Product Designer

Good products come from clarity in the system and the interface.
I help teams build that clarity across users, product, and engineering.

Working across user research, systems thinking, and iterative team work, I help turn ambiguous problems into clear, usable products. I've done this across domains like freight logistics, healthcare, and secure data-sharing.

Sales Orders list view — Mosaic freight logistics platform
Orchid illustration
Mosaic object model redesign diagram — annotated wireframe view
01 — Mosaic · 2026

Listening to distributors revealed a broken product model (and how we fixed it!)

How redesigning a single order object unblocked a workflow that was stalling logistics teams for weeks — and how separating commercial intent from freight execution gave operations and sales teams a system that finally matched how they actually work.

Revoke access confirmation modal — Inrupt access management UI
02 — Inrupt · 2024

Revoking access by design

The "revoke access" flow had never been defined. I designed it end-to-end — navigating two conflicting user groups, developer-tinted language that confused real users, and a technical foundation that wasn't built with consumers in mind. It shipped as open source and was adopted by enterprise clients.

Sensor hardware onboarding — 11-step flow diagram
03 — How I Think

Designing onboarding workflow for healthcare hardware

How I think before anything is built — a fully annotated onboarding flow for a wall-mounted radar wellness device, designed for adult children installing on behalf of an aging parent.


Good design depends on solving the right problem, not just executing well on the solution.

01

Understanding before action

Before any UI decision, I want to understand the system, the people inside it, and the workflow lifecycle end to end. The right question saves more time than the right screen. I treat research as something that runs through a project — not just something that kicks it off.

02

Relationships are a design input

The best outcomes I've been part of came from trust built early — with users who felt heard in research, engineers who were brought in before anything was decided, and product partners who knew I was genuinely invested in the problem.

03

AI assists execution. Judgment drives everything else

I use AI to move faster — visualizing flows early, pressure-testing ideas before they're precious. But the questions that matter most (why this, for whom, does this UI clarify or obscure) require human thought.

Transport Management System · Information Architecture · UX Design · UI Design · User Research

Listening to distributors revealed a broken product model (and how we fixed it!)

At Mosaic, our operations teams were managing growing backlogs of freight orders that appeared “stuck” in the system for weeks. Not because of process failure, but because the product forced two fundamentally different workflows into a single order object. That mismatch between system design and real-world operations was the root problem.

RoleLead Designer
Duration3 months
Year2026
CompanyMosaic

Redesigned a freight logistics platform's core order model to align with how customers actually manage sales orders and shipments.

Problem: The platform's core order model didn't match how customers managed freight operations.

My role: As the sole designer, I redefined the product design from a single order lifecycle to separate Sales Order and Shipment workflows.

Impact: Our product matched our distributor clients' mental models; our internal operations team was relieved of cluttered orders' lists.

One object trying to represent two different workflows

Our platform treated a freight order as a single object from creation through execution.

But in practice, customers did not think this way.

Through interviews and on-site workflow observation with logistics coordinators and mid-market distributors, a clear split emerged:

  • a commercial intent stage (should we ship this?)
  • a logistics execution stage (let's move this freight)

Most customers already modeled this separation in their ERP systems (e.g. sales orders vs shipments), but our product collapsed both into one structure.

This created friction in two ways:

  • operations teams couldn't quickly distinguish actionable shipments from pending intent
  • "created" orders accumulated and became operational noise rather than actionable work

Users had already solved this — our product hadn't caught up

A key moment came from observing a solar panel distributor working in Acumatica. Their workflow explicitly separated sales orders from shipments as distinct objects with distinct lifecycles.

That wasn't a feature request. It was evidence that our system model was misaligned with how users already operated.

The design constraint became clear:

We needed to separate intent from execution at the product model level, not just the UI.

Redesigning the system model, not just the interface

01 /

Grounded the work in real operational workflows

I conducted interviews and on-site observations with both logistics coordinators and their customers to map how orders actually progressed through real freight operations. This informed both product and data model decisions.

02 /

Worked with PM to redefine the product structure

I partnered closely with the PM to pressure-test a new model where sales orders and shipments became separate but linked objects, replacing the existing single-order structure. We iterated on early flows in Figma before committing engineering effort, allowing us to validate the model before implementation.

Workflow diagram showing before and after the two-object model
03 /

Designed workflows across two connected objects

I redesigned core interfaces to make the relationship between sales intent and shipment execution explicit, while ensuring operations teams could still move quickly through high-volume work.

The challenge was balancing:

  • clarity of system structure
  • speed of operational workflows
  • minimal cognitive overhead in daily use
Object model redesign annotation: from one Sales Order object to two — Sales Order and Shipment
04 /

Partnered with engineering to ensure feasibility

I worked directly with engineering to ensure the proposed object split aligned with backend data structures and could be implemented without breaking existing workflows.

A clearer operational model for freight execution

The redesign introduced a clearer separation between sales intent and shipment execution, reducing ambiguity in operational workflows and making it easier for teams to identify actionable work vs pending requests.

Operations teams were able to:

  • distinguish actionable shipments more clearly
  • reduce time spent interpreting "stuck" orders
  • work more efficiently across high-volume queues

Giselle Wenban

Currently

Product Designer — Mosaic

2025 – 2026

The sole product designer at a seed round freight logistics startup, I focus on turning complex, data-heavy workflows (orders, quoting, tracking, invoicing) into clear, structured product experiences that logistics teams can actually use day-to-day. I work alongside product, engineering, and our users: logistics coordinators, shippers, and operations teams.

Previously

Product Designer — Inrupt

2022 – 2025

Inrupt is a B2B2C tech company co-founded by Sir Tim Berners-Lee, focused on bringing users' agency over their data through decentralized technology. I designed UX/UI for internal products, spearheaded new features, provided workshop facilitation and design services to external clients.

Designer & Researcher — OpenLab, University Health Network

2021 – 2022

OpenLab is a healthcare innovation lab at UHN. I applied design-thinking methodologies to create digital and analog solutions alongside vulnerable populations in a complex healthcare system.

Teaching Assistant — Faculty of Information, University of Toronto

2021 – 2022

Led tutorials and graded assignments for two graduate-level courses: User-Centred Information Systems Development and User Interface Design.

Education

Master of Information Studies — User Experience Design

Faculty of Information, University of Toronto

Bachelor of Arts with High Distinction — History & English

University of Toronto

Outside of work
  • Outback camping trips (favourite so far: Quetico)
  • Baking — current fixation: pavlova
  • Reading fiction — just finished The Door by Magda Szabó
  • Supporting the Toronto Raptors
  • A walk in the neighbourhood at dusk

Access Management · UX Design · UI Design · User Research · Design Systems

Revoking access by design

I designed how end users and developers handle the “revoke access” part of an access management system. From undefined problem to shipped, open-source reference implementation.

RoleLead Designer
Duration4 months
Year2024
CompanyInrupt

Defining access revocation across two audiences

I led the design of the revoke-access experience for a decentralized identity platform. On the surface, it looked like an access management problem. In practice, it was a problem of trust, control, and shared understanding.

While grant-access flows were relatively well understood, revocation lacked both a clear end-user experience and a reference implementation for developers. My role was to define this missing interaction layer and translate it into reusable patterns that could work for two very different audiences:

  • End users managing access to their personal data
  • Developers integrating access controls into their applications

The challenge was not simply designing an interface. It was helping two groups understand the same system in ways that made sense for their needs.

Diagram showing the three-step access lifecycle: Request, Grant, Revoke
Inrupt access management interface — Government entity active access list with revoke controls

Three perspectives on the same system

Revocation sat at the intersection of three competing needs:

  • A flexible, developer-first architecture built around permissions, agents, and resources
  • Developers who needed predictable implementation patterns
  • End users who needed simple, trustworthy control over sensitive data

No shared UX model existed across these layers.

As a result, technical concepts leaked into user-facing experiences, making it harder for people to understand what they were controlling and whether they could trust the system to do what they expected.

Because access management was central to Inrupt's value proposition, this wasn't just a usability issue. Users are only willing to share data if they believe they can meaningfully control it.

Early design showing developer terminology leaking into end-user interface

Understanding the system before designing the interface

Before exploring interface solutions, I worked with product and engineering partners to map how access behaved across the system, including single-app revocation, bulk revocation, and edge cases such as expired grants.

This surfaced the central challenge:

The system treated access as a technical relationship. Users experienced it as control over their personal data.

What developers understood as permissions, resources, and agents, users understood as apps, files, and information that belonged to them.

That mismatch became the primary design constraint for the project.

System flow and user journey maps showing two perspectives on access management

Making control visible

Users weren't just struggling to find the revoke action. They were struggling to understand whether they actually had control.

Early concepts placed revocation behind secondary settings and management interfaces. During testing, users either missed these controls entirely or were uncertain whether revocation had actually occurred.

I elevated Revoke Access to a primary action within the access-detail view and introduced a Revoke All Access path for broader account management.

This shifted revocation from a hidden system capability into a visible expression of user control, reinforcing one of the platform's core promises.

Six-step wireframe flow showing the revocation user journey

Creating shared language

Testing revealed that users and developers were operating with completely different mental models of the same system.

Terms such as "agents" and "resources" made sense within the underlying architecture but created confusion for end users trying to understand who could access their information.

I restructured the experience around language that reflected how people naturally thought about the system:

  • Agents → Apps
  • Resources → My Data
  • Technical identifiers → Human-readable file names

The challenge wasn't simplifying the system. It was creating a shared understanding of it.

By aligning the interface with users' mental models, people could more easily understand what was happening and make decisions with confidence.

Designing for trust

Revocation is a trust moment, not just a transaction.

For users sharing sensitive information, uncertainty can undermine confidence in the entire system. I designed the success state to clearly communicate what had changed and reinforce a sense of certainty:

"Access successfully revoked. Government no longer has access to Passport.jpeg."

This wasn't simply confirmation that an action had completed. It was reassurance that the user remained in control.

Confirmation modal: Revoke Government access to Passport.jpeg

Designing for adoption

Because this work shipped as a reference implementation, success depended on developer adoption as much as user usability.

I partnered closely with engineers to define reusable components, align interaction patterns with API constraints, and ensure the implementation remained flexible across different client contexts.

The result was a reusable foundation that developers could adopt and customize while preserving the underlying user experience principles.

Rather than a one-off solution, the work became a bridge between UX intent and implementation reality.

Component library and design tokens built for the reference implementation

What testing revealed

Usability testing surfaced two recurring issues.

Discoverability and confidence

Users struggled to locate revocation controls or were unsure whether revocation had successfully occurred.

This led to clearer action placement, stronger hierarchy, and more explicit feedback throughout the experience.

Mental model mismatch

Users expected concepts like apps and files, while the interface reflected technical concepts from the underlying architecture.

This led to a broader language redesign across access-management surfaces.

These findings were not isolated usability issues. They revealed a deeper gap between how the system was built and how people understood it.

A reusable pattern for user control

The work established the first reusable revocation pattern for the platform and shipped as part of an open-source reference implementation used by client developers.

Beyond the interface itself, it helped define how decentralized access control should be communicated to end users: through visible controls, familiar language, and explicit feedback.

More broadly, the project clarified a principle that influenced future work:

User control only works when people can understand what they are controlling.

Final polished UI showing the Government entity access management screen

Translating between two worlds

The hardest part of this project was not designing the interface. It was reconciling the needs of a flexible developer platform with users' expectations of simplicity and control.

Developers needed precision and flexibility. Users needed clarity and confidence. Neither perspective was wrong, but they led to very different expectations of the same system.

Much of the design work involved creating a bridge between those perspectives and helping each group succeed without compromising the needs of the other.

The most valuable design decisions happened not at the UI layer, but in the translation layer between people and systems.

Healthcare · Product Design · Onboarding · UX Design

Designing onboarding for healthcare hardware

A fully annotated onboarding flow for a wall-mounted radar wellness device, designed for adult children installing on behalf of an aging parent.

Sensor Hardware Onboarding

Onboarding and setup experience for a wall-mounted radar wellness monitoring device. Primary user: adult children (40-60) installing on behalf of an aging parent. Click any step to see assumptions, open questions, and design rationale.

Single-device assumption Install target: under 10 min Primary user: installer, not parent
Key
Main step
Milestone
Error state
Decision
Assumption
Open question
Rationale
Account setup
Milestone: profile + needs captured, briefing done
Device count
Room selection
Bedroom
Bathroom
branches merge
Placement
Milestone: room chosen, placement confirmed
Mounting
Out of range
retry
Pass
continue
Milestone: device mounted, tilt confirmed
Connectivity
Weak / fail
save + resume later
Connected
continue
Milestone: device connected to Wi-Fi
Calibration
Below threshold
retry zone
Pass
continue
Milestone: calibration confirmed, device live
Handoff
Select a step
Click any node in the flow to see its assumptions, open questions, and rationale.
Download app + create account
Entry point for the installer
Assumptions
Assumption

The adult child doing the installation is the primary account holder. The parent does not have an app login at this stage.

Assumption

Account creation is straightforward: email or social sign-in only, with no complex verification required to get started.

Open questions
Open question

Should the parent eventually have a read-only view of the app? Even a simple "here is what is being monitored" screen could make a meaningful difference to how they experience the product.

Open question

How many family members can be linked to a single device? If siblings share caregiving responsibilities, multi-account support would affect the data model and notification structure.

Home + resident profile setup
Address and household context, with resident information nested within
Rationale
Rationale

Based on the Pontosense v1 demo, resident profile setup (risk level, mobility aids, pets, health memos) sits within the home profile rather than as a separate sequential step. This structure makes sense: the home establishes the physical context first, and the resident details are added as part of that same setup rather than as a distinct phase. It also means the home can support multiple residents or devices over time without duplicating address information.

Assumptions
Assumption

Home profile fields include address and household-level details. Resident fields (based on the v1 demo) include risk level, mobility aids, pets, and health memos. Additional fields like name, date of birth, or emergency contact may also be present but were not confirmed in the demo viewed.

Assumption

Health memos and risk level are optional fields, not required to proceed. Forcing detailed health information at this stage could create friction for installers who do not have that information to hand, or who feel uncomfortable entering it on the parent's behalf.

Open questions
Open question

Based on the v1 demo, it appears a single account can support multiple homes. This is worth confirming, and if so, it is worth understanding how the app handles switching between homes and whether device setup is scoped clearly to a specific home throughout the flow.

Open question

Is address used for anything functional in the product (emergency services integration, regional settings) or is it purely for identification purposes?

Open question

How does risk level get determined? Is it self-reported by the installer, selected from predefined options, or assessed through a short questionnaire? The answer affects how much guidance the app needs to provide at this step.

Open question

Does any of the resident profile information influence the onboarding flow itself (for example, does a high risk level affect the room recommendation), or does it only affect ongoing alert thresholds after setup?

Open question

Where does the parent's consent live? Is it captured in the app, or is it assumed to happen in conversation between family members? This is a product ethics question as much as a UX one.

Open question

Should the app prompt the installer to confirm they have spoken with the parent before continuing? A simple checkbox ("I've discussed this with [name]") would signal that Pontosense takes this responsibility seriously.

Needs-framing prompt
A short set of questions to surface the parent's situation before any installation decisions are made
Why this step exists
Room selection is a consequential decision that the installer cannot make well without knowing the parent's actual circumstances. Rather than nudging them toward a generic default, this step surfaces the right questions while the installer is still in "thinking about my parent" mode, before they pick up any tools.
Rationale
Rationale

A 78-year-old who has fallen twice getting up in the night has completely different monitoring needs from someone whose main concern is bathroom safety during the day. The app cannot know that without asking. Placing this prompt right after the parent profile is created means the installer is already thinking about their parent as a person with specific circumstances, which is exactly the right headspace for this conversation.

Rationale

If the parent is present during installation (which they sometimes will be), this is also a natural moment to include them. The brief focuses on the adult child as the primary user but does not say the parent is absent. A prompt that explicitly invites their input here is consistent with the parent awareness step at the end of the flow, and makes the overall experience feel more like a family decision rather than something done to the parent.

Assumptions
Assumption

The prompt asks two or three plain-language questions: where does the parent spend most time alone, has there been a fall or a concern about a specific room, and what is the main thing the family wants to monitor. The answers do not need to feed into an algorithm. Even just prompting the conversation changes the quality of the room decision that follows.

Assumption

This step adds no more than 60 seconds to the onboarding and sits entirely before any physical steps, so it does not affect the 10-minute installation time target.

Open questions
Open question

Should the responses be saved and surfaced back to the installer later in the flow, for example during zone definition, as a reminder of what they said they were most concerned about? That would make this step feel purposeful rather than a prompt that disappears once you tap next.

Open question

Should this step explicitly prompt the installer to have the conversation with the parent before continuing, or is it designed to be completed whether or not the parent is present?

Radar intro + privacy briefing
What the device senses, and what it does not
The most important trust-building moment in the flow
Installers have no prior mental model of radar sensing. Getting this step right directly affects placement quality and long-term confidence in the alerts the system produces.
Rationale
Rationale

Explaining what radar cannot detect (faces, voices, identity) is just as important as what it can. Non-technical users may worry about surveillance, and this is the right moment to reframe the device as anonymous movement sensing rather than anything more intrusive.

Assumptions
Assumption

The briefing uses plain language and a simple visual. No technical diagrams or radar terminology. The goal is a clear mental model, not engineering literacy.

Assumption

A shareable summary is available after this step, something the installer can show or send to the parent to help them understand what has been set up in their home.

Open questions
Open question

Does Pontosense have a preferred way of explaining radar to non-technical users? The language used here will shape how the parent understands the device for its entire lifespan.

Open question

Is there a risk that explaining the device's limitations makes it feel less capable than it is? It would be useful to know whether there is any user research on how to frame this well.

Pre-install checklist
Items to have ready before physical mounting begins
Rationale
Rationale

Surfacing this before any physical steps prevents mid-install abandonment. Someone who discovers they need a tape measure after they have already started drilling is much more likely to stop and not come back.

Rationale

This step is placed after the radar briefing rather than at app open because the checklist items are more motivating once the user understands why they matter. A tape measure makes more sense after learning about the 4 m bedroom placement rule.

Assumptions
Assumption

Checklist items include: a tape measure, the Wi-Fi network name and password, a pencil for marking the wall, wall anchors and screws, and optionally a second person to help hold the device during installation.

Open questions
Open question

Are wall anchors and screws included in the box, or does the user need to source them? This affects both what goes on the checklist and whether the 10-minute install estimate is realistic.

Device count decision point
One device or multiple per household?
Key ambiguity in the brief
The brief refers to "a wall-mounted radar sensing device" (singular), but never explicitly says whether a household receives one device or multiple. This has a significant impact on how room selection is designed.
Assumptions
Assumption

This flow is designed around a single device per household. Room selection is therefore a consequential, one-time decision rather than a repeatable step.

Open questions
Open question

If multiple devices are supported, is there an "add another device" loop after setup is complete? Would the second device require full recalibration, or could it inherit room data from the first?

Open question

Is this a one device per home product, or one per room? This is a pricing and product question with direct consequences for how room selection is framed in the onboarding.

Room selection
Bedroom vs. bathroom, arrived at through the needs-framing conversation
A facilitated decision, not a recommendation
By the time the installer reaches this step, they have already been through the needs-framing prompt. The app does not tell them which room to choose. It presents what each room is better suited for, and they make the call based on what they know about their parent.
Rationale
Rationale

A firm default recommendation (like "most families start with the bedroom") assumes the family has not already had the conversation about where the real risk is. It could easily nudge the installer toward the wrong room. The needs-framing step earlier in the flow is designed to surface exactly this information, so by the time the installer gets here they are equipped to make the right choice for their specific situation rather than following a generic default.

Rationale

The app's role here is to present the considerations clearly: what each room enables in terms of monitoring, what the placement constraints are, and what the implications are if the decision needs to change later. The installer makes the final call.

Assumptions
Assumption

Outlet access may constrain which room is actually viable. The app should surface this consideration before the installer commits, not after.

Open questions
Open question

Does Pontosense have a clinical or product perspective on which room is the higher priority for the most common use cases? That context should inform how the considerations are framed on this screen, even if the app stops short of making a recommendation.

Open question

Is this choice reversible without losing calibration data? If moving the device means starting over, that needs to be communicated clearly at this step so the installer understands the stakes before they decide.

Room type branch
Routes to bedroom-specific or bathroom-specific placement guidance
Rationale
Rationale

Showing only the rules that apply to the chosen room keeps the experience focused. A bedroom installer does not need the shower warning, and a bathroom installer does not need the 4 m bed distance rule. Room-gated instructions feel tailored rather than generic, which matters when you are trying to build trust with a non-technical user.

Bedroom placement rules
Corner, wall-mounted, within 4 m of where the person lies
Assumptions
Assumption

The 4 m check requires a tape measure, which the user has because of the pre-install checklist. The app illustrates this with a diagram rather than just stating a number.

Open questions
Open question

Is the 4 m measured from the device to the bed frame, or to the centre of where the person actually sleeps? The app should be specific, since this directly affects calibration accuracy.

Open question

What if the ideal corner does not have an outlet nearby? Does the app offer a path forward (a different corner, guidance on extension cord use) or does it just block progress?

Bathroom placement rules
Corner, wall-mounted, never inside a shower
Rationale
Rationale

The shower exclusion is a hard constraint, not a preference. It should be shown as a clear illustrated rule with a "do not install here" visual, not buried in a list of tips where it could be missed.

Open questions
Open question

Are there moisture or IP rating considerations to communicate? Does the device need to maintain a minimum distance from any water source beyond the shower enclosure?

Open question

For bathroom installs, what are the "key zones" the device actually monitors? Toilet proximity, shower entry, a general fall detection area? This needs product definition before zone calibration can be designed.

Guided placement view
Visual confirmation of corner positioning and outlet access
Assumptions
Assumption

This step uses a static illustrated diagram with a short checklist: outlet within reach, unobstructed field of view, and correct distance from bed (bedroom) or clear of shower (bathroom). No AR overlay.

Open questions
Open question

Is an AR camera overlay worth exploring for this user group, or would a well-designed static diagram be more reliable and less likely to create confusion for someone who is not technically confident?

Open question

Should the app show live Wi-Fi signal strength at this step, before the user commits to a location? If the signal is too weak at the chosen location, it is far better to surface that now than after the device is already mounted.

Physical mounting
Attaching the device to the wall and powering it on
Assumptions
Assumption

The brief confirms the device is wall-mounted but does not specify how. I am assuming the installation involves marking the wall, drilling, and attaching some kind of bracket before the device clips or screws into place. The actual mechanism needs to be confirmed, as it directly affects how many sub-steps this phase contains and how the instructions should be illustrated.

Assumption

Step-by-step illustrated instructions are shown here, not a summary screen. Physical installation is the highest-risk moment for abandonment in hardware onboarding, so each sub-step gets its own screen.

Assumption

The 10-minute installation target covers this physical phase only, not the full onboarding journey including account setup, briefing, and calibration.

Open questions
Open question

What does mounting actually involve? Does it require drilling, or is there an adhesive or no-drill option? The answer significantly affects who can realistically install the device and what tools they need.

Open question

Is there a printed quick-start card in the box, or is the app the only instruction source? A fallback matters for users who lose phone signal partway through.

Open question

Would a time estimate at this point ("about 5 minutes left") help reduce drop-off? Progress indicators can make a meaningful difference in multi-step flows where users cannot see the end.

Tilt angle check
Hard threshold: the device will not operate outside the valid range
Rationale
Rationale

I have placed tilt validation before Wi-Fi pairing because tilt is a hard block: if the angle is wrong, the device will not work regardless of whether Wi-Fi succeeds. Catching this first means the user only goes through the pairing process (which tends to be the most anxiety-inducing step for non-technical users) once the device is confirmed to be physically set up correctly. A tilt failure mid-pairing would feel like wasted effort and is a likely abandonment point.

Rationale

That said, this ordering assumes the device can communicate tilt data to the app via Bluetooth before Wi-Fi is established. If the hardware does not support that (for example, if tilt data is only readable over Wi-Fi), then the order would need to flip and Wi-Fi pairing would have to come first. This is a technical constraint that needs to be confirmed with the engineering team before the flow is finalized.

Open questions
Open question

Does the device communicate tilt data over Bluetooth before Wi-Fi is established, or does tilt data require a Wi-Fi connection to reach the app? The answer determines whether this ordering is even technically possible.

Open question

If Wi-Fi must come first for technical reasons, how do we handle the scenario where a user completes pairing only to then fail tilt validation? What does that recovery look like without it feeling like the earlier pairing effort was wasted?

Open question

Is tilt shown as a live reading, or just pass/fail? A live angle display would let the user make precise adjustments rather than guessing whether they have moved it enough.

Tilt error state
Mounting angle is outside the valid operating range
Rationale
Rationale

The error state needs a visual showing what a correct angle looks like next to an incorrect one. Text alone is not enough, since most users have no intuition for what "out of range" means in practice.

Assumptions
Assumption

The retry here is a short loop: adjust the bracket and recheck. If the bracket itself is the structural problem, the user should be offered a path to contact support rather than being asked to keep trying.

Wi-Fi pairing
Bluetooth handshake to establish the network connection
Assumptions
Assumption

Pairing uses Bluetooth to bootstrap the Wi-Fi connection so the user does not need to manually enter credentials on the device itself.

Open questions
Open question

Does the device support 5 GHz networks, or 2.4 GHz only? This is one of the most common failure points in hardware pairing and should be communicated clearly before the user attempts to connect.

Open question

How does the app handle mesh networks or homes with multiple SSIDs? Users who are not technically confident may not know which network to choose, or may accidentally select a guest network.

Open question

Is there a QR code or WPS pairing option for users who find manual network selection difficult?

Wi-Fi signal check
Hard threshold: the device will not operate below minimum signal strength
Rationale
Rationale

The brief specifically calls out Wi-Fi failure as a known abandonment point. The error state here needs to offer a genuine recovery path (tips, alternatives, a save option) rather than a dead end that leaves the user with a mounted device they cannot use.

Wi-Fi error state
Signal too weak or pairing failed
A pause state, not a failure state
The distinction matters. A failure state says: something went wrong, start again. A pause state says: something went wrong, your progress is safe, come back when you can. For this moment in the flow, a failure state is not just frustrating — it is genuinely unreasonable.
Rationale
Rationale

The device is already mounted at this point, potentially in a private room in someone else's home. The installer may be visiting for the day, may not live nearby, and may not be able to return the same week. Treating Wi-Fi failure as an expected scenario rather than an edge case changes everything about how this screen is designed: the error screen needs to feel like a safe stopping point, not a dead end, and the re-entry experience needs to automatically route a returning user back to the right place without them having to remember where they left off.

Rationale

This has implications beyond the UI. A pause state requires the backend to persist saved setup state across sessions, and the app to recognize a mid-setup user on re-launch and route them accordingly. These are product and engineering requirements that flow from this design decision, and they need to be flagged early.

Assumptions
Assumption

Recovery suggestions shown in this state: move the router closer, use a Wi-Fi extender, check that the correct network band is selected, and confirm the device is within range.

Open questions
Open question

How long does saved setup state persist? If the installer cannot return for two weeks, is their progress still there? And what happens if a firmware update ships in the meantime?

Open question

If the app had shown live signal strength during the placement step (before any mounting), this failure could often be prevented entirely. Is a proactive signal check at the placement step worth building into the flow?

Room boundary mapping
Define room walls and mark fixed obstacles
Assumptions
Assumption

This step uses a guided tap-to-define interface where the user draws walls and marks furniture on a schematic floor plan, rather than relying on automatic scanning. The 10-20 cm accuracy requirement makes precision input important.

Open questions
Open question

Does the app accept room dimension inputs, or does it rely entirely on the user drawing? If drawn, how does a finger tap on a small screen achieve the required accuracy?

Open question

Can the device contribute to its own room mapping through an initial radar sweep, or is all input manual at this stage?

Zone definition
Mark bed location and key activity zones to 10-20 cm accuracy
The highest-stakes step in the flow
Calibration accuracy directly affects the quality of alerts and wellness data the product produces. Errors here compound over time. This step deserves more design investment than its position in the flow might suggest, and should not be rushed to hit the installation time target.
Rationale
Rationale

The 10-minute installation budget applies to the physical mounting phase only. Calibration is a separate phase and should be given the time it needs. Framing it as "worth getting right" helps manage user impatience without understating the importance.

Assumptions
Assumption

The accuracy requirement is communicated in plain language ("mark the centre of where the person actually sleeps, not just the general area of the bed") rather than in centimetres, which is not meaningful to a non-technical user.

Open questions
Open question

Does the app give real-time feedback on zone accuracy as the user maps, or is accuracy only assessed after they submit? Live feedback would significantly improve the quality of what gets captured.

Open question

For bathroom installs, what exactly are the "key zones"? Toilet proximity, the shower threshold, a general fall detection perimeter? This needs product definition before the UX for this step can be finalized.

Calibration accuracy check
Validates that zone mapping meets the required threshold
A decision about what the product optimizes for
Treating calibration as a separate phase from the 10-minute install budget is a deliberate choice: the flow prioritizes quality of outcome over speed of setup. This is where that decision becomes visible.
Rationale
Rationale

A fast but inaccurate calibration produces a device that technically works but generates unreliable alerts. That erodes trust in the system over weeks and months in a way that is very hard to recover from. Getting someone to remount a device is a solvable problem. Getting them to trust alerts again after too many false ones is much harder. The flow therefore treats calibration as worth whatever time it takes, and the 10-minute installation budget is explicitly scoped to the physical mounting phase only.

Rationale

This is a values decision as much as a design one. It reflects a view that the product's long-term credibility depends on getting this right at setup, and that saving a few minutes here is not worth the downstream cost of a system the family stops trusting.

Open questions
Open question

How is accuracy scored? By the device, the app, or against a stored baseline? And who defines what counts as "good enough," given that different room sizes and layouts may require different thresholds?

Open question

Is the check instantaneous, or does it require a period of stillness (for example, 30 seconds)? This affects pacing and what the user needs to be told to expect at this point.

Calibration warning state
Zone mapping does not meet the accuracy threshold
Rationale
Rationale

The error state should pinpoint which zone is inaccurate, not just show a generic "try again" message. Targeted feedback means the user can fix the specific problem without redoing everything.

Rationale

Given how much calibration errors affect downstream accuracy, an "accept anyway" bypass should either not exist or require the user to explicitly acknowledge the consequences before proceeding.

Configure alerts
Notification thresholds and delivery preferences
Assumptions
Assumption

Alert defaults are pre-set by room type: bedroom installs default to sleep-focused thresholds, bathroom installs to movement and fall detection. Users can adjust these after setup.

Open questions
Open question

Are the defaults good enough that this step could be optional, with a "customize later" path for users who do not want to make these decisions at the end of a long installation? Forcing threshold decisions at this moment adds cognitive load when the user is likely already tired.

Open question

Who receives alerts? Only the installer, or all linked family members? If multiple contacts are supported, there needs to be a way to configure this without overwhelming everyone.

Parent awareness step
Ensuring the parent understands what has been installed and why
An in-flow step, not a follow-up
This step could have been an email, a push notification the next day, or left entirely to the family. The decision to include it here, immediately after the device goes live, is deliberate.
Rationale
Rationale

This is the only point in the journey where the installer is still in the app, still engaged, and still thinking about the setup. An async alternative relies on them following through after the fact, which most people will not do once they have left the parent's home and moved on with their day. Making it part of the flow means it happens while the motivation is still present.

Rationale

A parent having a monitoring device installed in their bedroom without being walked through what it does can easily feel like surveillance, even when the intent is care. Placing this step in the flow signals that Pontosense takes the parent's awareness seriously as a product value, not just a nice gesture. It also differentiates the product from monitoring tools that treat the person being monitored as secondary to the person doing the monitoring.

Assumptions
Assumption

The app provides a shareable summary screen in plain language that the installer can show or send to the parent. It covers what the device monitors, what it cannot detect, who can see the data, and how to contact Pontosense with questions.

Open questions
Open question

Should this step be skippable or required? Making it required is the stronger signal of product values, even if it adds a small amount of friction. Making it optional means most installers will skip it, which defeats the purpose of including it in the flow at all.

Open question

Is consent captured in the app, or does it happen verbally between family members and live outside the product entirely? Depending on the jurisdiction, this may have legal implications worth understanding early.

Open question

If the parent is not present during installation, does the app support an async path where the installer can share the briefing with the parent after the fact, and track whether it has been opened?

Setup complete
Summary view, first live reading, and next steps
Rationale
Rationale

The completion screen should show a first live reading right away, as proof that the device is actually working. An empty data screen at this point feels anticlimactic and raises doubt about whether the installation succeeded.

Open questions
Open question

What does the "next steps" content actually include? Tips for interpreting the first week of data? How to adjust alerts? How to add a second device? The completion screen is the handoff to the ongoing product experience and deserves thoughtful design.

Open question

Is there a follow-up touchpoint 24-48 hours after install (a push notification or email) that checks in and offers guidance? First-week drop-off is a real risk and worth designing against proactively.

Ongoing monitoring
Post-onboarding product experience
Open questions
Open question

What does the ongoing experience look like for the installer? Are they notified of all alerts, or only critical ones? Alert fatigue is a real risk that the product needs a clear strategy for.

Open question

Is there a path to remount or recalibrate without losing historical data? If the parent rearranges their room or the device needs to move, what does that recovery flow look like?

Open question

How does the product handle major life changes, like the parent moving to a care facility or the device being passed on to another family?