Medical info and allergies

A minor’s medical information is the most sensitive data the church handles. The module treats it with special care: encrypted at rest, least-privilege access, and audit on every read.

What can be recorded

• Allergies: food, environmental, medications. Severity: mild / moderate / severe (with epinephrine, etc.).
• Medications: name, dose, frequency. Useful if the minor needs medication during a long event (camp).
• Conditions: diabetes, asthma, epilepsy, autism spectrum, others.
• Emergency contacts: up to 3, with relationship and phones.
• Family pediatrician: optional, emergencies only.
• Additional notes: free field for the family.

Who sees what

The medical detail is not printed on the child’s label. It appears only on the room volunteer’s tablet with the info needed to care for them.

The red alert

When a family marks “Severe allergy the team must know IMMEDIATELY”, the system:

1. Shows a visible red flag on the room list.
2. Notifies the campus’s Kids Coordinator via push.
3. Logs the event in audit.
4. Prints a second label the team posts visibly in the room with the minor’s first name and the condition.

Use the red alert with judgment: if everything is a red alert, nothing is.

Editing

Only the parent or an org_admin can edit medical info. Every change is audited with who, what changed, and when.

{
  "action": "minor.medical.updated",
  "minor_id": "m_42",
  "field": "allergies",
  "before_redacted": true,
  "after_redacted": true,
  "actor_user_id": "u_18",
  "occurred_at": "..."
}

Note the before/after values don’t appear in logs to prevent leaks.

In an emergency

If a minor has an emergency during a service:

1. Volunteer opens the minor’s record on the room tablet.
2. Sees the emergency contacts and family pediatrician.
3. Calls the responsible adult AND one of the emergency contacts.
4. Follows the church’s emergency protocol (Ministrium doesn’t replace the protocol).

Compliance

This whole flow is designed to comply with:

• COPPA (US): see COPPA compliance.
• HIPAA (US): although churches usually aren’t covered entities, we treat medical info to a HIPAA-grade standard. See HIPAA.
• GDPR/LGPD: see GDPR and LGPD.