Appearance

Pairing & Sign-in ​

Patients do not create accounts or type passwords in the mobile app. Instead the app is paired with an organisation through an invite issued by the care team. Pairing is what links the phone to the patient's record on that organisation's Medipal instance.

The invite ​

A clinician enrolls the patient in the web application and generates an invite. The invite is delivered as:

  • a QR code shown on screen and scanned with the phone camera, or
  • a link sent to the patient, which opens the app directly, or
  • an authentication code that the patient pastes into the Records screen under "Manual device authentication".

Each invite is tied to one patient and one organisation and is valid for a limited time. An expired invite has to be regenerated by the clinician.

What happens on the phone ​

  1. The app reads the invite and looks up the organisation's instance.
  2. The app registers the phone as a device belonging to the patient. The device is listed in the patient's profile in the web application, together with its name, model and operating system.
  3. The consent step is shown. The app displays the consent documents the organisation has published for device pairing; the patient must accept each document marked as required before continuing. If the organisation has not published any, a built-in terms-and-conditions text is shown instead.
  4. The app downloads the patient's enrollments, questionnaires and the questionnaire engines needed to render them.
  5. If notifications are not yet allowed, the app asks for permission so it can remind the patient when a questionnaire is due.

Once paired, the app keeps the connection alive on its own. The patient does not sign in again unless the device is revoked or the data is cleared.

Accepting an enrollment ​

Some enrollments require the patient to accept enrollment-specific terms before the first questionnaire can be started. Such enrollments appear on the Home screen with an Accept invitation button and the status "Pending consent" in Records. After acceptance the enrollment becomes active and the questionnaires follow their schedule.

Several organisations on one phone ​

A phone can be paired with more than one organisation, for example a hospital and a research programme. Each pairing is independent: it has its own enrollments, questionnaires and reminders. The Records screen lists every organisation the device is authenticated with, when it was authenticated and when the pairing expires.

Leaving an organisation ​

From the Records screen the patient can:

  • Cancel an enrollment — the enrollment is terminated and its questionnaires and reminders are removed. This cannot be undone; the care team would need to enroll the patient again.
  • Revoke access to an organisation — all local data for that organisation is deleted from the phone and the device is unregistered.

The care team can also revoke a device from the web application. When that happens, the app removes the organisation's data on its next sync and tells the patient that access has been revoked.

What is stored on the device ​

The app keeps only what it needs to work offline: the questionnaires assigned to the patient, their schedules, the rendering engines, answers waiting to be sent, and the credentials that let the app talk to the organisation's instance. Everything is stored in an encrypted local database. Clinical data from the patient's record is not stored on the phone.