A private conversation, and a system that writes first
This is what a participant sees on a basic handset. The carrier layer is simulated — messages render here rather than travelling over SMS — but the conversation is live, grounded in an approved corpus, with a real classifier deciding when a human is needed.
Enrolment
asked in the first exchangeAsk something private
The participant is pseudonymous — no name, no number, nothing that identifies them. Pick a question, or write your own.
Demo clock
reviewer control · not in the real systemNobody in the real service has this. The participant just receives a text three days later; a scheduled job on the server sends it. This is here so you can skip the waiting.
Check-ins are scheduled at 7, 14, 21 and 28 days from the first message, with real dates. This moves today's date forward instead, so a month of follow-up is viewable in minutes.
Grounding
real retrievalThe corpus passages retrieved for the last message, and the exact terms that matched. These passages were in the prompt — this is not a reconstruction after the fact.
Send a message to see what grounded the answer.
Escalation classifier
two layersA deterministic rule pass runs first and can force escalation on its own. The model runs second, for judgement calls. The model can add an escalation the rules missed — it can never clear one they raised.
No message classified yet.
Randomization
recorded firstAssignment is written to storage before the message it governs is composed. An arm recorded afterwards is not evidence of anything.
No assignment yet.
The system knows its limits
A case arrives with the reason it fired and a priority. The conversation is not attached to the queue — a worker opens a case to read it. For a health funder, this is the single most important thing to see working.
Queue
No escalations yet.
What you have to work with
identity boundaryLoading…
Case
Select a case to open it.
A clinic verifies the outcome
The provider enters a referral code and records what happened. They never see the conversation — and not because it is filtered out. There is no endpoint that would return it.
Verify a referral code
The client shows you the code from her phone. You type it in — that is the only thing that reaches you.
Record the verified outcome
The six categories from the proposal. A voluntary decline is a valid outcome, not a failure.
The confidentiality boundary
enforced in codeShown side by side, because this is the architectural claim the prototype exists to demonstrate. Left is everything the provider is ever given. Right is what stays behind, and why.
Provider can see
Look up a code to populate this.
Provider never sees
The chain, assembled
Pseudonymous ID → conversation → randomization arm → referral issued → provider-verified outcome → follow-up schedule. Built from what was actually persisted. Close the tab and come back: it is still here.
Across the demo
No participant selected.