Skip to main content

Users

A user is one person in one tenant, with one role: a participant using the app, a member of staff working in the portal, or an API key's service account. The same person in two tenants is two users behind one identity. Everything that belongs to a participant (their user sequences, user journeys, responses, readings and chats) hangs off their user.

How a participant joins​

Every way in ends the same: an account at the identity provider, a user in one tenant, and the tenant's default journeys started on them.

  • A sign-up link or its code. A tenant and each of its cohorts can carry a signupCode; the link is built from it, and joining through a cohort's puts the person in that cohort. Codes are one pool across tenants and cohorts, so a code lands in exactly one place. An archived cohort's link is closed, with a message different from an unknown code's.
  • An invitation, for a named address and any role.
  • Open sign-up in a tenant's own app, when the tenant's signup.mode is open.

signup.mode is per tenant: code (links, codes and invitations; the default), open (as code, plus anyone signing up in the tenant's own app, who joins with no cohort) or invitation_only (codes and links refused). A code never reopens a membership an administrator closed. Someone who already has an account joins another tenant by invitation, not by code.

No health data is stored for a participant until they have consented (consentGivenAt). The app asks straight after the first sign-in; declining signs them out and leaves their record as it was. Consent is recorded, withdrawn and restored as a change to the user, and each is written to the audit trail. Staff reading another person's record need that person's consent to stand. See Consent, access logging and erasure.

Status​

A user is active or archived. Archiving closes someone off in a tenant, for good or for a while:

  • they can't sign in, and their sessions end;
  • their journeys stop running, and carry on from where they were if they are made active again;
  • nothing is sent to them (pushes, texts, journey emails);
  • staff can't assign them anything, start a chat with them or give them a task (user_archived);
  • their record, responses and history stay readable.

Only an active user signs in. Deleting a user is erasure; see the consent page.