PRIVATAR is a research project that places data protection at the center of telepresence for children who are sick or absent from school. It presents a UX framework where data protection is not just a legal box to check—but the foundation for trust, self-determination, and meaningful inclusion.

What privacy-focused design features does PRIVATAR use to protect children's privacy?

Data protection must be visual: the UI uses a consistent visual language of icons and status indicators, including a 'Sendbox' live display that shows exactly which data is being transmitted. It also uses 'No-Go Zones' that stop the robot at defined boundaries and 'No-View Zones' that blur or restrict the visual feed.

What are the four use cases (UC 1–UC4) described in the PRIVATAR framework?

UC 1 – Configuration and Setup: Parents or caregivers configure default data sharing and which features (camera, microphone, facial recognition, location tracking) are enabled. UC 2 – Class Participation: The child’s primary interface to control presence, visibility, and audio in real time, with hand gestures, detection of third parties in view, and a private teacher chat. UC 3 – Teaching Structure: The teacher’s and classmates’ perspectives, including starting and streaming lesson content, displaying streamed data, and adjusting volume for different situations. UC 4 – Robot Control and Spatial Privacy: The child controls the robot in the classroom within the defined boundaries of restricted areas and privacy zones.

How do AI-generated digital user twins contribute to the design process?

They allow examination of rare, ethically sensitive scenarios—such as the appearance of third parties on camera or conflicting preferences—without involving vulnerable users. The participation of real users was reduced by about 40%.

What is the core takeaway about privacy and UX in this article?

Privacy is viewed as empowerment and a foundation for trust. When users can decide what is visible, audible, and present, privacy becomes a driver of participation rather than an obstacle.

What is the Sendbox in PRIVATAR?

The 'Sendbox' provides a live view of all active data transmissions, giving immediate feedback about what data is being transmitted.

Paper

Presence Without Compromise

How privacy-focused UX design enables children who cannot attend school in person to participate

Reading time: approx. 3′ 29″

AI & Digital Customer Twins

Behavioral Design

Co-Creation & Participatory Design

Consumer Interfaces

Contextual Design

Design Ethics

Design Thinking

Digital Innovation

Experience Design

Human Centered Design

Interaction Parameters (DIN EN ISO 9241-210)

Medical Interfaces

Universal Design & Inclusion

User Research & Need Analysis

Presence Through Design

For children suffering from cancer or a serious illness, missing school means more than just falling behind in class—it means losing friendships, routines, and that sense of normalcy that is most important during treatment.

Telepresence robots promise to bridge this gap. But technology alone is not enough. If a child cannot control what their classmates see, what their teacher hears, or what intrudes into their private space—then participation becomes an exposure.

PRIVATAR is a research project that places data protection at the center of this challenge. This article by the chilli mind team, published in the CERN IdeaSquare Journal of Experimental Innovation, presents a UX framework in which data protection is not just a legal box to check—but the foundation for trust, self-determination, and meaningful inclusion.

Through child-centered interface design, spatial privacy boundaries, role-based control options, and AI-generated digital user twins, PRIVATAR demonstrates how informational self-determination can be designed—visually, intuitively, and at the appropriate cognitive level for young and vulnerable users.

Privacy as empowerment. Not as a barrier.

Data protection must be visual

Abstract consent forms and legal jargon that’s hard to understand don’t work for children—and they don’t work particularly well for adults in stressful situations either. The PRIVATAR user interface replaces text-heavy privacy notices with a consistent visual language: specially designed icons, clear status indicators, and the “Sendbox”—a live display that shows exactly which data is currently being transmitted from home or the hospital to the classroom. Audio on. Camera on. Avatar visible. Each status is immediately recognizable at a glance, giving children a real sense of awareness and control without having to navigate through settings menus or decipher abstract concepts.

Spatial Privacy Through Restricted and Privacy Zones

Privacy isn’t just about data flows—it’s also about physical space. In a classroom, certain areas are implicitly sensitive: the teacher’s desk during a private conversation, a corner for small-group work, and areas where other children could be filmed without consent. PRIVATAR programs these boundaries directly into the robot’s behavior. “No-go” zones automatically stop the robot at defined boundaries. “No-View” zones allow movement but restrict the visual feed or blur the image. When a boundary is reached, the child immediately receives child-friendly feedback explaining what happened and what options are available—thus transforming an abstract privacy rule into a tangible, understandable moment of control.

Core takeaways:

To what extent can UX serve as a driver of participation in the field of data protection?

When children can decide for themselves what is visible, audible, and present, privacy is no longer an obstacle but becomes the foundation for trust and emotional security. Self-determination is what makes it possible to reveal oneself in the first place.

Which interface designs put “Privacy by Design” into practice?

Three patterns emerged: The “Sendbox” provides a live view of all active data transmissions. “No-Go Zones” automatically stop the robot at defined boundaries; “No-View Zones” allow movement but blur the visual output. A tried-and-true set of pictograms ensures that important statuses—camera, microphone, avatar—are immediately recognizable to children.

To what extent do AI-generated digital user twins support the design process?

They make it possible to examine rare, ethically sensitive scenarios—such as the appearance of third parties on camera, conflicting preferences among participants, or a sequence of events occurring during a class—without directly involving vulnerable users. The participation of real users was reduced by about 40%.

Four rolls. One system. No one is left unprotected.

Privacy in a telepresence system cannot be controlled with a single switch—rather, it involves a series of decisions made by different people at different times. A parent who sets the default settings before the school day begins. A teacher who adjusts the volume during group work. A child who decides whether to raise their hand or step away from the camera. The PRIVATAR application organizes these decisions into four clearly defined use cases—each assigned to the right person, at the right time, and with the right level of control.

UC 1 — Configuration and Setup

This is done by the parents or a caregiver. Here, the basic default settings are configured: What data is transmitted to the classroom, and which features—camera, microphone, facial recognition, location tracking—are enabled?

UC 2 — Class Participation

The primary user interface for the child. Here, the child can control their presence, visibility, and audio in real time. It also includes hand gestures, detection of third parties in the camera's field of view, and a private chat with the teacher.

UC 3 — Teaching Structure

The teacher's and classmates' perspectives. This includes starting and streaming lesson content, displaying the streamed data, and adjusting the volume for different situations, such as group work.

UC 4 — Robot Control and Spatial Privacy

The child controls the robot through the classroom using a remote control—within the boundaries defined by restricted areas and privacy zones.

Conclusion

Well-designed data protection opens up new possibilities.

PRIVATAR demonstrates that telepresence for children with long-term school absences does not necessarily have to mean a trade-off between participation and protection. When data protection is viewed as a central design principle—and not merely as a compliance measure—it becomes the decisive factor that makes true inclusion possible in the first place.

The project’s findings extend beyond the classroom. The UX patterns, methodological approaches, and role-based control frameworks developed here are transferable: to other vulnerable user groups, other contexts relevant to data protection, and other challenges in the field of health innovation where trust is a prerequisite for acceptance.

Protecting presence is not a constraint on design. It is the guiding principle.