Measure wellbeing without surveilling the people you are measuring.
Fifteen seconds a day for the people answering. Cases, group insights and action plans for the people responsible. Between them sits an architecture that makes an individual answer unreadable — to a manager, to a wellbeing lead, to an org admin.
How Lurno measures wellbeing privately
Lurno's wellbeing module collects short check-ins from staff and shows leaders only what cannot identify anybody. Each answer is stored against a keyed pseudonym rather than a name, and the only read policy on the check-in table matches the author's own user id — so nobody in the organisation can open an individual response, including a manager, a wellbeing lead or an org admin. Group results are released only once enough people have answered: the threshold starts at five, an organisation can raise it, and neither the organisation nor Lurno can lower it. Below the threshold nothing is shown at all — not a smaller number, not an average. Wellbeing stays off until an administrator switches it on for a particular organisation.
- a minimum group size
- A result is k-anonymous when every person it describes is indistinguishable from at least k−1 others. Here, k is how many people must answer before a group result appears at all — with k = 5, a four-person team never produces a chart. It applies to every bar, not just the total: four agree and one strongly disagree clears a check on the total, then publishes a bar of height one. Cells too small to publish fold into one other bucket rather than vanish, because dropping them would leave the counts short by exactly the hidden number.
Suppression happens on the server, before anything is serialised. A number that has reached the browser has been disclosed, whatever the interface then does with it. The same reasoning runs through security and the reporting layer.
What it feels like from the inside
Two taps, about fifteen seconds
How the day went, and how manageable the workload felt. An optional note nobody else can read. Skipping is free and the copy says so — no streak penalty, no follow-up.
- Reminders are in-app only. Never email, never a lock screen, and never carrying anything about how somebody has answered.
- Nobody is invited until they accept a versioned participation policy. Withdrawing stops future check-ins at once.
A shelf of short, practical things
A two-minute reset. Unclenching your jaw. What to do after a session that went badly. Opening one records nothing: no signal is written, so no row says who read what.
- Beside it sit the organisation's own contacts — an assistance line, a counsellor, a safeguarding lead. Until one is added, questions about mental health stay off: the product will not ask how someone is coping without somewhere to point them.
Three ways to speak up, with different rules
Voice takes concerns, ideas and questions about how the place runs, with anonymity set to never, the person's choice, or always. A support request is somebody choosing to attach their name and ask a lead to get in touch. A one-to-one holds the module's most sensitive text, so its read policy names the two people in the room and no one else.
- An anonymous Voice item hashes under its own purpose key, so it cannot be joined to that person's check-ins or cases.
Wellbeing leads get a caseload, not a dashboard
Cases with SLA clocks
Requests queue oldest first, because waiting is the part that hurts. Assignment, a state, a risk tier, a deadline. The breach warning fires an hour ahead and fires once — otherwise a five-minute sweep sends twelve an hour.
Group insights, threshold-gated
Ask a team how work is going. A campaign may request more privacy than the organisation's floor and never less, and the rows behind a chart are unreadable even to the insights permission.
Action plans with provenance
Each plan records the question it came from, how many answered, and the threshold that had to be met before anyone saw it.
Alerts with a duty-of-care trail
Who was told, whether it reached them, whether they said so. An acknowledgement is written by a handler that knows who is calling, so it cannot be stamped from a browser. One the system declined to send is logged as skipped and escalates at once.
A rules engine that is data, not code
Three leaf shapes and two combinators: a signal type, a compared path, and this happened N times in D days. No expression language, no eval. An unrecognised node is an error, never a silent pass.
Retention on two clocks
Each governed row carries the retention terms that applied when it was written. One clock drops the identity and keeps the pseudonym, so a trend does not rewrite itself when somebody leaves; the other removes the row.
Three decisions, made by your administrator
- 01
Turn the module on for one organisation
Off by default, and out of every sidebar until enabled. In a group of sub-organisations it is enabled one at a time — a parent does not switch it on underneath.
- 02
Set the guardrails
Add at least one support contact, or the questions about coping stay disabled. Then set the threshold: five is the floor, you can raise it, and you cannot lower it.
- 03
Choose questions, cadence and audience
Everyone on staff, or a group of at least five — smaller and every result identifies somebody. Answers attach to the template version, so an edit never changes what was already asked.
Who can see what
Each row is a rule the platform enforces itself. Where it says no, the row is not returned in the first place.
| Capability | The person who answered | Their manager | A wellbeing lead | An org admin |
|---|---|---|---|---|
| An individual check-in answer, note and allThe only read policy matches the author's own user id. | Yes | No | No | No |
| A group breakdown below the thresholdNot a smaller number, not an average, not a zeroed chart. | No | No | No | No |
| A group breakdown at or above it | No | With the insights permission | With the insights permission | With the insights permission |
| The raw rows behind an insightA staff read path here was removed in July 2026 — it had let an insights holder list, by name, who submitted what. | Their own | No | No | No |
| An anonymous item sent through Voice | Yes | No | Content, never the author | Content, never the author |
| A support request the person opened | Yes | No | Yes | No |
| One-to-one notes | Yes | Only if they are in the room | Only if they are in the room | No |
Tenant isolation platform-wide is enforced underneath the platform itself, not only by the screens on top.
Questions procurement asks
See it with your own thresholds.
We will walk through a check-in, a suppressed chart, a case with its clock running, and the policies underneath.