The challenge

A village of this shape has three safety problems that look like one and are not. The call problem: residents press, staff go, and nothing in the system records who went or how long it took — so when a family asks, the answer is a duty roster and somebody's memory. The egress problem: a resident in frail care with dementia who walks out through a door a contractor propped open, where nothing is pressed and nothing alarms. And the staff problem: one or two carers covering a large site between 22:00 and 05:00, with the only panic button on a wall in a building they are not in.

Underneath all three sits a fourth: the operator of a registered residential facility must report annually to the Minister on compliance with prescribed service standards and measures to prevent and combat the abuse of older persons. That report was being assembled from rosters, incident files and recollection — defensible in a good year, fragile in a bad one.

The constraint that shaped everything: the site is occupied cottages, a converted main house and a frail care wing added decades later, spread across a landscaped property. Trenching between cottages and opening ceilings in occupied units was not a cost the village was going to carry.

Our approach

Keep the call system, add what it cannot do. Existing call points, pull cords and bathroom cords stayed in service. What was added was routing to the nearest available carer, arrival recorded by presence in the room rather than by someone cancelling a light at the wall, an escalation ladder on timers, and a call-to-arrival time written for every event.

Monitor the boundary, not the person. Reference points went on external doors, the frail care wing's exits, the lift lobby, the main gate and the garden paths that are the site's real perimeter. Inside residents' own cottages and the communal areas, the system deliberately does not watch. Boundary rules applied only to residents whose care assessment called for them, with accompanied exits silent so a resident leaving for an appointment with a carer is not an incident, and night-time profiles so a garden door unremarkable at 14:00 raises an alarm at 02:40.

No cabling where cabling was the problem. Battery-powered reference points with multi-year sealed cells mounted on cottage walls and gateposts and reported over a long-range radio link to a single gateway. Outdoor positions were specified for weather. The frail care wing, being refurbished anyway, took cabled Power-over-Ethernet units where the ceiling was already open — a mixed design rather than one answer for the whole site.

Privacy designed in, not bolted on. Resolution was set to room and boundary level rather than centimetres, raw position history given a short retention with the aggregate response measures kept longer, reporting limited to the named purposes, and processing kept on a server in the village's own office. Residents and families were told what was collected and why before go-live, and staff received a written notice covering the right to object — because under POPIA an employee may object to processing based on legitimate interests, and a purpose narrowly directed at safety is what makes that objection answerable.

Proven in one wing first. The frail care unit went live against acceptance criteria written before installation, in the operator's words. Only then did the cottages follow.