Yuna

An employer's mental health benefit was a traditional EAP: a phone number, a handful of free sessions, a waitlist to actually get matched with a therapist. Utilization was low, not because employees didn't need support, but because the benefit was only reachable during business hours, required scheduling a session in advance, and didn't fit the moment stress actually shows up — mid-shift, on a drive home, at 2am.

The company didn't need another underused line item in the benefits package. They needed something employees would actually open when they needed it, that could support them in the moment and knew exactly when to step aside for a licensed human.

Yuna gives employees an AI coaching companion available by voice or text any time, alongside a network of licensed therapists it can book directly into. I built the system end to end: the real-time conversation engine, the escalation and safety-routing logic, the therapist-matching and booking flow, and the anonymized employer-facing engagement dashboard.

Every conversation is private by default — employers see aggregate trends, never transcripts or individual activity. The coaching layer handles day-to-day stress, mood, and habit support, and is built to recognize the specific signals that mean a conversation needs more than coaching: escalating distress, a mention of self-harm, anything at or near a crisis threshold. When that happens, the system doesn't try to handle it — it interrupts the flow and routes immediately to crisis resources and a licensed therapist.

The core design decision was that the coaching model should never be the last line of defense. A separate, more conservative safety layer ran alongside every conversation, purpose-built to catch signals of crisis or self-harm risk — and when it fired, the response wasn't a scripted AI reply, it was an immediate, unambiguous handoff: crisis resources surfaced, a human path offered, the coaching conversation set aside. That threshold was deliberately set to over-trigger rather than under-trigger; a false positive costs a slightly awkward pause, a missed one doesn't.

Privacy was treated as core architecture, not a policy add-on. Individual conversations were encrypted and never surfaced to the employer in any form; what fed the employer dashboard was aggregated and de-identified at the data layer itself, before it was ever queryable — not filtered at the point of display.

Because this ran in a context where getting it wrong mattered more than almost any typical consumer app, the escalation path was tested and monitored independently of general product uptime — its own alerting, its own on-call response, its own review process for every crisis-adjacent routing decision. Voice and text sessions were built to degrade gracefully: a dropped connection mid-session preserved context so a person didn't have to re-explain themselves if they reconnected.

Rolling out from a traditional, underused EAP to Tandem changed the shape of the benefit itself: support stopped being something an employee had to plan ahead to use, and the cases that genuinely needed a licensed therapist or crisis line were reaching one faster and more reliably than the old phone-and-waitlist model ever managed.