Skip to main content

Users

A user is one person in one tenant, with one role: a participant using the app, a member of staff working in the portal, or an API key's service account. The same person in two tenants is two users behind one identity. Everything that belongs to a participant (their user sequences, user journeys, responses, readings and chats) hangs off their user.

How a participant joins​

Every way in ends the same: an account at the identity provider, a user in one tenant, and the tenant's default journeys started on them.

  • A sign-up link or its code. A tenant and each of its cohorts can carry a signupCode; the link is built from it, and joining through a cohort's puts the person in that cohort. Codes are one pool across tenants and cohorts, so a code lands in exactly one place. An archived cohort's link is closed, with a message different from an unknown code's.
  • An invitation, for a named address and any role.
  • Open sign-up in a tenant's own app, when the tenant's signup.mode is open.

signup.mode is per tenant: code (links, codes and invitations; the default), open (as code, plus anyone signing up in the tenant's own app, who joins with no cohort) or invitation_only (codes and links refused). A code never reopens a membership an administrator closed. Someone who already has an account joins another tenant by invitation, not by code.

No health data is stored for a participant until they have consented (consentGivenAt). The app asks straight after the first sign-in, with the terms; declining signs them out and leaves their record as it was. Consent is given, declined and withdrawn as events on the legal documents, and each is written to the audit trail. Staff reading another person's record need that person's consent to stand. See Consent, access logging and erasure.

Status​

A user is active or archived. Archiving closes someone off in a tenant, for good or for a while:

  • they can't sign in, and their sessions end;
  • their journeys stop running, and carry on from where they were if they are made active again;
  • nothing is sent to them (pushes, texts, journey emails);
  • staff can't assign them anything, start a chat with them or give them a task (archived);
  • their record, responses and history stay readable.

Only an active user signs in. Deleting a user is erasure; see the consent page.