Brio
Small companies want to look after their people, and their people do not trust an “anonymous” survey in a team of three. Brio makes privacy the architecture, not a setting.
- The problem
- 58 percent of small businesses now run a wellness programme, but the tools assume an HR team and a sales demo, and one of the best known left the segment for a $4,999 flat fee. Participation in these programs typically runs 20 to 40 percent.
- The goal
- Get participation to 65 percent or more with an operator who has no HR training, and prove the programme works at team level without ever showing one person's answer.
- What I did
- Research on 8 competitors and 5 trust benchmarks, three personas for three sides of the product, a seven-phase journey, 54 page specifications, and a grey prototype of 47 screens and 99 state pages with a voice applied to every line.
- What it gave
- A privacy bundle built into the architecture before any colour: answers only ever aggregated, no live response count, no score below five responses. There is no screen, export or data path that shows one person's answer.
Three users, and only one of them is the buyer.
In a company of forty people there is no HR department. There is an office manager, an ops lead or a founder who was handed people work on top of their actual job. She knows everyone by name and none of the methodology. She is the buyer, the daily user, and the point where adoption succeeds or dies.
The market says the need is real: 58 percent of small businesses run a wellness programme, up from 34 percent in 2021, and in a 2026 survey of 3,773 employees, 66 percent of those with a programme reported good wellbeing against 40 percent without. But the person whose behaviour decides whether the product has any data at all is the employee, who never sees the dashboard and never signs the invoice.
The low point is a single sentence on a form.
Six research documents, June 2026, public pages only: 8 competitors in three groups, a benchmark of 5 products people already trust with private data, a Lean UX canvas, a funnel model and the UX patterns. The gap it found: nobody combines self-serve pricing, a guided programme for someone with no HR training, and a team signal that is genuinely aggregate only. Everyone else assumes an HR team exists.
The journey has seven phases, and every emotion in it stands on a source. Where the crawler was blocked, the operator and employee voices were read in a real browser from public threads; where no first-person quote exists, the phase says so with a [?]. No emotion is drawn in. The low point is phase five, the moment an employee reads “your answers are anonymous”:
“My dept only has 3 of us. Needless to say we're not necessarily saying what we may want to.”
Privacy as mechanism, not as a promise.
In a small business there is no HR layer standing between the owner and personal data. So the privacy promise cannot be a sentence in a policy nobody opens. It has to be a mechanism the employee can see, and it has to visibly limit what the owner can see.
Four mechanisms, working as one bundle: a disclosure before the first question, not in a footer; at least five responses before any aggregate is shown; no live response count anywhere, because a running tally in a small team is a countdown to identification; and the privacy model written as a plain fact inside the product. Remove any one and the other three stop working.
The boundary is drawn before the screens are.
Twelve clusters and 54 pages, each with a written specification of its blocks, states and the person it serves: the operator, the owner or the employee. The boundary above is enforced at this level, which is why no later screen can quietly cross it: there is no node, export or entity that would let an owner look at one person.
The grey prototype renders the whole product for all three sides: 47 screens and 99 state pages, every internal link resolving, and a voice rulebook applied to every line of text. The visual layer is in progress; this case shows the part that is finished.
Calls that cost something, made on purpose.
Minimum of five, even when it means showing nothing.
A team of six with four responses sees an empty state, not a number. The threshold is fixed and cannot be lowered in settings.
CostIt delays the first moment of value, which is where activation is usually won.
No live response count, anywhere.
“7 of 12 answered” is a standard, motivating pattern. In a twelve-person company it is also a way to work out who has not replied. It is removed, and the phrase is on the voice rulebook's forbidden list so it cannot return in a later feature.
CostThe operator loses the easiest nudge in the category.
A number never appears without its reading.
The operator is not an analyst. Every score ships with a plain interpretation and a suggested next step, enforced as a voice rule across all 99 pages.
CostMore words on every screen that shows a score.
It looks like a privacy product, not a wellness brand.
No success colour and no celebration, only an alert colour. A dip is called a dip. The whole competitor set writes in the same upbeat register, which is why plain is the difference.
CostLess delight in a category that sells on it.
The bundle is specified and rendered. Participation is the test.
Shipped
Built to move
The number that decides whether any of this worked.
[?] Does the privacy bundle move participation above 65 percent. That is where the aggregate stops being noise. Every mechanism above is designed to reach it, and none of them proves it. It closes with the first live test.
[?] Does an aggregate-only view read as value to an owner who is paying for something he can never drill into. That is the commercial risk of the model, and it is written at the top of the canvas.
Forty-seven screens, ninety-nine states, one voice.
Yonder