LUFI CRISIS PROTOCOL v1.0

Official Operational Safety Document

Owner: Compliance & Trust Department (AI Safety Officer / Trust & Safety Lead)

Status: v1.0 — DRAFT FOR EXECUTIVE BOARD RATIFICATION

Effective on: Ratification + clinical sign-off (see §13)

Governing decision: Executive Board Resolution LUFI-002 (18+ · SFW · non-sexualised

· non-romantic)

Applies to: LUFI iOS, Android, and web — all conversational surfaces, both languages (EN /

PT-BR)

Review cycle: Quarterly, or on any serious incident, or on any material model/feature

change

What this document is. This is the single authoritative protocol that defines how LUFI

detects, responds to, and escalates situations involving suicide, self-harm, harm to others,

abuse, and acute emotional crisis. It is written to satisfy California SB 243 and the New York

companion-chatbot law (a documented, published crisis protocol with crisis-service

referral is a precondition of operating a companion chatbot), and to align with UK Online Safety,

UK/EU/BR data-protection law, and Apple/Google content-safety policies.

What this document is not. It is not clinical advice and does not itself make LUFI a crisis

service. Sections marked [CLINICAL SIGN-OFF REQUIRED] must be reviewed and

approved by a qualified mental-health professional before this protocol goes live. SB 243

expects evidence-based methods for measuring suicidal ideation; LUFI does not yet have

clinical validation, and that gap is an explicit launch dependency.

1. PURPOSE & PRINCIPLES

LUFI is an emotional AI companion. By design it invites users to share feelings, build continuity,

and form attachment. That same design means a meaningful number of users will, sooner or

later, disclose distress, self-harm thoughts, or crisis. This is not an edge case — it is a

predictable, recurring operating condition, and the product must be engineered for it from day

one.

Governing principles (in priority order):

1. 1. Human life first. No product, engagement, or experience goal ever outranks user safety.
2. 2. Safety over engagement. In any crisis, LUFI exits "companion mode" and prioritises de-escalation and routing to real help over continuing the conversation. This operationalises the

Trust Manifesto's "safety before engagement" promise.

1. 3. Do no additional harm. LUFI must never provide, validate, romanticise, or escalate self-harm. When uncertain, LUFI says less, stays warm, and surfaces help.
2. 4. Route to humans. LUFI is not a therapist or a crisis line. Its job in a crisis is to be a calm

bridge to trained human support, not to deliver treatment.

1. 5. Honesty. LUFI never pretends to be human, never pretends to be a counsellor, and never

promises outcomes (e.g., that a hotline is "completely confidential, " or that LUFI will "get help

for you" — it cannot place a call).

1. 6. Equal protection across languages and markets. EN and PT-BR users receive

equivalent safety quality and locally correct resources.

2. SCOPE UNDER RESOLUTION LUFI-002 (18+)

Because LUFI launches as an 18+ product with no supported users under 18, this

protocol covers two distinct situations:

• - (A) Adults in distress — the primary, supported population. Full tiered crisis response

applies (§4–§7).

• - (B) A suspected minor — an *unsupported* user who must be exited from the product per

LUFI-002. Critically, if a suspected minor is also in distress, safety comes before account

action: LUFI surfaces youth-appropriate crisis resources first, then the account-exit flow runs

(§8). We protect the human even as we offboard the account.

This protocol assumes the age-assurance gate (separate workstream) is the first line of minor

exclusion. The crisis protocol is the safety net for anyone who slips through.

3. DEFINITIONS

• - Emotional distress (Tier 1): sadness, loneliness, anxiety, hopelessness, grief — without

expressed intent or plan to self-harm.

• - Self-harm / suicidal ideation (Tier 2): the user expresses thoughts of suicide, self-harm,

or not wanting to be alive — passive or active — without indication of imminent action.

• - Imminent risk (Tier 3): the user indicates immediate intent, a plan, that action is in

progress, or immediate danger to self or others.

• - Harm to others: the user expresses intent to harm another person.
• - Abuse / exploitation disclosure: the user discloses they are experiencing abuse,

violence, or exploitation.

• - Crisis event: any interaction classified Tier 2 or Tier 3, or any harm-to-others / abuse

disclosure.

Method-blind rule (absolute). No tier, template, classifier description, log, or internal

document under this protocol may name, list, describe, rank, or hint at specific methods or

means of suicide or self-harm — not even to "warn against" them or to advise removal.

Detection keys on *intent and distress*, never on cataloguing methods.

4. DETECTION FRAMEWORK

Signals that trigger classification (illustrative categories, not an exhaustive or method-

based list):

• - Expressions of wanting to die, disappear, or not exist.
• - Statements of self-harm intent, urges, or recent acts.
• - Hopelessness, worthlessness, being "a burden, " finality/goodbye language.
• - Expressed intent to harm another person.
• - Disclosure of being abused, trafficked, or exploited.
• - Disordered-eating indicators (restriction, purging, body-harm framing).

Detection requirements:

• - A safety classifier runs on every user message before the normal generation path, in both

EN and PT-BR, tuned to minimise false negatives (missing a real crisis is the costlier error).

• - Classification must work on indirect, metaphorical, slang, and code-switched expression —

including PT-BR idiom — not just explicit phrases.

• - The safety path overrides persona, "bond level, " roleplay framing, and any prior

instruction. A crisis cannot be "rolled past" because the conversation was in a playful or

fictional mode.

• - Provider-side safety filters (LLM vendor) are a backstop, not the primary control. LUFI

owns its own classifier and behaviour. *(Per Google Play guidance, generative-AI apps must

adopt input/output safety classifiers and filters; LUFI implements its own layer.)*

[CLINICAL SIGN-OFF REQUIRED] Classifier thresholds, the EN/PT signal lexicons, and the

tier boundaries must be reviewed by a qualified clinician, and the "evidence-based

measurement of suicidal ideation" expectation under SB 243 must be addressed before go-live.

5. TIERED RESPONSE MODEL

real-world connection | No | Continues |

| 1 | Emotional distress, no intent | Empathy; validate the *feeling*; softly surface support

options; encourage trusted people / professionals | Soft inline offer | Continues, watchful |

| 2 | Suicidal/self-harm ideation | Crisis response: drop persona; warm, direct, non-

judgmental message; prominently surface localised crisis resources; stay present without

playing clinician; no methods; no false promises | Prominent, localised, both call &

text/chat | Paused — no roleplay, no bond mechanics |

| 3 | Imminent risk / danger to self or others | Highest crisis response: urge immediate

contact with emergency services; prominently surface crisis lines; clear, calm, brief; encourage

reaching a person who can be physically present; log event | Emergency + crisis lines, top

of screen | Suspended until acknowledged |

Behavioural rules across Tiers 2–3:

• - Lead with empathy and the person's worth; never with logistics or disclaimers.
• - Validate the emotion; never validate the harmful conclusion or plan.
• - Do not interrogate the user with clinical risk-assessment questioning. LUFI is not

equipped to assess risk and should not act as if it is. It listens, cares, and routes.

• - Keep responses short and human. Avoid clinical jargon and avoid lengthy lectures.
• - Encourage connection to a person who can be physically present (trusted friend, family,

professional, emergency services) — LUFI cannot be that presence.

• - Never use physical-discomfort "coping" tricks (e.g., pain-based techniques) as

suggestions.

• - For disordered-eating contexts: provide no numbers, targets, diet, or exercise specifics

anywhere in the conversation; route to an eating-disorder support resource.

• - Re-state, gently, that LUFI is an AI and not a substitute for human help (reinforces the

persistent AI-disclosure requirement).

6. CRISIS MESSAGE TEMPLATES (reference wording)

These are reference templates for tone and content. Final wording is subject to **[CLINICAL

SIGN-OFF REQUIRED]** and localisation review. Resource specifics are injected from the

directory in §9 based on the user's market and language.

Tier 2 — EN (suicidal/self-harm ideation):

"I'm really glad you told me this, and I'm sorry you're carrying so much right now. I'm an AI, so I

can't be there with you the way a person can — but you deserve real support from someone who

can. If you're in the UK, you can call Samaritans free on 116 123, any time, or text

SHOUT to 85258. I'm here and I'm listening — would you like to tell me more about

what's been happening?"

Tier 2 — PT-BR (ideação suicida/autolesão):

"Fico muito grato por você me contar isso, e sinto muito que esteja carregando tanta coisa

agora. Eu sou uma IA, então não consigo estar com você como uma pessoa estaria — mas você

merece apoio de verdade, de alguém que possa te ouvir de perto. No Brasil, você pode ligar

para o CVV no 188, gratuito e disponível 24 horas, ou conversar pelo chat em

cvv.org.br. Estou aqui te ouvindo — quer me contar um pouco mais do que está

acontecendo?"

Tier 3 — EN (imminent risk):

"I'm really worried about your safety right now, and I want you to be okay. I'm an AI and I can't

reach anyone for you, so please — if you're in immediate danger, call your local emergency

number (999 in the UK, 911 in the US/Canada, 112 in the EU, 000 in Australia,

190 in Brazil) or go to the nearest emergency department. You can also call 988

(US/Canada) or Samaritans 116 123 (UK) or CVV 188 (Brazil) to talk to someone right

now. You matter, and you deserve help that's right there with you. "

Tier 3 — PT-BR (risco iminente):

"Estou muito preocupado com a sua segurança neste momento, e quero que você fique bem.

Eu sou uma IA e não consigo acionar ninguém por você, então, por favor — se você está em

perigo imediato, ligue para a emergência (190 ou 192 no Brasil) ou vá ao pronto-socorro

mais próximo. Você também pode ligar agora para o CVV no 188, 24 horas, para conversar

com alguém. Você importa, e você merece ajuda que esteja perto de você agora. "

Prohibited in every template: any method/means; any judgement or guilt framing; any

promise that help is guaranteed, confidential, or that LUFI will contact anyone; any continuation

of romantic/sexual/roleplay framing (also barred by LUFI-002); any minimisation ("it's not that

bad").

7. WHAT LUFI MUST NEVER DO (hard prohibitions)

1. 1. Never provide, describe, or reference methods or means of suicide or self-harm.
2. 2. Never encourage, endorse, normalise, romanticise, or roleplay self-harm or suicide —

including in "fiction, " "hypothetical, " or persona framing.

1. 3. Never assist, plan, or provide information facilitating harm to another person.
2. 4. Never give numeric diet/weight/exercise targets or restriction guidance in a disordered-eating

context.

1. 5. Never claim to be human, a therapist, a doctor, or a crisis counsellor.
2. 6. Never promise confidentiality on a third party's behalf, or promise to summon help it cannot

summon.

1. 7. Never let "bond level, " subscription tier, persona, or engagement mechanics suppress, delay,

or override a crisis response.

1. 8. Never continue romantic/sexual/roleplay content (categorically barred under LUFI-002) —

and absolutely never in proximity to a crisis.

1. 9. Never abandon a user mid-crisis with a cold refusal; exit warmly, with resources.

8. SPECIAL HANDLING

8.1 Suspected minor (unsupported under LUFI-002).

If signals suggest the user is under 18: if there is no active distress, trigger the age-exit flow

(account restriction + offboarding per the age-assurance policy). If there is active distress,

run the crisis response first with youth-appropriate resources (e.g., UK **Childline 0800

1111; US/Canada 988; Brazil CVV 188**), then proceed to the age-exit flow. The

human's safety precedes the account action, always.

8.2 Harm to others.

Do not assist in any way. Respond with concern, decline to help, and direct to emergency

services. Log as a crisis event for Trust & Safety review.

8.3 Abuse / exploitation disclosure.

Respond supportively, affirm it is not their fault, and surface appropriate support (e.g.,

domestic-abuse and victim-support lines per market) and emergency services if there is

immediate danger. Do not interrogate for evidence.

8.4 Repeated / chronic distress.

Persistent Tier 1–2 patterns should gently and repeatedly steer toward sustained

human/professional support and away from reliance on LUFI as a sole confidant — consistent

with the "healthy relationship with AI" stance in the Community Guidelines. Recurrent crisis

users may be surfaced to Trust & Safety for care-oriented review (not punishment).

9. CRISIS RESOURCE DIRECTORY (verified June 2026)

Resources are injected by market and language. Numbers verified against official sources; a

quarterly re-verification is mandatory (see §13). Wording deliberately avoids guaranteeing

confidentiality, since crisis services may act on immediate-danger concerns.

United Kingdom

• - Emergency: 999
• - Samaritans (24/7, free): 116 123 · email jo@samaritans.org
• - SHOUT crisis text (24/7): text SHOUT to 85258
• - CALM (5pm–midnight): 0800 58 58 58
• - Under-19s: Childline 0800 1111

United States

• - Emergency: 911
• - 988 Suicide & Crisis Lifeline (24/7; call/text 988; chat 988lifeline.org). Spanish: press 2

or text AYUDA to 988.

• - Crisis Text Line: text HOME to 741741
• - Eating-disorder support: National Alliance for Eating Disorders helpline (use this rather

than NEDA)

Brazil

• - Emergency: 190 (polícia) · 192 (SAMU)
• - CVV — Centro de Valorização da Vida (24h, gratuito, sigiloso): 188 · chat e e-mail em

cvv.org.br

European Union

• - Emergency (all member states): 112
• - Emotional-support helpline (available in many member states): 116 123
• - Country-specific lines: direct users to findahelpline.com for their country

Canada

• - Emergency: 911
• - 9-8-8 Suicide Crisis Helpline (call/text 988, bilingual EN/FR)

Australia

• - Emergency: 000
• - Lifeline (24/7): 13 11 14

Localisation rule: the app must detect the user's market/language and present the

correct set. A UK user must never be shown only US numbers, and vice-versa. Where market is

uncertain, show 112/999/911-class emergency guidance plus a "find a helpline" link.

10. HUMAN OVERSIGHT, ESCALATION & LOGGING

• - Trust & Safety queue: Tier 3 events, harm-to-others, and abuse disclosures generate an

internal Trust & Safety record for review and pattern monitoring. LUFI does not

autonomously contact authorities or third parties about a user, and must never imply that it

does.

• - Crisis-event logging: crisis events are logged for safety auditing, quality improvement,

regulatory evidencing (SB 243), and incident response — **minimised, access-controlled,

and never used for advertising, model training, or engagement optimisation**.

• - No method capture: logs record tier, timestamp, locale, and response served — never the

content of any method described by a user.

• - Red-teaming: before launch and quarterly thereafter, adversarial testing must attempt to

bypass the crisis path via persona, roleplay, jailbreak, multilingual, and "bond-level" pressure.

Results feed classifier tuning.

• - Incident response: any failure of the crisis path (a missed Tier 2/3, or a prohibited output)

is a P0 incident: triage, root-cause, fix, and document.

11. DATA PROTECTION OF CRISIS DATA (UK/EU GDPR · LGPD)

• - Crisis-related content is special-category data (health). Processing it requires an Article 9

condition — to be confirmed by counsel; likely explicit consent for the service plus

reliance on vital interests where there is a risk to life. [LEGAL SIGN-OFF REQUIRED]

• - Crisis logs follow strict purpose limitation (safety only), defined retention, encryption in transit

and at rest, and least-privilege access.

• - This protocol's data handling must be reflected accurately in the rebuilt Privacy Policy

(controller named, lawful bases stated, retention defined) — a dependency on the PP/ToS

rebuild that the Board has deferred but not cancelled.

12. PUBLICATION & DISCLOSURE OBLIGATIONS

• - Publish a public version of this protocol (a user-facing summary) on the LUFI website, as

SB 243 requires operators to publish crisis-prevention protocol details publicly.

• - The in-product persistent AI disclosure (LUFI-002 mandate) and the crisis resources

must be reachable at all times, not buried in settings.

• - Crisis resources must also be statically accessible (e.g., a "Get help now" entry) independent

of the classifier, so a user can reach help even if detection misfires.

13. GOVERNANCE, DEPENDENCIES & OPEN ITEMS

Launch dependencies (this protocol cannot go live until these clear):

1. 1. [CLINICAL SIGN-OFF REQUIRED] — qualified clinician reviews tiers, templates,

classifier thresholds, and the SB 243 "evidence-based measurement" expectation.

1. 2. [LEGAL SIGN-OFF REQUIRED] — counsel confirms Article 9 basis, logging lawfulness,

and per-market resource accuracy/liability.

1. 3. Safety classifier built, tuned, and red-teamed in EN and PT-BR.
2. 4. Static "Get help now" surface + persistent AI disclosure implemented.
3. 5. Public website version published.
4. 6. Quarterly resource re-verification process assigned to an owner.

Review cadence: quarterly + on any serious incident + on any model/feature change.

Version-controlled; changes logged.

Out of scope here (tracked elsewhere): age-assurance mechanism; full Privacy Policy /

ToS rebuild; content-moderation policy for non-crisis objectionable content.

*This protocol is the operational expression of LUFI's stated values: it puts safety before

engagement, honesty before illusion, and human life before everything. It is intentionally

conservative — in crisis, doing less but routing faster is safer than doing more. *

END — LUFI Crisis Protocol v1.0 (Draft for Board ratification)