Each person has a pre-approved emergency protocol. In an emergency, staff make three decisions — who is responding, why, generate — and hand over a QR code. The responder sees exactly what the protocol allows, for a limited time.
The responder gives their name, organisation and an identifier before seeing anything. They get allergies, current medication and the documents the protocol includes — with medication clearly marked as provisional when it is not fully reconciled.
The protocol has an owner, reviewers, effective and review dates, consent and legal basis, and a scope for each type of responder. It moves from draft to review to approved — and nothing can generate a code without an approved protocol.
When the session ends it is closed out to the incident and the person's chronology, and a post-event review is opened. The office has an oversight view of every session and an assurance view over time.
Every refusal and every responder page says to call 999 first.
Fields and documents come only from the approved protocol. There is no generic "Other".
Unscanned codes die after 60 minutes; an idle responder must acknowledge again.
The code is random and opaque. Verio stores its hash, never the token itself.
Revoking ends the token and every device grant together.
Escalation closes the old session and opens a new one with a recorded reason.
We'll trigger a session and show the responder's view on a phone.
