Section 1

System architecture

Five distinct layers — each with a single responsibility. Inputs flow upward into models; outputs flow downward into experiences. No single model does everything. Specialisation enables safety, auditability, and performance.

Layer 1 — Data Input
Raw signals from child, parent & educator
Real-time
Interaction Signals
Keystrokes, tap latency, scroll depth, response times, hover patterns, error sequences, session abandonment points.
100ms samplingclient-side
Session
Language & Affect
Free text, chat messages, journal entries, check-in selections, voice transcripts (opt-in), emoji and symbol use.
NLP pipelinesentiment
Parent / Educator
Context Signals
Parent flags, educator notes, EHCP goals, diagnostic information, home event flags — difficult mornings, medication changes.
manual inputstructured
Historical
Longitudinal Record
All prior session data, mastery snapshots, emotional state history, content exposure log, outcome measurements over time.
time-series DBencrypted
Layer 2 — Processing
Signal interpretation and feature extraction
Core · 30s cadence
Feature Extraction Pipeline
Transforms raw signals into structured features: attention score, frustration index, confidence level, fatigue estimate, curiosity signal. Feeds all downstream models.
edge computeprivacy-first
NLP
Language Understanding
Sentiment analysis, reading age estimation, topic extraction, safeguarding flag detection, distress signal identification. Fine-tuned on neurodivergent language patterns.
fine-tuned LLM
Assessment
Response Scoring
IRT-based item scoring that distinguishes mastery from performance anxiety. Not just right/wrong — quality, approach, persistence, and creativity are all scored.
IRT model
Layer 3 — Model Layer
The child model and its specialist components
Cognitive
Cognitive Profile Model
Working memory, processing speed, attention window, chunk size, modality preferences. Bayesian update after every session.
Bayesian inference
Affective
Emotional State Model
Regulation level, anxiety index, motivation state. Predicts dysregulation 3–5 minutes before it peaks — proactive, not reactive.
LSTM · predictive
Mastery
Knowledge Graph
Concept-level mastery for every curriculum node. 8,000 nodes, 40,000 prerequisite edges. Forgetting curve tracked per concept per child.
knowledge graph
Contextual
Context Model
Time-of-day patterns, weekday variation, seasonal signals, home context flags, school calendar awareness. Environment shapes cognition.
temporal · contextual
Layer 4 — Output Layer
Decisions translated into experiences
Instruction
Content Selector & Generator
Selects or generates the right content, in the right format, at the right difficulty — every single moment of every session.
RAG + LLM
Tutor
Conversational Tutor AI
Warm, patient, endlessly creative — a learning service built on expert pedagogy and child psychology. Never uses "wrong."
persona-consistent
Reports
Insight Generator
Plain-language summaries for parents and educators. EHCP-formatted reports. Human-reviewed for clinical accuracy before every delivery.
LLM + human review
Intervention
Regulation Responder
When the affective model predicts dysregulation, selects the right response — break, switch, calm tool, or parent escalation.
rule-based safety
Layer 5 — Safety Layer
Always on · cannot be disabled · no exceptions
Content
Content Guard
Every AI-generated output passes content safety filter before delivery. Zero exceptions. <50ms latency on the critical path.
Safeguarding
Safeguarding Monitor
Real-time scan of all child input for abuse, self-harm, and crisis signals. Human review queue. Sub-4hr response SLA.
Privacy
Data Privacy Layer
PII removed before any model training. Differential privacy for aggregate analytics. Child data never leaves encrypted storage.
Audit
Decision Logger
Every AI decision logged with reasoning. Parents can request full session logs. Regulatory audit trail maintained permanently. No black boxes.
Architectural principle: No child learning data is ever processed by a third-party AI API. All inference that touches child data runs on self-hosted infrastructure. This takes precedence over cost, convenience, or model quality advantages. We will build or fine-tune our own models rather than compromise on this.

Section 2

A living cognitive portrait

Every child has a continuously-updated model of how they learn. Not a diagnosis label — a precise, evolving map of this specific child at this specific moment. It updates after every session and informs every AI decision.

CHILD_MODEL · example_profile · session 47
live · updates every session
Attention window
9 min
optimal chunk length
Processing speed
P38
percentile · context-adjusted
Working memory
3–4
items held simultaneously
Regulation score
74
today · 7-day rolling: 68
Best session time
4–6pm
based on 47 sessions
Primary modality
Visual
+ auditory secondary
Arrival state today
😐
neutral · slight fatigue
Confidence index
+12
↑ vs onboarding baseline
Frustration trigger
3 errors
consecutive · threshold
Preferred break
Movement
chosen 71% of the time

Child Model Schema · Live example · Session 847

What follows is a simplified example of what Bloom stores and continuously updates for a single child. Every field is derived from real session data — not set at onboarding and forgotten. By session 847, the model knows this child's optimal attention window, their regulation baseline, which modalities work for their profile, and even that Mondays are harder than other days. This is what "adaptive" actually means in practice — not a single difficulty slider, but a living portrait updated every session.

// Child model schema — simplified { childId: "ch_a8f2k9", modelVersion: 847, // increments every session confidence: 0.84, // grows with data over time cognitive: { attentionWindowMinutes: 9, workingMemoryItems: 3.5, frustrationThreshold: 3, // consecutive errors before intervention optimalChunkSize: "SHORT" }, affective: { regulationBaseline: 68, arrivalStateToday: "NEUTRAL", preferredBreakType: "MOVEMENT", dysregulationRisk: 0.12 // current session score }, modalities: { // preference scores 0–1 visualDiagram: 0.80, audioNarration: 0.65, videoContent: 0.72, writtenText: 0.30, // low — dyslexia profile creativeTask: 0.55 }, temporal: { bestSessionHours: [16, 17, 18], mondayEffect: -0.18 // regulation dip every Monday } }

Section 3

Six specialist AI modules

Each module is independently deployable, testable, and auditable. They share the child model but operate independently — so a failure in one never cascades to others.

M1 — Emotional State Detector · LSTM + NLP · 30-second inference cycle
📥
Signal collection
Response latency, error rate, free text sentiment, check-in selections, time since last break, session duration. Sampled every 30 seconds passively — child never prompted.
always on · passive
🔬
LSTM inference
Planned sequence model, to be trained once Bloom has around 50,000 annotated sessions. Reads the pattern of signals over time — not just the current moment — to identify trajectories toward dysregulation.
Design target: trained specifically on neurodivergent session data, not general-purpose emotional AI. No data exists yet.
📡
Regulation score output
Produces a 0–100 regulation score, a predicted trajectory for the next 5 minutes, and a recommended intervention class for the adaptation engine.
<200ms latency
🔄
Child model update
Score feeds into the affective layer of the child model. Session-level data stored for longitudinal pattern analysis and ongoing model improvement.
Accuracy target to be set in beta
M2 — Knowledge Graph & IRT Engine · Item Response Theory · per-concept mastery
🗺️
Curriculum knowledge graph
8,000 curriculum nodes connected by 40,000 prerequisite edges. Every concept knows what it depends on and what it unlocks. Prerequisite gaps surface automatically.
Neo4j · custom ontology
📐
IRT scoring
3-parameter logistic model scores each response for difficulty, discrimination, and guessing probability. Distinguishes genuine understanding from performance anxiety.
Anxiety-adjusted: high-stress performance is weighted differently from calm performance.
📉
Forgetting curve tracking
Ebbinghaus-derived forgetting curve modelled per concept per child. Concepts resurface at precisely calculated intervals — invisible to the child, woven into session warm-ups.
spaced repetition · automatic
🎯
Mastery state classification
Every concept node carries a live mastery state. State drives what content is served next and when concepts resurface for retrieval practice.
Bayesian posterior update
Unknown Emerging Developing Secure Fluent
M3 — Content Selector & Generator · RAG + LLM · multimodal output
🧭
State-aware decision
Child model state — regulation score, mastery level, modality preferences — determines what type of content is appropriate before any retrieval begins.
📚
Library retrieval
RAG search across 10,000+ curated content units. Format-aware: retrieves visual, audio, interactive, or narrative variants based on the child's live modality vector.
Child's interests (dinosaurs, football, coding) are injected as the actual context of examples — not surface decoration.
✨
Generation if no match
When the library has no sufficiently good match, the LLM generates novel content. Every generated piece passes: reading level check, clinical language check, content safety filter.
3-filter pipeline
🚀
Feedback loop
Engagement and outcome signals fed back to improve future selection. Every session makes the model more accurate for this specific child.
reinforcement loop
M4 — Conversational Tutor AI · fine-tuned LLM · persistent persona
👤
Persona consistency
A consistent character across every session — same warmth, patience, curiosity. The child builds a genuine relationship. The character never breaks, never forgets, never judges.
🗣️
Adaptive explanation
Explanation 1 fails → simpler language. Still fails → different analogy. Still fails → different modality entirely. Still failing → brain break, then return fresh with a new approach.
Fine-tuned on expert tutoring transcripts, child psychology texts, and SEN practice guides.
🚫
Language rules (hard)
Never: "wrong," "incorrect," "try again," "mistake." Always: specific praise ("you tried four different approaches — that takes persistence"), alternatives not corrections.
reviewed by psychologists
🔒
Scope guardrails
Hard stops for clinical advice, personal disclosure beyond educational scope. Safeguarding module runs in parallel on every single message the child sends.
safety layer always active
M5 — Insight & Report Generator · LLM + structured templates · human-reviewed
📰
Parent weekly digest
Warm narrative. One specific celebration. One pattern worth noticing. One conversation starter for the week ahead. Max 300 words. Delivered Sunday evening.
📋
EHCP reports
Structured to SEND Code of Practice format. Evidence cited from session data. Saves families 5+ hours per application. Reviewed by a qualified SENCO before delivery.
No AI clinical output is ever delivered without human review. Non-negotiable.
🌅
Educator morning brief
Bullet-format. Flags for today. Which students had difficult evenings (parent-flagged). Differentiation suggestions based on live session data. 60-second read maximum.
🌍
Multilingual delivery
12 languages via post-generation translation. Culturally reviewed — not just machine-translated. EAL families receive identical quality of insight as English-speaking families.
12 languages at launch
M6 — Safeguarding AI · always-on · designed to miss nothing, with human review
🔍
Multi-layer detection
Keyword matching (100+ patterns, typo-tolerant) + semantic LLM contextual analysis + longitudinal pattern analysis across sessions. Three independent layers — all three must agree before dismissal.
⚡
Immediate response
On detection: session pauses gracefully. Child receives warm, calm message. Safeguarding lead alerted within 5 minutes. Human review triggered immediately — not queued.
False positives are reviewed and welcomed. False negatives are treated as critical failures requiring model review.
📞
Escalation pathway
AI flag → Senior Safeguarding Lead → Parent/guardian contact → Statutory referral if required. Every step logged, timestamped, and permanently auditable.
sub-4hr parent contact SLA
📊
Quarterly model review
Every flag reviewed by clinical team. Outcomes fed back to improve detection accuracy. Missed signals retrospectively identified and used for training. The model never stops improving.
Non-negotiable: The Safeguarding AI cannot be disabled, downgraded, or bypassed by any user, administrator, or system update. It operates on every message, every session, with no exceptions.

Section 4

Curriculum framework

The curriculum is not a content library with accessibility features bolted on. It is built from the ground up on six pedagogical frameworks — with neurodivergent cognition as the design target, not an afterthought.

Frameworks
🌐 Universal Design for Learning
🎯 Mastery-Based Progression
💪 Strength-Based Entry Points
🧩 Cognitive Load Design
🔄 Spaced Retrieval System
💚 Emotion-First Sequencing

Universal Design for Learning

UDL assumes variability is the norm. Designing for the edges creates a better experience for everyone. Bloom implements all three UDL principles at the curriculum architecture level — not as accessibility overlays applied after the fact.

🎬 Principle 1 — Representation

  • Every concept delivered in ≥3 formats as standard
  • Visual, auditory, kinaesthetic as the baseline — not the exception
  • Text complexity automatically matched to child's reading level
  • No concept is text-only anywhere in the curriculum
  • All audio content has captions and transcripts

✍️ Principle 2 — Expression

  • Draw, speak, type, build, or perform to show understanding
  • No single "correct" response format ever enforced
  • Output medium matches child's identified strengths
  • Voice-first for children with motor or writing difficulties
  • All response types marked as equally valid

🔥 Principle 3 — Engagement

  • Interest-based content hooks woven into every topic
  • Child-selected challenge level within a safe range
  • Autonomy over learning sequence where possible
  • Varied social contexts: solo, async-peer, showcase
  • Intrinsic motivation always prioritised over extrinsic rewards

📦 Content modality types

  • Visual diagrams and illustrated concept maps
  • Audio narration and explanation podcasts
  • Interactive drag-and-drop and building activities
  • Short-form video + captions (documentary style)
  • Open-ended creative response tasks
  • Story and narrative framing for every subject area

Mastery-Based Progression

Children move forward when they are ready — not when a schedule dictates. A child who hasn't mastered subtraction does not move to multiplication. But they are never made to feel behind — the framing is always "not yet," never "behind."

📋 The learning sequence

  • Concept introduction — visual + audio, no reading required
  • Three worked examples before any independent attempt
  • Guided practice with scaffolding visible and hints available
  • Fluency check — game-like, low-stakes, child-initiated when ready
  • Creative application — open project to demonstrate depth

🚦 Mastery thresholds

  • 80%+ IRT confidence score required before progression
  • Mastery decays over time via Ebbinghaus forgetting curve
  • Child can request earlier fluency check if they feel ready
  • Partial mastery: next concept unlocked in preview-only mode
  • Mastery is never "lost" — always "due for a revisit"
Why this matters: Neurodivergent children have often experienced the trauma of being pushed forward before they were ready. Mastery-based progression removes that pressure entirely — while the AI's invisible scaffolding fills gaps before they become barriers to the next stage.

Strength-Based Entry Points

Every subject is taught through the lens of what the child already loves and does well. This is not superficial personalisation — it is structural. The child's identified strengths become the cognitive scaffold for everything new.

🔭 Spatial / Visual strength

  • Maths through geometry and visual patterns first
  • Writing through storyboarding and visual planning
  • Science through diagrams, models, spatial reasoning
  • Common in ADHD and autism profiles

📖 Narrative / Verbal strength

  • Maths through rich story problems with real characters
  • Science through documentary and narrated discovery
  • History through first-person accounts and letters
  • Common in hyperlexic and creative profiles

⚙️ Systems / Patterns strength

  • Reading through code structure and pattern recognition
  • Maths through pure logic and mechanism
  • Science through how-things-work deep dives
  • Common in autism and twice-exceptional profiles

🎨 Creative / Maker strength

  • Writing through art direction and visual making
  • Maths through building, measurement, construction
  • Science through hands-on experiments and making
  • Common in ADHD and dyspraxia profiles

Cognitive Load Design

Cognitive overload is the enemy of learning — and neurodivergent children hit it faster and with fewer warning signs. Every piece of content is designed against a strict cognitive load budget. These are enforced constraints at the content authoring stage, not guidelines.

✅ Intrinsic load rules

  • Max 3 new concepts per session — hard limit enforced at content level
  • Max 2 instructions visible on screen simultaneously
  • Sequential instructions revealed progressively, not all at once
  • Complex processes split across sessions with a narrative bridge
  • Worked examples always before independent practice — always

🧹 Extraneous load rules

  • Every UI element on learning screens must be justified — decoration removed
  • Competing visual information eliminated from focus screens
  • Navigation hidden until needed, revealed only when relevant
  • Max 3 elements competing for attention on any single screen
  • All activities audited against a cognitive load scoring rubric

🧠 Germane load (intentional)

  • Schemas built explicitly — "this is like that thing you learned before"
  • Connections to prior knowledge are always stated, never assumed
  • Pattern recognition actively taught, not assumed to emerge
  • Transfer to new contexts encouraged through varied application tasks

⏱️ Pacing controls

  • 5–8 minute natural stopping points built into every activity
  • Brain breaks built in structurally — not bolted on as an afterthought
  • Child controls pace within session at all times
  • No time pressure on any individual interaction, ever

Spaced Retrieval System

The forgetting curve is real — and spaced review matters for every child. The curriculum is a spiral, not a line. Content returns at precisely calculated intervals, woven invisibly into sessions so retrieval practice never feels like testing.

📅 Spacing schedule — example

  • Day 0: Initial mastery to 75%+ IRT confidence before progression
  • Day 1: Retrieval woven into next session warm-up activity
  • Day 7: Creative application of concept in a new context
  • Day 21: Interleaved with a related new concept being learned
  • Day 60+: Adaptive maintenance — interval extends if retrieval stays strong

🔀 Adaptive intervals

  • Strong retrieval: interval automatically extends — less practice needed
  • Weak retrieval: concept re-taught from a completely new angle first
  • Child is never told "you forgot this" — always "let's revisit"
  • Interleaving used deliberately to strengthen relational memory
  • Every scheduling decision driven by that child's live IRT score
Design rule: Retrieval practice is never called a test or framed as assessment. It appears as warm-up activities, creative challenges, and conversation starters — identical in format to regular learning. The child never knows the difference.

Emotion-First Sequencing

Bloom's design principle: a child should feel settled before academic work begins. Academic content never starts until the check-in confirms the child is ready. Some practitioners draw on polyvagal theory here, but it is contested, so Bloom treats this as a design choice to test, not settled science.

🔴 Dysregulated state

  • Curriculum: PAUSED — no exceptions, no overrides
  • Regulation tools offered immediately and warmly
  • No academic content attempted in this state
  • Session ends with full dignity preserved
  • Parent receives warm notification with a practical guide

🟡 Unsettled state

  • Low-demand, familiar content only — no new concepts
  • Favourite activities and previously-mastered topics
  • Build toward regulation through small, achievable wins
  • Check-in revisited gently after 10 minutes
  • Child's choice honoured at every step

🟢 Regulated state

  • Full curriculum access — all content types available
  • New concepts can be introduced when mastery path is clear
  • Challenging content appropriate and offered
  • Creative and open-ended exploratory tasks available
  • Stretch activities if regulation score exceeds 80

🕯️ Session opening ritual

  • Same structure every session — predictability is safety
  • 2-minute low-demand warm-up regardless of emotional state
  • Feelings check-in using illustrated animal scale, not words
  • Today's plan shown upfront — no surprises ever
  • Child can modify the plan without explanation or penalty

Section 5

How each subject is reimagined

Each subject is rebuilt from its learning objectives outward — not from its traditional teaching methods inward. The question is never "how do we teach maths?" but "how does this specific child come to understand mathematical thinking?"

🔢
Mathematics
Ages 5–16 · KS1–KS4 · UK National Curriculum

Maths anxiety and low maths performance feed each other (Cambridge / Nuffield, 2019). Redesigned around conceptual understanding first, procedural fluency second — with visual-spatial as the default entry point.

  • Concrete → Pictorial → Abstract (CPA) for every concept
  • Number sense before arithmetic — no rote tables without meaning
  • Visual models: number lines, arrays, bar models throughout
  • Dyscalculia accommodations: finger use and counting normalised
  • Real-world context before abstraction — child-chosen scenarios
  • Every error treated as information and explored with curiosity
  • Time and duration as a dedicated thread — clock reading, sequencing, and time management built from concrete manipulation. Informed by NCETM guidance.
  • Executive function embedded: time awareness as a life skill, not just a curriculum target
NCETM partnership opportunity: The National Centre for Excellence in the Teaching of Mathematics publishes evidence-based approaches directly relevant to Bloom's maths curriculum — particularly around number sense, time, and mastery progression. Engaging NCETM as a curriculum adviser would strengthen credibility and align Bloom's content with the most respected national framework.
📝
Literacy & English
Ages 5–16 · Reading, writing, comprehension

Reading, writing, and comprehension treated as distinct skills. A child can excel at comprehension while still developing decoding — the subject is rebuilt around this separation.

  • Structured literacy: systematic phonics, multisensory reinforcement
  • Voice-first writing: dictate → transcribe → edit, always available
  • Graphic novels, audio books, comics as first-class texts
  • Grammar through pattern recognition, not rules memorisation
  • Hyperlexic learners: comprehension deepening alongside decoding
  • Writing is thinking — never handwriting
🔬
Science
Ages 7–16 · Biology, Chemistry, Physics

Where many neurodivergent children find their superpower. Deep curiosity, pattern recognition, and obsessive interest align perfectly with science. Bloom leans into this deliberately.

  • Interest-led: child's obsessions become the scientific lens
  • Observe → question → explain — theory always follows experience
  • Visual models for abstract concepts (atoms, forces, cells)
  • Documentary and video as the primary content medium
  • Real scientists with neurodivergent profiles featured throughout
  • Science journal: child's record of discoveries in any format
🌍
Humanities
Ages 7–16 · History, Geography, Citizenship

Chronically taught in ways that disadvantage neurodivergent learners — essays, abstract timelines, large volumes of text. Bloom reimagines them through story, character, and place.

  • History through first-person narrative and "you are there" scenarios
  • Geography through maps, visuals, and real-place exploration
  • Timelines as visual artefacts, never written text sequences
  • Character studies: who were these people, what did they feel?
  • Local world as the entry point for global understanding
  • Neurodivergent historical figures studied and celebrated
🎨
Creative Arts
Ages 5–16 · Art, Music, Drama, Making

Not enrichment — the primary vehicle for many neurodivergent children to develop executive function, emotional regulation, and self-expression. Core curriculum at Bloom, not optional.

  • Art as communication for pre-verbal or low-verbal learners
  • Music for phonological awareness and emotional regulation
  • Drama for social understanding and perspective-taking
  • Making (STEM craft) for spatial reasoning and persistence
  • Creative work explicitly connected to all other subjects
  • Process always celebrated over product — always
🧠
Self-Understanding
Ages 6–16 · Bloom-exclusive subject

A Bloom-original subject existing in no national curriculum — and possibly the most important one. Children learn about their own minds: how they think, why they feel things, what neurodivergence means.

  • Age-appropriate neuroscience: why brains differ
  • "My brain is different, not broken" — the core narrative thread
  • Emotional vocabulary building and regulation strategy toolkit
  • Identifying personal strengths and challenges without shame
  • Self-advocacy skills: how to ask for what you need, clearly
  • Stories of neurodivergent people who shaped the world
Early Years bridge (0–6): Self-Understanding content is designed with the 0–6 to 6+ transition explicitly in mind. The Early Years companion introduces emotional vocabulary, simple regulation strategies, and the concept of "different thinkers" through play and story — preparing children for this subject before they formally begin it. The transition at age 6 should feel like continuing something familiar, not starting something new.
🌱
Early Years Preparation
Ages 0–6 · Parent-facing · Bloom Early Years companion

Not a taught subject in the traditional sense — a parent guidance and preparation framework for families with neurodivergent children aged 0–6. Supports the transition into formal learning by establishing the foundations Bloom builds on.

  • Emotional vocabulary introduced through illustrated animal characters — building the language Bloom's check-in system uses from the earliest age
  • Play-based number sense and early literacy activities — informal, joyful, no pressure
  • Sensory exploration activities that build self-awareness and regulation vocabulary
  • Parent guidance on supporting neurodivergent development through routine, predictability, and strength-based play
  • School readiness toolkit — not about performing readiness, but about the child arriving knowing they belong
  • Transition documentation support — helping parents communicate their child's profile to Reception teachers
Design principle for transition: When a child moves from the Early Years companion into Bloom's main learning platform at age 6, nothing should feel unfamiliar. The same illustrated animals. The same check-in ritual. The same warm tutor character. The transition should feel like walking into a room you already know — just with more in it.

Section 6

The adaptation engine

Every 30 seconds, Bloom re-evaluates whether the current content, pacing, and approach is optimal for this child at this exact moment. This is not static personalisation — it is continuous adaptation with a real decision tree behind every choice.

The 30-second loop — runs continuously throughout every session
👁️
Observe
Response time vs baseline. Error pattern. Engagement signals. Language affect. Time since last break. Session duration. Collected passively — the child is never interrupted or prompted.
🧩
Infer
Current regulation score. Cognitive load estimate. Frustration trajectory. Mastery confidence delta. Motivation level. Fatigue index. Feature extraction completes in under 200ms.
⚖️
Decide
Continue current path · reduce difficulty · switch modality · offer break · change subject · or end session with dignity. Decision made using the full child model as context.
🔄
Act & learn
Adaptation delivered seamlessly — the child never sees a loading state or explicit switch. Outcome of each adaptation logged and fed back to improve future decisions.
invisible to child
⟐
Regulation score check — runs every 30 seconds, every session
The single most important signal. Everything else is secondary if this is low.
Score <40 → dysregulation risk: offer break, switch calming activity, notify parent if sustained Score 40–60 → reduce demands, familiar content, shorter chunks, more encouragement Score 60–80 → standard pathway, check mastery state, select optimal next concept Score >80 → introduce stretch, creative extension, new concept if mastery path is ready
Adaptation actionTriggerSpeedChild experienceParent visible?
Difficulty reduction 3 consecutive errors <1s Seamless — next item is simpler, no comment made to child No · silent
Modality switch Low engagement + 2 min elapsed <2s "Want to try a different way to look at this?" No · logged
Break offer Regulation score <50 <1s Gentle: "How about a quick break?" No · logged
Subject change Frustration signals on specific topic <5s "Let's come back to this later — want to try something else?" Yes · digest
Session end recommendation Sustained dysregulation >5 min <10s Warm close: "You've done something really hard today. That takes real courage." Yes · with guide
Safeguarding escalation Crisis signal detected Immediate Warm redirect to safe content — human review triggered in parallel Yes · urgent

Section 7

Safeguarding AI — full specification

Neurodivergent children are disproportionately vulnerable to abuse, exploitation, and mental health crises. Our safeguarding system is the most important technical system in Bloom — and the one we are least willing to compromise on for any reason.

🔴

Tier 1 — Immediate Crisis

Suicidal ideation, self-harm statements, acute abuse disclosure, immediate danger language. Any match triggers the most urgent response path without exception.

  • Session pauses — child receives warm, calm message immediately
  • Safeguarding lead alerted within 5 minutes
  • Parent contacted within 1 hour
  • Statutory referral assessed within 4 hours
Response: <5 min
🟠

Tier 2 — High Concern

Persistent distress language, emotional abuse indicators, neglect signals, repeated disclosures, escalating anxiety patterns across multiple sessions over time.

  • Human review triggered within 4 hours
  • Parent welfare check initiated by team
  • Specialist team review activated
  • Session continues with elevated monitoring active
Response: <4hr
🔵

Tier 3 — Monitor & Support

Persistent low mood, school anxiety beyond expected range, social isolation indicators, language suggesting peer difficulties or ongoing bullying.

  • Human review within 24 hours
  • Parent digest includes a concern note
  • Wellbeing resources offered warmly to child
  • Pattern tracked longitudinally across all sessions
Response: <24hr
Detection approach: Signals detected through three parallel methods: keyword matching (100+ patterns, typo-tolerant, bypassing-resistant), semantic LLM contextual analysis that understands metaphor and indirect disclosure, and longitudinal pattern analysis that detects gradual change across sessions no single message would flag. All three are necessary — vulnerable children rarely disclose directly or clearly.
Non-negotiable rule: The Safeguarding AI cannot be disabled, downgraded, or bypassed by any user, administrator, or system update. It operates on every message, every session, with no exceptions. False positives are reviewed and welcomed. False negatives are treated as critical system failures requiring immediate model review and full retrospective audit.

Section 8

Technology stack

Chosen for reliability, privacy compliance, and the ability to keep child data sovereign. No vendor lock-in on critical paths. Open standards wherever possible. Every technology choice has a child safety rationale behind it.

🤖

AI & Models

Self-hosted, auditable, privacy-first
  • LLM: fine-tuned open-weight model (Llama-class), self-hosted. Child data never leaves our infrastructure under any circumstances.
  • Emotion model: LSTM trained on proprietary annotated neurodivergent session dataset. Bloom expects a specialist model to outperform general-purpose ones here; to be tested.
  • Safeguarding: custom rule engine + LLM semantic layer + human review queue. No third-party content moderation API used for child data.
  • NLP pipeline: fine-tuned on neurodivergent language patterns — critical for accurate affect detection across communication styles.
🗄️

Data & Storage

EU-region only · encrypted · GDPR-compliant
  • Knowledge graph: Neo4j with custom curriculum ontology — graph structure natively models prerequisite relationships across 8,000 concept nodes.
  • Time-series: TimescaleDB (Postgres extension) for session signals, mastery history, and emotional state data over time.
  • Content: CDN + offline-first PWA (service worker) — low-bandwidth families and unreliable connections fully and equally supported.
  • Analytics: Plausible (privacy-first) — no Google Analytics, no individual tracking, no cookies used for product analytics data.
🔐

Security & Auth

No social login · no third-party identity
  • Auth: Passkeys + MFA. No social login for parent accounts. Social login creates data sharing with social platforms — unacceptable for this user group.
  • Encryption: at rest and in transit. Child data encrypted with keys managed separately from data storage infrastructure.
  • PII removal: automated stripping before any model training. Differential privacy for all aggregate analytics outputs.
  • Audit trail: every AI decision logged permanently. Regulatorily auditable. Parents can request full session logs at any time, no questions asked.
🌍

Accessibility & Reach

WCAG 2.2 AA standard, AAA where possible · offline-first
  • Offline-first PWA: full functionality without internet. Auto-syncs on connection restore. Critical for low-income families with unreliable broadband access.
  • Low-bandwidth mode: all content optimised for 3G. Video compressed, images lazy-loaded, audio prioritised over video in constrained conditions.
  • Switch access + eye tracking: Tobii integration. Complete keyboard navigation throughout. Voice input available on all text fields in the platform.
  • 12 languages at launch — culturally reviewed by native speakers, not just machine-translated from English source text.
Architectural rule: No child learning data is ever processed by a third-party AI API (OpenAI, Google, Anthropic, or any other). All inference that touches child data runs on self-hosted infrastructure. This is a non-negotiable architectural constraint that takes precedence over cost, convenience, or model quality advantages. We will build or fine-tune our own models rather than compromise on this principle.

Section 9 — Data Sovereignty & Containment

What stays inside Bloom — and what doesn't, yet

Child data stays inside Bloom from the first beta session. What changes across the phases is how capable the models become — not where the data goes. This section documents what is self-contained at each phase and the consent obligations that remain.

The core principle: Child learning data sovereignty is non-negotiable from day one. What is phased is model sophistication, not data protection. What is never phased, never deferred, and never compromised is parental consent — parents must know precisely what happens to their child's data at every stage before they agree to anything.
PHASE 1 · MVP BETA
Fully contained
  • Child model — Bloom infrastructure ✓
  • Session signals — Bloom infrastructure ✓
  • Knowledge graph — Bloom infrastructure ✓
  • Safeguarding system — local, no external API ✓
  • Emotional check-in — rules-based, self-contained ✓
  • Tutor AI — open-weight model, self-hosted on Bloom's UK/EU infrastructure ✓
No child data leaves Bloom. The tutor uses a base open-weight model, tested against the 50 child scenarios before any child uses it. GPU hosting is around £1.8k a month during the beta.
PHASE 2 · SEED
Fully contained, learning
  • All Phase 1 self-contained elements ✓
  • LSTM emotion model — Bloom-trained, self-hosted ✓
  • Knowledge graph with IRT scoring — self-hosted ✓
  • Tutor AI — self-hosted, improved with consented session data ✓
  • ML pipeline — Bloom infrastructure ✓
  • Full parent and EHCP data — Bloom only ✓
Models improve, data stays put — the ML Engineer's Phase 2 mandate is the emotion model, the knowledge graph and preparing Bloom's own fine-tuned tutor model.
PHASE 3 · SERIES A
Fully self-contained
  • Bloom fine-tuned open-weight LLM, self-hosted ✓
  • All child interaction data stays in Bloom ✓
  • No third-party AI API for any child data ✓
  • Full longitudinal dataset — Bloom infrastructure ✓
  • RCT clinical dataset — encrypted, Bloom-only ✓
  • Lower cost per session as smaller tuned models replace the base model ✓
Full sovereignty, with Bloom's own model. No child data leaves Bloom's environment for any reason — as at every phase. This is the architecture that enables NHS commissioning and school data agreements.

What never leaves Bloom — at any phase

Child identity & profile
Name, age, diagnostic information, EHCP content, parental notes. This data is stored encrypted in Bloom's infrastructure and is never shared with any third party, at any phase, under any circumstances.
Safeguarding flags and disclosures
Every safeguarding concern, flag, or disclosure is processed entirely within Bloom's own infrastructure. The safeguarding detection system never uses a third-party API. Statutory referral content goes to relevant authorities only — never to commercial third parties.
Session signals and the child model
Keystroke patterns, attention scores, regulation states, mastery data, emotional baseline — all stored in Bloom's encrypted database. The child model that accumulates across hundreds of sessions never leaves Bloom's environment.
Parent and EHCP data
All parent account data, EHCP documentation, weekly digests, and parent hub activity stays within Bloom's infrastructure. Parents can request complete deletion at any time. Bloom's analytics provider (Plausible) is privacy-first and carries no individual user tracking.

How the Phase 1 tutor handles conversations — and the consent obligation

Tutor AI conversation content
In Phase 1, the conversational tutor runs on an open-weight model hosted on Bloom's own UK/EU infrastructure. The message a child sends, the conversation context injected into the prompt, and the model's response never leave Bloom's environment. No OpenAI, Anthropic, Google or other third-party AI service processes child conversations.
What the model sees: The system prompt includes the child model fields relevant to that session (attention window, regulation state, modality preferences, current topic). It does not include name, diagnosis, EHCP content, or any directly identifying information — the model works from a session ID, not a child's identity, even though it runs inside Bloom.
The consent obligation this creates
Parental consent is a first-class design deliverable — not a legal checkbox buried in terms and conditions. The consent journey must clearly explain: what conversation and session data is stored, where it is hosted, how long it is kept, who at Bloom can see it, and how it is used to improve the child's experience. Parents must actively consent to this, separately from general terms, and can withdraw consent and request deletion at any time.

What legitimately stays external — at all phases

Payment processing
Stripe or equivalent. Financial data only — no child data involved. Standard and appropriate for any subscription product.
Transactional email
Parent weekly digests and account notifications via a transactional email provider. Parent email address and digest content — no child session data included in email payloads.
CDN and infrastructure
Static assets (images, fonts, cached content) served via CDN for performance. No personal or session data transmitted through CDN infrastructure.
The architectural rule — held from day one: "No child learning data is ever processed by a third-party AI API" applies from the first beta session, not just as a destination. The trade-off is honest: a self-hosted open-weight model costs more per child at small scale, and its quality must be proven against the tutor persona scenarios before any child uses it.