Lichtung - Prescribable AI Journaling App with a Clinical Safety Console
DiGA Journaling App and Clinical Console for a Berlin Health Startup
Designed and built a clickable clinical console for a prescribable CBT journaling app on the German DiGA pathway: clinical review of every patient-facing text, an AI release register with safety gates and sign-offs, and a crisis detection log that staff review without ever reading a journal entry.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Impact
Dashboard, content review queue with a German and English diff panel, AI release register with compare, release detail with sign-off checklist, and the crisis detection log with its event panel.
100% crisis recall on the crisis set, 0 medication or diagnosis statements, a human-rated harm score of 1.5 of 5 or less, and no regression against the live release. Go live stays disabled until all 5 sign-off items are ticked.
Patients appear only as pseudonyms such as P-7K3M9Q. The one exception is a redacted crisis excerpt, shown only with the patient's safety review consent and after the reviewer states a reason.
22 crisis detection events from 5 sources, 8 AI releases including one rolled back, 10 content versions in review, 6 recently decided and 10 staff users.
The Problem
Auenwald's first product was a consumer journaling app with a chatbot bolted on. It could not be prescribed: it had no medical device conformity, no evidence of benefit and no answer to what the AI says to someone in crisis. Clinical content lived in a shared drive with no review trail, prompts were edited in production, and the study team pulled outcome data by hand from the production database.
Our Solution
Lichtung is one product where every word a patient sees is clinically reviewed and versioned, every AI release is tested against a safety evaluation set and signed off before it ships, crisis handling is deterministic and human-written, and staff run content, AI releases and safety review from pseudonymised data without reading a journal entry.
The Challenge: Safe AI in a Prescribable Medical Device
To be listed as a DiGA and reimbursed by statutory insurers, a journaling app has to be a CE-marked medical device that shows positive care effects, keeps health data in the EU and treats its AI as part of the device, not a feature that can change overnight.
A Medical Device, Not a Wellness App
Software intended to relieve depressive symptoms is a medical device under the EU MDR, generally class IIa under rule 11, which needs a notified body. That means versioned content and AI releases, release sign-off, post-market surveillance and vigilance reporting of serious incidents to BfArM.
An AI That Must Never Overstep
Reflections may summarise themes and suggest one approved exercise, but never diagnose, advise on medication or name self-harm methods. The feature is generally a high-risk AI system under the EU AI Act, so every output is labelled and a clinical reviewer stays in charge of what ships.
Crisis Handling Without Monitoring
Nobody reads entries in real time and Lichtung is not an emergency service. Crisis language, a positive PHQ-9 item 9 or the Help button must always open a human-written crisis screen with Telefonseelsorge, 112 and 116 117, and the detector still needs reviewing and improving.
Health Data Under GDPR Article 9
Journal entries, mood and questionnaire answers are special category data. The DiGAV limits their use to the intended purpose and bans advertising, BSI TR-03161 sets the security bar, and pseudonymised outcome data has to reach the study without anyone on staff reading it.
Our Approach: From DiGA Rules to a Clickable Clinical Console
Spec and Rules Research
Mapped 10 user roles, 44 screens across the patient app and the staff console, and the data model for patients, consents, access periods, journal entries, reflections, versioned content, AI releases, evaluation runs, crisis events, incidents, the outcomes study and insurer invoices. Wrote down the rules the design follows: the DiGA pathway under the DVG and DiGAV, EU MDR class IIa, BSI TR-03161, GDPR and BDSG, the EU AI Act, prescription codes, PHQ-9 and the HWG.
Clickable Demo on a Production UI Kit
Built 5 key console screens on a production dashboard kit: the dashboard with KPIs, safety strip, activations by week and study progress, the review queue with a German and English diff and the two-approval rule, the AI release register with compare, release detail with components, evaluation gates, sign-off checklist and live monitoring, and the crisis detection log with consent-gated excerpts. Approve, go live and roll back run on local state.
What a Production Build Adds
The 20-screen patient app and the remaining console areas, hosting in Germany, an EU-processed language model with no training on data (such as Mistral AI or Azure OpenAI), the insurers' DiGA code check and electronic invoicing, GesundheitsID sign-in, self-pay payments, study data capture in secuTrial or REDCap, staff SSO with a hardware key or authenticator, and an append-only, hash-chained audit log.
Why It Works: Clinicians Decide What Patients See
Two Approvals for Safety-Critical Text
Crisis texts, fixed AI responses and the reflection system prompt carry a lock and need a second approval from a different clinical reviewer. Approvals record the reviewer's professional role, and request changes needs a comment.
Every AI Release Is a Register Entry
Each release pins the base model, model version, system prompt version, output checker, crisis classifier and threshold, so a model change is visible, comparable and treated like any other change to the device, with the safety officer judging whether it is significant.
Go Live Only When the Checklist Is Complete
Evaluation gates passed, clinical reviewer approval, safety officer approval, risk file reference updated and release notes written. Rolling back the live release needs a reason, takes effect at once and opens an incident draft.
Safety Review Without Reading Journals
The crisis log shows source, detector, score, classifier version and whether the crisis screen was shown, with the matched phrase category instead of the text. Reviewers label each event as a true detection, false positive or unclear and can add it to an evaluation set as a clinician-rewritten synthetic case.
Related case studies
View all: Mental health & wellness
Remanso - Online Therapy Platform with Crisis Rules Built In
Designed and built a clickable psychologist workspace for a Spanish online therapy platform that matches clients with licensed psychologists: today's sessions with a pre-session summary, availability and bookings, a private clinical record per client, and a message inbox that flags risk phrases and replies waiting too long.
Hidamari - Employee Wellbeing Platform for Stress Checks and Long Working Hours
Designed and built a clickable staff console for a Tokyo HR-tech company's employee wellbeing platform: run the annual stress check, read group analysis that never shows a group under 10 people, follow physician interviews and track long working hours, with each piece of health information kept with the people allowed to see it.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab