alumbra

Contextual, audience-verified screens for hospital lobbies · Bangkok

Attention, measured like light.

Alumbra sees without recording — the shipped binary contains no image encoder, and an automated audit enforces it on every release.

Alumbra reads the audience waiting at a lift, picks the message to fit, and proves what was seen — while storing nothing. Alumbra: Spanish, “it illuminates.”

[ n=— · attn — ]

awaiting first logged session

The proof is the product.

[ n=— · attn — · replay pending first logged session ]

operator view · format shown · no session logged yet

This is everything Alumbra sees.

Boxes, bands, counts — the device’s total perception, rendered live. There are no pixels behind this view to reveal.

It physically cannot save a picture.

The shipped binary contains no image encoder; a CI-gated audit — tools/privacy_audit.sh — fails any build that adds one. We run it in front of you, on your device, in your lobby.

Nothing about you outlives the lift wait.

Frames are destroyed in RAM in under 200 ms, and the frame type is not serializable by construction — the code has no way to write one.

No small group is ever described.

Visible in the view beside this sentence — below five people, every box reads unknown.

Only ministry-approved health messages ever play.

A creative without its DoHSS approval reference does not play — the engine will not start.

under 2 sdecision, preflight-gated
<200 msframe lifetime
k<5suppression
0images stored

We publish this list because in a hospital, what a device refuses to do is the specification that matters.

01

Alumbra refuses to identify anyone.

No face recognition, no biometric templates, no recognizing a person who returns — tomorrow, or five minutes later.

02

Alumbra refuses to guess what it cannot know.

No ethnicity, health, or income inference — refused on law, on science, and on taste. No emotion claims. No gaze certainty. The honest tier is head-pose attention, and we name it.

03

Alumbra refuses to keep an image.

Not disabled — absent. No encoder in the binary; audited every release.

04

Alumbra refuses to describe small groups.

Below five people, age bands are suppressed everywhere — including our own operator view.

05

Alumbra refuses to play an unapproved health message.

No DoHSS approval reference, no boot.

06

Alumbra refuses to override the venue.

The hospital holds the kill-switch; we do not.

Light in. Numbers out. Decision.

01 · light in

A camera above the screen reads the waiting area. Frames live in memory for under 200 milliseconds — counted, then destroyed.

02 · numbers out

Headcount, group composition, wide age bands when visible, seconds of attention. Aggregates only — below five people, the band breakdown suppresses itself.

03 · decision

A pair and a solo visitor wait; the screen weighs the mix and picks the message to fit — before the lift arrives. Decisions in under two seconds — gated in preflight.

Your lift lobbies already hold an audience. Alumbra gives you proof of attention — every play verified, every number reproducible from the event log.

A monthly report in standard out-of-home vocabulary — verified plays, attention seconds, audience mix — every line reproducible from the event log. DoHSS approval enforced on every creative. A per-venue kill-switch turns audience-reactive selection off and the screen falls back to its scheduled rotation; stated candidly for your DPO: in this mode the instrument still measures, it stops acting on what it measures. The pilot is reversible.

Request a pilot

For data-protection officers

What this camera does, and what it cannot do.

For patients and visitors

The notice behind the QR code on venue signage.

nulabs is a Bangkok lab building instruments that measure the physical world without surveilling the people in it. nulabs signs every instrument it ships. Alumbra is the first.