Skip to content
lurno
Wellbeing

Measure wellbeing without surveilling the people you are measuring.

Fifteen seconds a day for the people answering. Cases, group insights and action plans for the people responsible. Between them sits an architecture that makes an individual answer unreadable — to a manager, to a wellbeing lead, to an org admin.

In short

How Lurno measures wellbeing privately

Lurno's wellbeing module collects short check-ins from staff and shows leaders only what cannot identify anybody. Each answer is stored against a keyed pseudonym rather than a name, and the only read policy on the check-in table matches the author's own user id — so nobody in the organisation can open an individual response, including a manager, a wellbeing lead or an org admin. Group results are released only once enough people have answered: the threshold starts at five, an organisation can raise it, and neither the organisation nor Lurno can lower it. Below the threshold nothing is shown at all — not a smaller number, not an average. Wellbeing stays off until an administrator switches it on for a particular organisation.

a minimum group size
A result is k-anonymous when every person it describes is indistinguishable from at least k−1 others. Here, k is how many people must answer before a group result appears at all — with k = 5, a four-person team never produces a chart. It applies to every bar, not just the total: four agree and one strongly disagree clears a check on the total, then publishes a bar of height one. Cells too small to publish fold into one other bucket rather than vanish, because dropping them would leave the counts short by exactly the hidden number.

Suppression happens on the server, before anything is serialised. A number that has reached the browser has been disclosed, whatever the interface then does with it. The same reasoning runs through security and the reporting layer.

The person answering

What it feels like from the inside

Two taps, about fifteen seconds

How the day went, and how manageable the workload felt. An optional note nobody else can read. Skipping is free and the copy says so — no streak penalty, no follow-up.

  • Reminders are in-app only. Never email, never a lock screen, and never carrying anything about how somebody has answered.
  • Nobody is invited until they accept a versioned participation policy. Withdrawing stops future check-ins at once.
The people responsible

Wellbeing leads get a caseload, not a dashboard

Cases with SLA clocks

Requests queue oldest first, because waiting is the part that hurts. Assignment, a state, a risk tier, a deadline. The breach warning fires an hour ahead and fires once — otherwise a five-minute sweep sends twelve an hour.

Group insights, threshold-gated

Ask a team how work is going. A campaign may request more privacy than the organisation's floor and never less, and the rows behind a chart are unreadable even to the insights permission.

Action plans with provenance

Each plan records the question it came from, how many answered, and the threshold that had to be met before anyone saw it.

Alerts with a duty-of-care trail

Who was told, whether it reached them, whether they said so. An acknowledgement is written by a handler that knows who is calling, so it cannot be stamped from a browser. One the system declined to send is logged as skipped and escalates at once.

A rules engine that is data, not code

Three leaf shapes and two combinators: a signal type, a compared path, and this happened N times in D days. No expression language, no eval. An unrecognised node is an error, never a silent pass.

Retention on two clocks

Each governed row carries the retention terms that applied when it was written. One clock drops the identity and keeps the pseudonym, so a trend does not rewrite itself when somebody leaves; the other removes the row.

Switching it on

Three decisions, made by your administrator

  1. 01

    Turn the module on for one organisation

    Off by default, and out of every sidebar until enabled. In a group of sub-organisations it is enabled one at a time — a parent does not switch it on underneath.

  2. 02

    Set the guardrails

    Add at least one support contact, or the questions about coping stay disabled. Then set the threshold: five is the floor, you can raise it, and you cannot lower it.

  3. 03

    Choose questions, cadence and audience

    Everyone on staff, or a group of at least five — smaller and every result identifies somebody. Answers attach to the template version, so an edit never changes what was already asked.

The honest version

Who can see what

Each row is a rule the platform enforces itself. Where it says no, the row is not returned in the first place.

CapabilityThe person who answeredTheir managerA wellbeing leadAn org admin
An individual check-in answer, note and allThe only read policy matches the author's own user id.YesNoNoNo
A group breakdown below the thresholdNot a smaller number, not an average, not a zeroed chart.NoNoNoNo
A group breakdown at or above itNoWith the insights permissionWith the insights permissionWith the insights permission
The raw rows behind an insightA staff read path here was removed in July 2026 — it had let an insights holder list, by name, who submitted what.Their ownNoNoNo
An anonymous item sent through VoiceYesNoContent, never the authorContent, never the author
A support request the person openedYesNoYesNo
One-to-one notesYesOnly if they are in the roomOnly if they are in the roomNo

Tenant isolation platform-wide is enforced underneath the platform itself, not only by the screens on top.

Questions procurement asks

No. The single read policy on the check-in table matches the author's own user id, so a manager, a wellbeing lead and an org admin all get nothing back. Answers are written under a pseudonym, so the row a service process can reach does not say whose it is.

See it with your own thresholds.

We will walk through a check-in, a suppressed chart, a case with its clock running, and the policies underneath.