Import from a patient app
Pull a patient's record from their wallet app, with their approval — including temporary shares.
Patients can carry their own record in the temetro patient wallet app, encrypted on their phone. When they arrive at your clinic, you can import that record with their approval — and optionally as a temporary share that deletes itself afterward.
Before you start
Your clinic has an Ed25519 signing key (Settings → Signing). It's created automatically; the panel shows its public-key fingerprint, which patients and other clinics use to verify that a change really came from you. Owners and admins can rotate it there.
Importing a record
There are two ways, both in the Import from a patient app dialog on the Patients page:
By number
- Enter the patient's wallet number (starts with
tmw_— they copy it from their app). - (Optional) Turn on Share temporarily and pick a window (1 hour, 1 day, or 7 days).
- Click Send request — the patient gets a prompt on their phone.
By QR (scan to connect)
- Switch to Show QR and click Show QR code.
- The patient opens their wallet app, goes to the Scan tab, and scans the code. The QR carries this clinic's server address, so they never type anything — and it works even when each clinic runs its own server.
Either way, when the patient Approves, their record arrives for you to review in the usual patient form. Edit anything if needed, then save it to your clinic.
No setup for patients
The wallet app ships with a default server built in and can also be pointed at a specific clinic from its Settings → Relay server screen, or simply by scanning that clinic's QR. Patients never need to know a URL.
The QR address must be reachable from the patient's phone
The QR encodes the server address the phone connects to, so the phone has to be able to reach it. Out of the box that means the same Wi-Fi (the QR carries your machine's LAN address). To let a phone scan from any network (cellular, a different Wi-Fi), give the relay a public address:
- Testing now — in
backend/, runnpm run docker:tunnel(needs Docker). It opens a temporary publichttps://…trycloudflare.comaddress and wires it into the QR automatically — no install or account needed. (Without Docker:npm run dev:tunnel, which uses a localcloudflared.) - In production — deploy the backend and set
PUBLIC_RELAY_URLto its publichttps://URL. See Deploying the relay.
The record travels end-to-end encrypted — temetro's relay only ever sees ciphertext, and the record is verified against the patient's wallet number before it's shown to you.
Temporary shares
A temporary import is badged Temporary in the patient list. When its window ends, temetro automatically deletes the record from your clinic. The patient can also revoke it earlier from their app, which deletes it immediately.
Patient-owned by design
The record lives on the patient's device. Importing it copies it into your clinic only for as long as the patient allows — a permanent share stays until you delete it; a temporary share cleans itself up.