Devices and device management

Staff phones

• The companion app's staff mode runs only on hospital-managed phones: the MDM app configuration carries the site's managed-device flag.
• The app refuses staff mode on a phone with no passcode.
• After 5 minutes in the background, it asks for Face ID, fingerprint or the passcode.
• Sessions last 12 hours and can be ended remotely by a manager.
• Lock-screen actions (for example "Can't go" on an urgent request) require device authentication.
• Push payloads contain no patient details.
• Recommended MDM settings: required passcode, OS updates within your policy window, managed app configuration, remote wipe.

Shared workstations

The console is designed for shared workstations: the idle lock removes patient data from the screen after 15 minutes (site range 5 to 60), sessions end after 12 hours, and staff can see and end their own sessions. No patient data is cached in browser storage.

Print and big-board stations

Print stations (visit cards) and big-board stations run under a station credential registered by a manager with a one-time code, never under a person's session. A station can only do its one job, has no idle lock, is audited with its id, and is revoked instantly. Put big-board stations only where patients and visitors can't see them.

Waiting-room display

A kiosk browser showing department-level information only: never a name, a code or an area. See Network requirements.

Patients' phones

Patients' phones are untrusted: they may be shared, lost or observed. The design assumes it:

• tokens in URL fragments, removed from the address bar immediately;
• generic lock-screen text by default;
• optional Face ID or fingerprint lock in the app;
• "Sign out and forget this device";
• the offline copy encrypted and deleted when access ends, even with no network;
• the questions notepad stored only on the phone, encrypted with a key the server deletes at access end.

Related

• Companion app
• Identity and SSO