Safety before featureswhy we refuse to act medical

The risk that worried me most

I'm Serhii Rohachov. I designed and built Mommy Refuel end to end, and across more than ten years of senior engineering work, the failure mode I've come to respect most isn't a crash or a slow query — it's a system that answers confidently when it shouldn't answer at all. In a wellbeing app for mothers, that failure mode has a name: pretending to be medical when it isn't, and getting it wrong for someone who is already vulnerable.

So the first architectural decision I made for the safety-sensitive parts of Mommy Refuel wasn't about the AI assistant. It was about what happens before AI is even allowed to speak.

Why safety classification is deterministic, not AI-driven

It would be technically easier to let a language model read a symptom or a message and decide how serious it is. I chose not to build it that way. Safety classification in Mommy Refuel runs through a rules engine — a pure, synchronous, unit-tested piece of code with no network access and no dependency on any AI model. It evaluates a fixed taxonomy — normal, concern, urgent, emergency, crisis — using a versioned, human-readable configuration of rules, not a black box.

That matters for a concrete reason: the same input always produces the same output. There's no randomness, no version of the model quietly changing its judgment between requests, and no way for a clever prompt or an unusual phrasing to talk the safety layer into downgrading something serious. If the configuration ever fails to load or returns something unexpected, the engine is built to fail toward the most cautious route, never toward "normal."

Crisis and urgent situations never reach the AI model

This is the part I'd want any mother using this app to understand clearly: if what you're describing looks like a crisis — thoughts of self-harm or harming someone else — or a red-flag symptom like heavy bleeding or a fever, the app does not hand that to an AI model to soften, summarize or respond to. The deterministic gate catches it first, and the AI call is simply never made. You're shown a distinct, unmissable safety screen with real actions — calling emergency services, contacting a trusted person, region-appropriate crisis resources — not a chat window.

The same gate runs twice: once on your device, and again on our backend, so a bug or a tampered client can't route sensitive text into the model by accident. Because the cost of missing a genuine crisis is so much higher than the cost of a false alarm, the pattern-matching behind this is deliberately tuned to catch more than it needs to, even if that occasionally means a benign phrase gets routed to a safety screen it didn't need. That trade-off is intentional.

What AI is — and isn't — allowed to do here

Once the safety gate clears something as normal or concern, Refuel AI can help: explaining why your score moved, suggesting what to focus on today, helping you draft a message asking for help, summarizing your week before a doctor's appointment. What it never does is diagnose you, claim you have a condition, decide whether a situation is an emergency, or compute your Refuel Score. The score arrives at the AI already calculated by a deterministic system; the model can only explain it in plain language, never generate or adjust the number itself.

Output is filtered before it reaches you, and it's labeled as AI-generated everywhere it appears. Anything AI drafts that becomes something you might send to another person — a help message, doctor questions, a summary — stays fully editable, because the point is to give you a starting point, not a final answer written on your behalf.

Guidance content is reviewed, not freely generated

For non-emergency symptoms, the app shows what you reported, what may help now, and what's worth monitoring, alongside a clearly separated medical-information card with real source attribution and an explicit "this is not a diagnosis" statement. That guidance comes from a reviewed content library keyed to the specific symptom, not from an AI model composing medical-sounding advice on the fly. AI is allowed to rephrase existing reviewed content if you ask it to explain something differently — it's never allowed to originate new medical guidance.

Any threshold or wording that touches a clinical judgment — what counts as a red flag, how a crisis screen is worded, which resources appear for a region — is explicitly marked in our configuration as requiring sign-off from a qualified clinician before it can ship to production. Engineering doesn't get to invent clinical thresholds because a placeholder value made the tests pass.

Honest statuses: available, beta, planned

The same instinct that keeps AI out of crisis decisions also shapes how I talk about what the app can do. A feature is either available, in beta, or planned — and it's labeled that way inside the app, not just in a roadmap document. I'd rather a mother see "planned" next to something we haven't built yet than have her assume a capability exists because it was implied by clever copy. That's a small discipline, but it's the same discipline as the safety layer: don't let confidence outrun what's actually been verified.

Why I consider this the real product

It would be faster to ship a single chat box and call it a wellbeing companion. I didn't build it that way, because the people using this app are often tired, worried, and making decisions about their own or their child's health in the middle of the night. A wellbeing app earns the right to be useful by being honest about its limits first — by routing the hard cases to real help instead of a confident-sounding paragraph. Everything else, including the AI, is built on top of that boundary, not around it. You can read the fuller technical picture in Trust & safety, and see the everyday side of it in the daily check-in.