The hearing began with testimony about the walking group.
One worker said it had given her friends.
Another said the routine helped him sleep.
A third said it was the only free thing he did before work.
Grace presented those statements carefully.
“The program had real social value.”
When Asha reached the microphone, she agreed.
“Yes.”
The room went quieter than it would have if she had attacked everything.
“Hatua za Alfajiri helped people. I also failed to build strong enough privacy rules when we started. The form link was public. Too many people retained access to the spreadsheet. Emergency contacts were not separated early enough.”
Grace looked toward the panel.
“So the company was not the only place with privacy weaknesses.”
“Correct.”
Asha continued.
“But community benefit did not authorize taking voluntary check-in language and repurposing it for payroll scheduling without clear disclosure and appeal.”
Juma testified next.
He did not give a diagnosis.
He described a double shift, an incident, the contractor hostel, the fatigue band, and reduced hours.
“I needed rest,” he said. “I also needed rent. Telling the truth about being tired should not silently decide my income.”
Elias presented his own records under the narrow consent scope he had chosen.
Panel counsel asked, “Can you prove the score alone caused every reduction?”
“No,” Elias said. “That is why the synthetic test mattered.”
Priya presented the controlled test: same role; same seniority; same availability; fixed seed; band swap; decision trace.
The outcome followed the fatigue band.
The upstream mapping showed that a community-derived signal could help move the band across the threshold.
Ochieng confirmed the configuration.
Grace defended the objective as injury prevention.
The chair asked the harder question.
“If a fatigue classification triggers a safety reduction, where is the protected-rest or income-protection route?”
Grace described existing sick-leave policies.
“And fatigue below a medical-leave threshold?”
There was no clean answer.
The manual-mode report made the tradeoff visible. The company had continued operating without covert scores, but it paid more for standby staffing and accepted delays.
Efficiency had not disappeared.
Its true cost had surfaced.
When restitution was discussed, finance proposed a simple before-and-after formula.
Njeri objected.
“Timing alone is not enough. Claims need scheduling reason, available-hours evidence, and rule applicability.”
The panel created tiers: strong decision-trace cases; timing-plus-message cases; timing-only cases with appeal.
The final order did not destroy the company or ban every wellbeing tool.
It prohibited covert use of voluntary community data for payroll scheduling.
It required explicit purpose disclosure and consent.
It required worker-visible reasons, human review, and appeal for safety-driven reductions.
It prohibited retaliation for refusing voluntary wellbeing participation.
It ordered review of provable lost shifts for restitution.
It required deletion or lawful retention review of community-derived fields no longer needed.
It imposed an independent ninety-day audit and transparent staffing plans that budgeted for lawful rest rather than hiding shortages through opaque scores.
Grace asked whether the “zero burnout” metric could remain.
The chair said only if its methodology was disclosed and the company stopped treating fewer assigned hours as proof that workers were healthier.
Asha nearly laughed.
Reporters waited outside.
“Did Grace steal your data?”
“The finding is about purpose misuse and scheduling. Read the order.”
“Should the company be shut down?”
“No.”
It was not the headline they wanted.
Later, Grace found Asha in the corridor.
“The program was never designed to hurt people.”
“The finding did not require intent to be the test.”
Grace nodded once.
No dramatic reconciliation followed.
Juma arrived.
“Tomorrow morning?”
“What?”
“The walk.”
“The committee chooses the route now.”
Juma smiled.
“Will we walk without the app?”
Asha smiled back.
The rules had been decided in a hearing.
The hearing also addressed retention.
Elias asked whether the red fatigue label would remain in old archives forever even after the rule changed.
Ochieng said historical records were still stored under standard retention schedules.
The regulator required a specific review of community-derived fields. Data with no current lawful purpose had to be deleted unless needed for an active claim or another defined obligation.
That mattered to Asha.
A system could stop using a label and still let the label follow a person forever.
The order therefore covered not only future purpose but the afterlife of the old inference.
The panel also required monthly interim reporting before the ninety-day audit so the company could not quietly restore the old configuration in another field.
There was no victory speech.
There was a set of things that could be checked later.
That was the kind of ending Asha had learned to trust.
Tomorrow would show whether the community could still exist without a score.