What happens when a token is scanned
Describes the result of a scan from the side of whoever scans it — what is shown, and what is not.
What the responder sees
Section titled “What the responder sees”A page, straight away. The phone camera reads the QR and opens it. Nothing to install and no account to hold: emergency contacts behind a login would be no use to the person standing there, who has no reason to have one.
Who to call, in the order to call them. The name of the person the token belongs to, then their contacts grouped as Call first, If no answer and About them. It is meant to be read top-down until a number answers. Numbers are tap-to-call, email addresses open a message, addresses open in Maps.
When it was last updated. The stamp sits under the name, and it is the whole difference from a card printed on paper: what a responder reads is what the person last set, not what was true when the token was made.
A short-lived address. Once the page opens, the address in the browser changes to a temporary one. It works for 30 minutes — reloading it shows the card again, with current details — and then it says the link has expired and the token has to be scanned again. Whoever the address is forwarded to sees the card too, until it expires.
Only what has been filled in. Empty fields are not rendered at all — an unanswered row costs reading time — and what is there is what the person chose to put behind their token.
Sometimes, the token’s ID first. Its owner can ask for the last 5
characters of the ID printed on the token before the card is shown. The page
says so and shows where to look: SPH-T-XXXXX-?????. A mistake can be
corrected and tried again, and the card is never locked.
That check is the owner’s choice. It is off unless they turn it on, under My tokens → Ask for the token’s ID before showing your contacts. It is worth turning on only if the ID on the token is easy to read: if it is worn or too small, a responder cannot reach the contacts.
One of three other outcomes, when there is no card to show. A token nobody has linked yet says it is not active, and offers a link for the person who ought to be linking it. A token linked by someone who has not filled anything in says there is no emergency information yet. A token that has been switched off says it is no longer active.
What they don’t
Section titled “What they don’t”Anything the person did not put there. This is not a medical record and not a file on anybody: it holds the contacts and details they entered, at their current values, with no history and no earlier versions behind them.
A way into anything else. The page has no navigation, no search, nobody else’s details, and no route into the Portal or into that person’s account. It is one page about one person and it leads nowhere.
A page that can be found. It is not indexed, never linked from anywhere, and carries instructions to search engines to leave it alone. The only way in is physically holding the token.
The printed ID is not the way in. The ID on the face of a token is for its owner to link it by, and it will not open this page — the QR carries a different key. The page never shows that ID either. If the owner asks for it, its last 5 characters only confirm a scan; on their own they open nothing.
An address anyone could arrive at by trying. What the QR carries is long and random, and it is not built from the printed ID or from anything else about the person — there is no pattern to work out and no neighbouring token to step to. A wrong address returns the same page an unlinked token returns, word for word, so an attempt is not even told it was wrong.
Who scanned it. Nobody is asked who they are, and nothing about them is kept: not a name, not a device, not where they were. The scan itself is recorded on our side as an event — that this token was scanned, and what it resolved to — which is what lets a token’s use be accounted for without anyone being identified by it.