Asking sensitive questions

The rule

Say why you are asking, before you ask. Every question in a health form carries an implicit second question. What happens to this answer? A form that leaves it unanswered gets worse data, more abandonment, and a reader who feels examined rather than helped.

Four rules, in the order they apply to a question.

1. State the purpose in one clause, next to the question. Not in a help article, not behind an information icon, not in the privacy policy. "We ask because we use it to work out your usual range" is eleven words and it changes the answer rate.
2. If it is optional, say so on the label and mean it. An optional question that blocks the next step is a required question with a lie attached. Mark required and optional explicitly rather than relying on an asterisk. See Required and optional.
3. Offer a way not to answer that is not a lie. "Prefer not to say" is a valid answer and must be stored as one. That stored answer is distinct from unanswered, and it must never be silently coerced into a default.
4. Never explain a refusal back to the reader. No "are you sure?", no "this will make your results less accurate" as a penalty. If the consequence is real, state it once, neutrally, before the question.

What makes a question sensitive

More than the obvious categories. A question is sensitive if any of these apply:

• The answer could be used against the reader by an insurer, an employer or a family member with access to the phone.
• The answer is about something the reader may not have told anyone.
• The answer implies a judgement. Alcohol, weight, smoking, adherence, sexual health and mental health all carry one.
• The answer is immutable and identifying, and that covers ethnicity, sex assigned at birth and date of birth.
• The reader may have to answer it in front of somebody, which is most of them, on a phone. See On-screen privacy.

The per-question guidance says what to ask, in what form, and with what options. That guidance is in the Ask users for… family, which is canonical for each individual question. This page is the copy rule that applies across all of them.

Approved / Rejected

The third pair is a small change with a large effect. "Other" makes the reader the exception; "Unknown" says the system does not know something it should. "Prefer not to say" is the only option that describes a decision the reader made.

Patterns

Any sensitive question

Question in the reader's words? (optional, where it is) We ask because single specific reason. Who can see it.

A question with a real consequence for skipping

Question? (optional) We ask because reason. If you skip it, specific consequence, and you can add it later.

Stated once, before the question, never as a challenge afterwards.

A question that may be answered in company

Question? Control to hide the answer as it is entered, or a note that it is stored privately.

Introducing a group of sensitive questions

The next n questions are about topic. You can skip any of them. What the answers are used for.

Confirming a disclosure without alarming

Thank you for telling us. What happens next, concretely.

Never "we're sorry to hear that" as the whole response. Sympathy without an action is a dead end.

Storing a non-answer

Not answered · Prefer not to say

Two distinct states, both preserved. Never collapsed into a default value.

Banned words

Related components

• Field carries the label, the optional marker, the purpose clause and the error text. The purpose clause is a first-class part of the field, not a tooltip.
• ConsentSheet is the surface for asking permission rather than for asking a question; governed by Consent and disclosure.
• LogSheet is where repeat questions live, and where a "prefer not to say" from last time must not be re-asked as though it were unanswered.
• CareCard is the usual home for what happens after a disclosure.
• DisclaimerNote states what the product does with answers, in the same register as everything else.