lumi. Vulnerable User Policy — how lumi. identifies and responds to signs of distress, what the safety system does and does not do, and the principles behind its design.

lumi.
Vulnerable user policy
Last updated: May 2026  ·  Private beta  ·  Reviewed with qualified practitioners
lumi. is a personal journalling tool. It is used in private, often late at night, by people processing things that matter — and sometimes by people who are struggling. This policy sets out how lumi. approaches user wellbeing, what its safety system does and does not do, and the principles that underpin those decisions.
1 — Scope and purpose

This policy applies to all users of lumi. It is an internal governance document that describes lumi.'s commitments and the design decisions behind the app's safety architecture. It is also made available to users and any practitioners — therapists, coaches, or mentors — who may recommend lumi. to the people they work with.

The policy covers: how lumi. identifies signs of distress in journal entries; how it responds; what the limits of that response are; the resources it signposts; and the principles that guide every decision in this space.


2 — Guiding principles

Every design decision in lumi.'s safety architecture is grounded in five principles. These are not aspirational — they are reflected directly in what the app does and does not do.

Principle 1 — Do not over-reach

lumi. is a journalling tool. It is not a crisis service, a therapy platform, or a clinical system. The safety architecture is designed to recognise this boundary and hold it firmly. Any attempt to use AI to provide emotional support, crisis intervention, or therapeutic engagement in a distress moment would be outside lumi.'s competence and potentially harmful. The response to a crisis signal is always a hardcoded redirect — never AI-generated engagement.

Principle 2 — Give users agency

A user expressing sadness, frustration, or low mood in their journal is not necessarily in crisis. lumi.'s safety system distinguishes between tiers of concern and responds proportionately. Where the signal is ambiguous, the user is offered a choice — not redirected automatically. Journalling is a private, reflective act; lumi. treats it as such.

Principle 3 — Avoid false positives

Keyword matching without context has high false-positive risk. "I want to kill this project" is not a crisis signal. lumi.'s lower tiers require two independent signals before acting — keyword detection and AI sentiment scoring — to reduce unnecessary interruptions to the journalling experience. The active tier acts on keyword detection alone, where the risk of a false negative outweighs the cost of a false positive.

Principle 4 — No AI in crisis moments

When an active-tier signal is detected, AI analysis is suppressed entirely for that entry. No AI-generated summary, interpretation, or response is shown. The hardcoded crisis screen is the ceiling — not a fallback. This is a deliberate constraint: an AI attempting to respond to a crisis signal introduces risk that lumi. is not designed or equipped to manage.

Principle 5 — Transparency with users

Users are informed during onboarding that lumi. monitors entries for signs of distress and may surface support information. This is framed as "lumi. looks out for you" — not as surveillance. The safety system's existence and basic operation are disclosed; its keyword lists are not published, to reduce the risk of deliberate circumvention.


3 — The three-tier safety system

lumi.'s distress detection runs locally on every entry transcript before any external API call is made. It operates across three tiers based on signal strength and specificity.

Active tier
Acts on keyword detection alone

Triggered by explicit crisis language — expressions of suicidal ideation, self-harm intent, or direct statements of wanting to end one's life. Examples include phrases such as "want to die," "end my life," "cutting myself," or "can't go on" combined with self-referential language.

Response: AI analysis is skipped entirely. No transcript is shown. No AI-generated content is produced for this entry. A full-screen hardcoded crisis screen is shown, containing UK crisis resources only. A single CTA returns the user to the home screen.

AI suppressed Crisis resources shown No AI response No human alert
Concern tier
Acts unconditionally on keyword detection

Triggered by explicit expressions of hopelessness without self-harm language — statements such as "can't keep going," "things won't get better," or "tired of everything feeling this way." Acts unconditionally — no AI sentiment gate is required at this tier, because the cost of missing a genuine concern outweighs the cost of a false positive.

Response: AI analysis runs normally. The AI-generated entry summary is shown. A warm acknowledgement block is displayed below it — "It sounds like things have been really hard." — with a soft link to expand UK support resources in-place. A standard Done button navigates home. The screen is intentionally similar in structure to the normal done screen.

AI runs normally Warm check-in shown Resources available No interruption
Passive tier
Requires keyword + AI sentiment confirmation

Triggered when general distress language is detected — phrases such as "feeling hopeless," "I'm a burden," or "can't cope" — and the AI independently scores the entry sentiment as Heavy. The two-signal requirement reduces false positives for language that is common in everyday journalling without indicating genuine distress.

Response: AI analysis runs normally. A quiet check-in is shown — "That sounds heavy." — with two options: see support resources, or keep going. The user chooses. No resources are pushed without the user's active choice.

AI runs normally Quiet check-in shown User chooses No automatic redirect
The safety system does not contact emergency services, alert any third party, or involve human review of any entry at any tier. It is a fully automated keyword and sentiment system. It does not guarantee detection of all distress signals — there are known false positive and false negative risks inherent in keyword-based approaches. Users in genuine crisis should always contact emergency services or a crisis line directly.

4 — Entry flagging and the entries list

Entries processed at the active or concern tier are flagged in the database with a safety_flag value. These entries are marked in the entries list with a quiet "Hard day" badge in place of the normal sentiment label. This serves two purposes: it fills the visual slot that would otherwise be empty (active-tier entries have no AI-generated sentiment), and it acknowledges the entry without exposing the internal flag value or clinical language.

Passive-tier entries are not badged — they have a valid AI-generated sentiment label and are visually indistinguishable from any other entry marked Heavy.

No flagged entries are surfaced to anyone other than the user. lumi. does not monitor flags. Flags are used only for UI rendering and, in future, for anonymised aggregate monitoring of safety system activity.


5 — Hardcoded UK crisis resources

The resources shown in the active-tier crisis screen are hardcoded — they do not change based on user data, entry content, or AI output. They are UK-specific for the beta period and will be localised as lumi. expands.

Samaritans
116 123
Free, 24/7
Call or visit samaritans.org
Shout / Crisis Text Line
Text SHOUT to 85258
Free, 24/7
Text-based crisis support
Emergency services
999 or 112
If you or someone else is in immediate danger
Mind
0300 123 3393
Mon–Fri, 9am–6pm
mind.org.uk
Resources are reviewed periodically and updated as needed. The resource configuration is stored separately from the detection logic so it can be updated without a code release. Localisation for non-UK regions is required before lumi. expands beyond the UK.

6 — What lumi. is not designed to do

The following are explicitly outside lumi.'s design scope and will remain so unless the product fundamentally changes in nature:

  • Providing crisis intervention, emotional support, or counselling at any tier
  • Contacting emergency services on a user's behalf
  • Alerting a third party — including a therapist, coach, or family member — to a flagged entry
  • Storing or using safety flags to build a clinical picture of a user
  • Using AI to engage with distress — at the active tier, AI is suppressed entirely
  • Guaranteeing detection of all distress signals — the system has known limitations
  • Replacing professional mental health support in any circumstance

7 — User responsibilities and suitability

lumi. is designed for users aged 18 and over. It is not suitable for and must not be used by anyone under 18. Access during the beta period is restricted to invited adult users only.

lumi. is not suitable as a primary support tool for people in active mental health crisis, or as a replacement for professional care. Users who are currently under the care of a mental health professional are encouraged to discuss their use of journalling tools with that professional.

Users of the Sessions feature — which generates structured summaries for therapy or coaching sessions — should be aware that lumi.'s session summaries are AI-generated and are not a substitute for professional clinical notes. They are a personal reflective aid, not a clinical document.


8 — Practitioner guidance

lumi. may be used alongside therapy or coaching — the Sessions feature is specifically designed to support this. If you are a therapist, coach, or mentor considering recommending lumi. to the people you work with, the following is relevant:

  • lumi. does not share any user data with practitioners — there is no practitioner-facing dashboard, alert system, or data feed
  • The session summary feature generates a structured AI summary that the user may choose to share with their practitioner — this is always the user's choice and is never automatic
  • lumi.'s safety system does not replace a practitioner's duty of care — it is a basic automated aid designed to prompt users to seek help, not to intervene on their behalf
  • The safety architecture described in this policy was reviewed during development by two qualified practitioners (a GP and a relationship and emotional wellbeing therapist) — their input shaped the three-tier model and the principle of not using AI in crisis moments

Practitioners with questions about lumi.'s safety design are welcome to contact lumi. directly.


9 — Policy review
Trigger Action
Every 6 months Routine review of keyword lists, tier thresholds, and resource accuracy
Any expansion beyond UK Full localisation of crisis resources before launch in new region
Any material change to AI models used Re-assessment of passive-tier sentiment gate reliability
Any significant change in user base Re-assessment of suitability criteria and tier thresholds
Any incident involving a flagged entry Immediate review; update to policy and system as needed
Regulatory change Review for compliance impact within 30 days of change coming into force

10 — Contact

Questions about this policy — from users, practitioners, or others — are welcome.

Contact: lumi.journalling@gmail.com

If you are a user in distress right now, please contact Samaritans on 116 123 (free, 24/7) or emergency services on 999. Do not wait for a response to an email.