Brio
Employee wellbeing for companies with no HR team, where the privacy boundary is not a policy page. It is the architecture.
- My role
- Product design end to end: research, personas, journey, architecture, prototype, voice
- Primary user
- Priya, the person handed people work with no HR training
- Built
- 47 screens, 99 state pages, 100 files, every internal link resolving
- Stage
- 6 of 12 stages complete, through Voice
Three users, and only one of them is the buyer.
In a company of forty people there is no HR department. There is an office manager, an ops lead or a founder who got handed people work on top of their actual job. She knows everyone by name and knows none of the methodology. She is the buyer, the daily driver, and the point where adoption succeeds or dies.
Behind her, the owner pays and wants proof it is worth it. In front of her, the employees answer, or do not. The person whose behaviour decides whether the product has any data at all is the one person who never sees the dashboard and never signs the invoice.
In a team of twelve, “anonymous” is not a believable word.
The lowest point of the current-state journey is not onboarding friction or price. It is the moment an employee reads the words “your answers are anonymous” in a company small enough that everyone can be identified by their writing style, their absence, or the timing of their response.
And in a small business there is no HR layer standing between the boss and personal data. The structural protection that exists in a large company is not there. So the privacy promise cannot be a sentence in a policy nobody opens. It has to be a mechanism the employee can see, and it has to visibly constrain what the boss is able to see.
Privacy as mechanism, not marketing. If you cannot point at it in the interface, it is not a promise.
Four mechanisms, working as one bundle.
The privacy bundle is the load-bearing feature of the product. It is four things that only work together, and removing any one of them collapses the trust the other three were building.
A disclosure shown before the first question, not buried in a footer. A minimum of five responses before any aggregate is ever rendered. No live response count anywhere, because a running tally in a small team is a countdown to identification. And the privacy model stated as a fact about how the product works, in plain words, in the product itself.
The promise, as the product renders it.
Three frames from the grey clickable prototype: 47 screens and 99 state pages, every state its own page. Concept is in progress, so nothing here is coloured yet. The privacy argument is made by what these screens refuse to show, which is a structural claim and readable at this layer.
Calls that cost something, made on purpose.
Minimum of five, even when it means showing nothing.
A team of six with four responses sees an empty state, not a number. This is expensive: it delays the first moment of value, which is the exact moment activation is usually won. It is kept because a product that quietly renders an aggregate from three answers has already broken the promise it is selling.
No live response count, anywhere.
“7 of 12 answered” is a standard, useful, motivating pattern. In a twelve-person company it is also a way to work out who has not replied yet. The pattern is removed from the product, and the word “live count” is in the forbidden list of the voice rulebook so it cannot quietly return in a later feature.
A number never appears without its reading.
The operator is not an analyst and does not want to become one. Every score ships with a plain-language interpretation and a suggested next action, as a voice rule enforced across all ninety-nine screens rather than a nice touch on the dashboard.
A dip is called a dip.
No celebration states, no exclamation marks, no “successfully”, no encouragement. The entire competitor set writes in the same upbeat wellbeing register, which is why plain and honest is the differentiation. If the trend is down, the product says so, and then says what to do.
The number that decides whether any of this worked.
[?] Does the privacy bundle actually move participation above sixty-five percent. That threshold is where the aggregate stops being noise and starts being signal. Every mechanism above is designed to reach it, and none of them proves it. It is closed by the first live test, not by a better argument.
[?] Whether a self-serve, aggregate-only tool reads as real value to an owner. The owner is paying for something he can never drill into. That is the commercial risk the whole model carries, and it is written at the top of the canvas rather than left implied.
Forty-seven screens, ninety-nine states, one voice.
The prototype covers the whole product across all three audiences, with every state as its own page and every internal link resolving. The voice rulebook was then applied line by line across all ninety-nine screens as a text-only pass, with the before and after of every string recorded.
Sift