Renata Individual Mode private data planning

Renata Individual Mode Private Data and Consent Model, Planning Only

Protected-preview planning artifact for future private data labels, consent, user control, and cross-mode separation.

This is a protected-preview, read-only Individual Mode Private Data and Consent Model. It defines future consent, minimization, retention, deletion, export, user-control, AI, crisis, commercial, and cross-mode sharing boundaries only; it does not create accounts, consent records, private data records, storage, chat, AI runtime, recovery coach runtime, billing, protected APIs, protected live routes, database behavior, migrations, exports, downloads, forms, inputs, buttons, or live workflows.

Purpose

Phase 11.6 defines the private data and consent model that must exist before any future Individual Mode account, storage, chat, AI, billing, or protected runtime work begins. The page records no consent, stores no private data, and creates no runtime path.

Current Boundary Status

Private data consent model status

read-only-renata-individual-mode-private-data-consent-model-plan

read-only-renata-individual-mode-private-data-consent-model-plan

Individual Mode status

future-planning-only

future-planning-only

Public Packet Mode status

only-live-static-current-mode

only-live-static-current-mode

Direct subscriber account status

not-created

not-created

Consent capture status

not-implemented

not-implemented

Consent record status

not-created

not-created

Private data storage status

not-stored

not-stored

Organization Mode visibility default

hidden-not-organization-visible-by-default

hidden-not-organization-visible-by-default

AI processing status

not-implemented

not-implemented

Chat runtime status

not-implemented

not-implemented

Recovery coach runtime status

not-implemented

not-implemented

Crisis runtime status

not-implemented

not-implemented

Billing status

not-active

not-active

Protected API status

not-created

not-created

Protected live route status

not-created

not-created

Database status

not-active

not-active

Migration status

not-added

not-added

Live workflow activation status

no-go

no-go

Future Private Data Categories

These categories are planning labels only. They are not collected, stored, shared, exported, downloaded, processed by AI, or made visible to Organization Mode.

check-ins

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-private-recovery-data

Safe future purpose: May later support subscriber-owned daily recovery orientation and follow-through.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

morning orientation entries

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-private-recovery-data

Safe future purpose: May later help a subscriber set intentions, structure, and support choices for the day.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

evening reflection entries

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-private-recovery-data

Safe future purpose: May later help a subscriber privately review what helped and what was hard.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

private reflections

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-private-recovery-data

Safe future purpose: May later support user-owned reflection without staff or organization visibility by default.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

craving/trigger notes

Planning status: planning-label-only

Sensitivity / handling class: very-high-sensitivity-recovery-risk-data

Safe future purpose: May later help a subscriber name urges or triggers and choose non-clinical support steps.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

relapse-prevention plans

Planning status: planning-label-only

Sensitivity / handling class: very-high-sensitivity-recovery-planning-data

Safe future purpose: May later help a subscriber outline personal support steps and warning signs.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

values/commitment notes

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-private-recovery-data

Safe future purpose: May later help a subscriber remember personal values and commitments.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

routines / structure plans

Planning status: planning-label-only

Sensitivity / handling class: moderate-to-high-sensitivity-private-routine-data

Safe future purpose: May later support user-owned routine building and structure reminders.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

repair/accountability drafts

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-private-writing-data

Safe future purpose: May later support private repair-oriented writing before any voluntary sharing.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

human-support plans or support contacts

Planning status: planning-label-only

Sensitivity / handling class: very-high-sensitivity-support-network-data

Safe future purpose: May later help a subscriber plan who to contact while protecting contact details and consent.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

memory-like continuity/preferences

Planning status: planning-label-only

Sensitivity / handling class: high-sensitivity-user-controlled-continuity-data

Safe future purpose: May later carry forward user-approved preferences, routines, and commitments.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

chat transcripts / prompt/completion records, if future AI is ever approved

Planning status: planning-label-only

Sensitivity / handling class: very-high-sensitivity-ai-interaction-data

Safe future purpose: May later support continuity only if AI, consent, deletion, export, and privacy gates are passed.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

crisis/escalation interaction records, if future crisis flow is ever approved

Planning status: planning-label-only

Sensitivity / handling class: restricted-crisis-safety-data

Safe future purpose: May later support a separately reviewed safety flow without making Renata the sole crisis pathway.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

consent records / consent receipts, as future policy concepts only

Planning status: planning-label-only

Sensitivity / handling class: restricted-consent-policy-data

Safe future purpose: May later document consent version, purpose, and revocation state only after policy approval.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

account/profile metadata, as future policy concepts only

Planning status: planning-label-only

Sensitivity / handling class: restricted-account-metadata

Safe future purpose: May later support account operation only after account, identity, privacy, and security gates are passed.

Blocked interpretation: Not collected, not stored, not organization-visible, not used for scoring, compliance, surveillance, marketing, clinical judgment, or staff reporting.

Required future consent or control: Requires explicit opt-in, plain-language notice, purpose limitation, user-controlled visibility, revocation, and separate consent for AI, cross-mode sharing, crisis/escalation handling, marketing, research, or analytics if ever applicable.

Required future retention/deletion/export: Requires retention limits, deletion rights, export/access rights, consent versioning or consent receipt policy, security review, and user-control review before storage.

Organization Mode visibility default: hidden-not-organization-visible-by-default

Current implementation effect: blocks-runtime-not-stored-label-only

Consent and User-Control Model

  • explicit opt-in before collection
  • plain-language notice before collection
  • purpose limitation
  • data minimization
  • user-controlled visibility
  • no default Organization Mode access
  • revocation / opt-out
  • deletion rights
  • export/access rights
  • retention limits
  • consent versioning / consent receipt as future concept only
  • separate consent for cross-mode sharing
  • separate consent for AI processing
  • separate consent for crisis/escalation resource handling, if ever applicable
  • separate consent for marketing/research/analytics, default blocked

Data Minimization Rules

  • Do not collect more than needed for the user-owned recovery purpose.
  • Do not collect resident/staff/program identifiers in Individual Mode by default.
  • Do not collect organization affiliation unless a separate account/sharing model is approved.
  • Do not store crisis, medical, legal, or clinical details without separate legal/privacy/safety review.
  • Do not use private data for scoring, ranking, compliance, surveillance, marketing, or organization reporting.

Cross-Mode Boundary

Status: separated-by-default

Individual Mode private data remains separated from Organization Mode by default.

  • Individual Mode private data is separated from Organization Mode by default.
  • Organization Mode cannot see direct-subscriber check-ins, reflections, relapse plans, memories, coach transcripts, support contacts, or private records by default.
  • No staff dashboard, review queue, analytics surface, tenant admin, or organization owner view can inspect Individual Mode private data.
  • Any future sharing requires separate explicit consent plus privacy, legal, product, and technical review.
  • No cross-mode bridge is implemented in this phase.

AI / Data Boundary

Status: blocked-planning-only

No OpenAI or AI processing for direct-subscriber content exists in this phase.

Blocked Now

  • no OpenAI processing for direct-subscriber content
  • no AI processing of private content
  • no prompt endpoint
  • no chat endpoint
  • no prompt/completion storage
  • no chat transcript storage
  • no memory storage
  • no risk scoring
  • no clinical judgment

Future Requirements

  • separate consent for AI processing
  • prompt/evaluation/privacy review
  • cost/budget gating
  • safety testing
  • data retention rules
  • deletion/export policy before activation

Crisis Boundary

Status: blocked-planning-only

Future crisis-related records or routing require a separately reviewed safety flow and must not treat Renata as the sole crisis pathway.

  • No crisis detection is implemented.
  • No hotline lookup is implemented.
  • No crisis workflow is implemented.
  • No triage is implemented.
  • No dispatch is implemented.
  • No emergency routing is implemented.
  • No local emergency content is implemented.

Commercial Boundary

Status: planning-only-inactive

Direct subscription remains future and planning-only.

no billingno checkoutno Stripe/payment providerno trial signupno lead captureno CRMno marketing funnelno customer recordsno support recordsno subscriber storage

Stop Conditions

  • someone asks to collect consent in the app
  • someone asks to store check-ins, reflections, relapse plans, support contacts, memories, transcripts, prompts, completions, consent receipts, or crisis records
  • someone asks to create accounts, login, signup, identity capture, billing, checkout, lead capture, or CRM
  • someone asks to add chat, AI runtime, recovery coach runtime, OpenAI processing, prompt endpoints, chat endpoints, protected APIs, protected live routes, database reads/writes, or migrations
  • someone asks to make Organization Mode private-data visibility active by default
  • someone asks to use private data for scoring, ranking, compliance, surveillance, marketing, clinical judgment, or organization reporting
  • someone asks to implement crisis detection, hotline lookup, crisis workflow, triage, dispatch, emergency routing, or local emergency content

What Remains Blocked

no live accountsno loginno signupno identity captureno account storageno subscriber storageno consent captureno consent recordsno private reflection storageno check-in storageno relapse-plan storageno craving/trigger note storageno routine storageno support-contact storageno memory storageno chat transcript storageno prompt/completion storageno crisis record storageno sensitive storageno chat runtimeno AI runtimeno recovery coach runtimeno crisis runtimeno emergency-service runtimeno OpenAI processing for direct-subscriber contentno prompt endpointno chat endpointno protected live routesno protected APIsno database readsno database writesno migrationsno formsno inputsno buttonsno textareasno checkboxesno selectsno upload controlsno export controlsno downloadsno generated PDFsno generated ZIPsno billingno Stripe/payment providerno checkoutno lead captureno CRMno marketing funnelno organization visibility into Individual Mode private datano staff dashboard for direct-subscriber datano analytics / scoring / ranking / compliance metricsno clinical claimsno treatment claimsno diagnosis claimsno medication adviceno legal adviceno case-management claimsno patient monitoring

Recommended Next Phase

Phase 11.17 - Individual Mode Handoff Freeze, Planning Only

Status: planning-only

After the Individual Mode static closure note is documented as a no-go planning artifact, future planning should freeze the handoff order and no-go language for outside-app review without creating handoff records, approvals, readiness records, protected APIs, storage, or live workflows.