Vimenti · Platform for Social Impact Social services · 2026 Platform Access design Sensitive data

Family Navigator.

A functional, working prototype that walks families through sensitive processes. The data model and the access design were the hard problem, and they were settled before the first screen.

Family Navigator, hero screenshot
3
roles, and each worker sees only their own cases
16
indicators scored per family, each one auditable
0
personal records reaching the reports or the model
the setting

Vimenti runs the first integrated family services center in Puerto Rico, a two generation model where education, health and economic mobility sit under one roof. A family's path crosses all three. For years that path lived in individual navigators' heads, in spreadsheets and in stacks of paper, and five years of assessments held real signal about what families needed that nobody could read across. The facts a household hands over in an intake interview are income, housing, health and family circumstance, and every copy carried them further from anyone's control.

the hard problem

Intake happens in community settings on unreliable connectivity, families come back months later expecting continuity, and the level a family is assigned moves real resources, so it cannot be a black box. That set the terms before any interface existed: sensitive answers captured away from the office, a score a supervisor can audit line by line, a worker who sees the families they carry and nothing else, and a way to learn from years of intake without reading anyone's file.

how we mutinied

We designed with the navigators rather than only for them, and we settled the data model and the access rules before drawing the screens. Caseloads are private and enforced on the server, not hidden in the interface. The instrument splits in two, so a family answers the ordinary questions on its own phone through a single-use link while the delicate ones stay inside the in-person conversation. Scoring is deterministic and explained value by value. Generative AI drafts narrative over tokenized placeholders, so personal data never reaches the model. Reporting is aggregate by construction. What is left is a small number of doors, all of them logged, on a deployment we watch.

What we built.

↓ each one working, not a mock

Private caseloads, enforced at the server

A social worker sees only the families they carry. Managers and administrators see the program. The restriction lives in the server, so the screen is not the thing holding it shut.

The instrument splits in two

Families answer the non-confidential questions on their own phone through a single-use prefilled link. The delicate questions never leave the navigator's in-person conversation.

Deterministic scoring, auditable line by line

Sixteen indicators scored one to four on a fixed rubric, with the level computed as answers arrive and every value explained beside it. The assistant drafts language; it never sets the level.

Goals suggested from the gaps

The same deterministic read that sets the level identifies each family's gaps and needs, and suggests goals from the catalog that answer them. The navigator assigns, adapts or declines each one case by case; the suggestions stay updatable, never automatic.

Benefit estimate and cliff risk, in the form

The summary estimates what each participant should be receiving and flags how close the household sits to its next benefit threshold, using the same verified rules engine behind the public Calculadora de Beneficios.

Tokenized before the model reads it

Every piece of personal data becomes a placeholder before a summary is drafted. Generative AI writes over the placeholders. What it does not write stays deterministic.

Reporting with no path to a person

The board shows counts and percentages, filterable by grant. It holds no view of a single household, so there is no record in it to open.

Field capture, encrypted and revocable

A separate installable app fills evaluations and logs contacts with no signal, encrypted at rest behind a field PIN, syncing without duplicates and wipeable remotely.

An audit record of access, not only of edits

Every access and every change is written to the log, failed sign-ins included, so the question of who read what has an answer.

How a case moves without spreading
01

Invite, or capture in the field

A caseworker sends a QR code or an email so the family answers the questions only it can answer. The navigator completes the rest in the field, offline if needed, resuming wherever anyone left off.

02

Score on a fixed rubric

Sixteen indicators, one to four each, computed live and shown value by value, so a supervisor can audit exactly why a family landed where it did.

03

Summarize over placeholders

Personal data is tokenized before any summary is requested. The model writes narrative over the placeholders and never sees the household behind them.

04

Plan and route to services

The assessment becomes a family roadmap and a referral pathway drawn from the goal catalog, with a follow-up cadence set by the level and adjustable without losing history.

05

Recalculate as life moves

Follow-up interventions and touchpoints are part of every plan, and any change in the family's conditions is registered there and rescored on the spot: a new job, or the loss of one. The level tracks the household as it lives, not as it last interviewed.

06

Read the population, not the person

Because every family answers the same instrument, an analysis layer reads across years of intake in aggregate, showing where need concentrates and where the catalog falls short. Years of back assessments were read exactly this way, and the goals that analysis surfaced were added to the catalog, so plans can cover the vulnerabilities intake actually reveals.

By request of the program: Family Navigator is a functional, working prototype, a proposal for how this intake-to-follow-up process can be solved and automated, built for Vimenti to validate. It is not an approved platform in production use.

What this proves.

✓ Sensitive data modeled before the interface, not after the incident ✓ Access scoped to real roles and enforced on the server ✓ Generative AI used over de-identified text, with the scoring left deterministic

under the hood: React and TypeScript, serverless API layer, managed Postgres with versioned migrations, role-scoped private caseloads, granular audit logging, deterministic scoring, verified benefits rules engine, PII tokenization ahead of generative-AI summaries, encrypted offline field capture with background sync, aggregate-only reporting

sensitive by design means decided at the first table, not patched at the last one

Want one like it?

We reply personally. A senior partner, not a sales pod. We'll tell you straight whether we can help.