---
title: "Asking sensitive questions"
description: "How to ask something personal in a health form. Say why you are asking, make optional genuinely optional, and never make the answer feel like a confession."
url: "https://opsinjs.pensievelabs.org/content/asking-sensitive-questions"
source: "https://opsinjs.pensievelabs.org/content/asking-sensitive-questions.md"
section: "Content & language"
kind: "content"
reviewed: "2026-09-20"
reviewer: "content"
aliases: ["sensitive questions", "why we ask", "optional questions", "form copy"]
---
> Elements written as `` below are opsinjs documentation
> components. Their attributes are the content: the values they render are
> generated from `tokens/*.json` and `registry/catalogue.ts` and are
> published separately at https://opsinjs.pensievelabs.org/r/index.json and under the Reference
> section.
> Nothing is missing from this page. The data simply does not live in
> the prose.
## The rule [#the-rule]
**Say why you are asking, before you ask.** Every question in a health form
carries an implicit second question. *What happens to this answer?* A form that
leaves it unanswered gets worse data, more abandonment, and a reader who feels
examined rather than helped.
Four rules, in the order they apply to a question.
1. **State the purpose in one clause, next to the question.** Not in a help
article, not behind an information icon, not in the privacy policy. "We ask
because we use it to work out your usual range" is eleven words and it changes
the answer rate.
2. **If it is optional, say so on the label and mean it.** An optional question
that blocks the next step is a required question with a lie attached. Mark
required and optional explicitly rather than relying on an asterisk. See
[Required and optional](../patterns/forms/required-and-optional.mdx).
3. **Offer a way not to answer that is not a lie.** "Prefer not to say" is a
valid answer and must be stored as one. That stored answer is distinct from
unanswered, and it must never be silently coerced into a default.
4. **Never explain a refusal back to the reader.** No "are you sure?", no "this
will make your results less accurate" as a penalty. If the consequence is
real, state it once, neutrally, before the question.
### What makes a question sensitive [#what-makes-a-question-sensitive]
More than the obvious categories. A question is sensitive if any of these apply:
* The answer could be **used against the reader** by an insurer, an employer or a
family member with access to the phone.
* The answer is about something the reader may **not have told anyone**.
* The answer implies a **judgement**. Alcohol, weight, smoking, adherence,
sexual health and mental health all carry one.
* The answer is **immutable and identifying**, and that covers ethnicity, sex
assigned at birth and date of birth.
* The reader may have to answer it **in front of somebody**, which is most of
them, on a phone. See [On-screen privacy](../health/on-screen-privacy.mdx).
The per-question guidance says what to ask, in what form, and with what options.
That guidance is in the [Ask users for…](../patterns/ask-users-for/index.mdx)
family, which is canonical for each individual question. This page is the copy
rule that applies across all of them.
Some answers are disclosures rather than data. A question about mood, self-harm
or safety at home can produce an answer that requires the product to respond
immediately and appropriately, and a form that thanks the reader and moves on has
failed them. Those flows are governed by
[Crisis and self-harm](../health/crisis-and-self-harm.mdx), which is canonical,
and no product should ship such a question without reading it.
## Approved / Rejected [#approved--rejected]
How much alcohol do you drink in a usual week? We ask so we can show this alongside your readings. Nobody else sees it.
Alcohol consumption (units/week) *
What is your ethnic group? (optional) We ask this so we can check whether the app works as well for everyone. You can skip it.
Ethnicity (required for accurate results)
Prefer not to say
Other / Unknown
You can change this later in Settings.
Are you sure? Skipping this will make your results less accurate.
The third pair is a small change with a large effect. "Other" makes the reader
the exception; "Unknown" says the system does not know something it should.
"Prefer not to say" is the only option that describes a decision the reader made.
## Patterns [#patterns]
**Any sensitive question**
> `Question in the reader's words`? `(optional, where it is)`
> We ask because `single specific reason`. `Who can see it`.
**A question with a real consequence for skipping**
> `Question`? (optional)
> We ask because `reason`. If you skip it, `specific consequence`, and you can
> add it later.
Stated once, before the question, never as a challenge afterwards.
**A question that may be answered in company**
> `Question`?
> `Control to hide the answer as it is entered, or a note that it is stored
> privately`.
**Introducing a group of sensitive questions**
> The next `n` questions are about `topic`. You can skip any of them. `What the
> answers are used for`.
**Confirming a disclosure without alarming**
> Thank you for telling us. `What happens next, concretely`.
Never "we're sorry to hear that" as the whole response. Sympathy without an
action is a dead end.
**Storing a non-answer**
> Not answered · Prefer not to say
Two distinct states, both preserved. Never collapsed into a default value.
## Banned words [#banned-words]
| Banned | Why | Use instead |
| ------------------------------------------- | --------------------------------------------------------------------------- | ----------------------------------------- |
| an asterisk to mean required | Unlabelled convention; invisible to some readers and ambiguous to the rest. | the words "required" or "optional" |
| Other, Unknown, N/A (as a refusal option) | Makes the reader an exception or the system ignorant. | Prefer not to say |
| Are you sure? | Challenges a decision the reader already made. | delete |
| for accurate results (as a pressure phrase) | Turns a data request into a threat. | the specific consequence, once |
| honestly, truthfully, be honest | Implies the reader was about to lie. | delete |
| we're sorry to hear that (alone) | Sympathy with no action after a disclosure. | thank them, then say what happens next |
| units (of alcohol) without explanation | A unit is a technical measure most readers cannot convert. | ask in drinks, and explain the conversion |
| failed to disclose, refused | Case-note register applied to a person's own app. | not answered, prefer not to say |
## Related components [#related-components]
* **`Field`** carries the label, the optional marker, the purpose clause and the
error text. The purpose clause is a first-class part of the field, not a
tooltip.
* **`ConsentSheet`** is the surface for asking permission rather than for asking
a question; governed by
[Consent and disclosure](../health/consent-and-disclosure.mdx).
* **`LogSheet`** is where repeat questions live, and where a "prefer not to say"
from last time must not be re-asked as though it were unanswered.
* **`CareCard`** is the usual home for what happens after a disclosure.
* **`DisclaimerNote`** states what the product does with answers, in the same
register as everything else.