This policy applies to all users of lumi. It is an internal governance document that describes lumi.'s commitments and the design decisions behind the app's safety architecture. It is also made available to users and any practitioners — therapists, coaches, or mentors — who may recommend lumi. to the people they work with.
The policy covers: how lumi. identifies signs of distress in journal entries; how it responds; what the limits of that response are; the resources it signposts; and the principles that guide every decision in this space.
Every design decision in lumi.'s safety architecture is grounded in five principles. These are not aspirational — they are reflected directly in what the app does and does not do.
lumi. is a journalling tool. It is not a crisis service, a therapy platform, or a clinical system. The safety architecture is designed to recognise this boundary and hold it firmly. Any attempt to use AI to provide emotional support, crisis intervention, or therapeutic engagement in a distress moment would be outside lumi.'s competence and potentially harmful. The response to a crisis signal is always a hardcoded redirect — never AI-generated engagement.
A user expressing sadness, frustration, or low mood in their journal is not necessarily in crisis. lumi.'s safety system distinguishes between tiers of concern and responds proportionately. Where the signal is ambiguous, the user is offered a choice — not redirected automatically. Journalling is a private, reflective act; lumi. treats it as such.
Keyword matching without context has high false-positive risk. "I want to kill this project" is not a crisis signal. lumi.'s lower tiers require two independent signals before acting — keyword detection and AI sentiment scoring — to reduce unnecessary interruptions to the journalling experience. The active tier acts on keyword detection alone, where the risk of a false negative outweighs the cost of a false positive.
When an active-tier signal is detected, AI analysis is suppressed entirely for that entry. No AI-generated summary, interpretation, or response is shown. The hardcoded crisis screen is the ceiling — not a fallback. This is a deliberate constraint: an AI attempting to respond to a crisis signal introduces risk that lumi. is not designed or equipped to manage.
Users are informed during onboarding that lumi. monitors entries for signs of distress and may surface support information. This is framed as "lumi. looks out for you" — not as surveillance. The safety system's existence and basic operation are disclosed; its keyword lists are not published, to reduce the risk of deliberate circumvention.
lumi.'s distress detection runs locally on every entry transcript before any external API call is made. It operates across three tiers based on signal strength and specificity.
Triggered by explicit crisis language — expressions of suicidal ideation, self-harm intent, or direct statements of wanting to end one's life. Examples include phrases such as "want to die," "end my life," "cutting myself," or "can't go on" combined with self-referential language.
Response: AI analysis is skipped entirely. No transcript is shown. No AI-generated content is produced for this entry. A full-screen hardcoded crisis screen is shown, containing UK crisis resources only. A single CTA returns the user to the home screen.
Triggered by explicit expressions of hopelessness without self-harm language — statements such as "can't keep going," "things won't get better," or "tired of everything feeling this way." Acts unconditionally — no AI sentiment gate is required at this tier, because the cost of missing a genuine concern outweighs the cost of a false positive.
Response: AI analysis runs normally. The AI-generated entry summary is shown. A warm acknowledgement block is displayed below it — "It sounds like things have been really hard." — with a soft link to expand UK support resources in-place. A standard Done button navigates home. The screen is intentionally similar in structure to the normal done screen.
Triggered when general distress language is detected — phrases such as "feeling hopeless," "I'm a burden," or "can't cope" — and the AI independently scores the entry sentiment as Heavy. The two-signal requirement reduces false positives for language that is common in everyday journalling without indicating genuine distress.
Response: AI analysis runs normally. A quiet check-in is shown — "That sounds heavy." — with two options: see support resources, or keep going. The user chooses. No resources are pushed without the user's active choice.
Entries processed at the active or concern tier are flagged in the database with a safety_flag value. These entries are marked in the entries list with a quiet "Hard day" badge in place of the normal sentiment label. This serves two purposes: it fills the visual slot that would otherwise be empty (active-tier entries have no AI-generated sentiment), and it acknowledges the entry without exposing the internal flag value or clinical language.
Passive-tier entries are not badged — they have a valid AI-generated sentiment label and are visually indistinguishable from any other entry marked Heavy.
No flagged entries are surfaced to anyone other than the user. lumi. does not monitor flags. Flags are used only for UI rendering and, in future, for anonymised aggregate monitoring of safety system activity.
The resources shown in the active-tier crisis screen are hardcoded — they do not change based on user data, entry content, or AI output. They are UK-specific for the beta period and will be localised as lumi. expands.
The following are explicitly outside lumi.'s design scope and will remain so unless the product fundamentally changes in nature:
lumi. is designed for users aged 18 and over. It is not suitable for and must not be used by anyone under 18. Access during the beta period is restricted to invited adult users only.
lumi. is not suitable as a primary support tool for people in active mental health crisis, or as a replacement for professional care. Users who are currently under the care of a mental health professional are encouraged to discuss their use of journalling tools with that professional.
Users of the Sessions feature — which generates structured summaries for therapy or coaching sessions — should be aware that lumi.'s session summaries are AI-generated and are not a substitute for professional clinical notes. They are a personal reflective aid, not a clinical document.
lumi. may be used alongside therapy or coaching — the Sessions feature is specifically designed to support this. If you are a therapist, coach, or mentor considering recommending lumi. to the people you work with, the following is relevant:
Practitioners with questions about lumi.'s safety design are welcome to contact lumi. directly.
| Trigger | Action |
|---|---|
| Every 6 months | Routine review of keyword lists, tier thresholds, and resource accuracy |
| Any expansion beyond UK | Full localisation of crisis resources before launch in new region |
| Any material change to AI models used | Re-assessment of passive-tier sentiment gate reliability |
| Any significant change in user base | Re-assessment of suitability criteria and tier thresholds |
| Any incident involving a flagged entry | Immediate review; update to policy and system as needed |
| Regulatory change | Review for compliance impact within 30 days of change coming into force |
Questions about this policy — from users, practitioners, or others — are welcome.
Contact: lumi.journalling@gmail.com
If you are a user in distress right now, please contact Samaritans on 116 123 (free, 24/7) or emergency services on 999. Do not wait for a response to an email.