Hence, our forthcoming research will prioritize greater user involvement in the design process of AAL technologies and emphasize the importance of enhancing the aging literacy of involved designers and technologists.

Figure 2 :
Figure 2: Overview of the proposed privacy-by-context video monitoring system.The primary user's living space is equipped with visual sensors to monitor their well-being.An automated context extraction module will determine the contextual cues needed (ii).A graphical user interface for the caregiver is provided, showing the visualization determined by the context, and user preferences (iii)

Figure 3 :
Figure 3: Schematic representation of the modules involved in the privacy-preserving video monitoring system employed in this study.

Figure 4 :
Figure 4: A context-aware Fall Application model, an automatic change of the visualization once a fall is detected.

Figure 5 :
Figure 5: User testing session with projected visualization modes Figure 6: Fragments from the Afnity Diagram Wall Filter preferences for home environments (b) Filter preferences for home environments (c) Whom older adults would choose to share data from each flter with

Figure 8 :
Figure 8: Diferent visualization model preferences by Other stakeholders (N=16) 4.1.1Older adults.Older adults (N=13) were 65 and plus of age and lived in Private Housing (PH) or in Sheltered Housing (SHH) and represented diferent sociodemographic backgrounds (Table

Table 1 :
Demographics of older adults

Table 2 :
Demographics of other stakeholders