ADR 0018 (lands with #128) is deliberately Open and needs a named owner to close it, in the same way #23 does for 0009.
0007 settled what happens when the biometric fails — fall back to the device passcode. It was written about lockout, and it assumes there is a device lock to fall back to. Some phones have neither a biometric nor a passcode set, and then there is nothing to prompt with.
This is not a rare edge case for this audience: a passcode is one more thing to remember, and people who find technology difficult are exactly who this app is for.
What ships today is a placeholder, not a decision. The unlock gate explains the situation and lets the user continue. It was chosen because silently doing nothing and hard-refusing both seemed worse than saying something true. The journal is still encrypted at rest either way — the device lock is a second layer, not the only one.
Options (from 0018)
- Refuse to open until a device lock is set. Strongest, and locks someone out of their own medical information over a phone setting they may not know how to change. Hard to square with "keep technology in a supporting role".
- Continue, with a plain explanation. What is built today.
- Prompt once, remember the answer. Nudges without trapping. More UI, and needs somewhere to store the answer.
- Continue, and offer a shortcut into the OS settings screen. Same, with a lower barrier to actually fixing it.
What is needed
ADR 0018 (lands with #128) is deliberately Open and needs a named owner to close it, in the same way #23 does for 0009.
0007 settled what happens when the biometric fails — fall back to the device passcode. It was written about lockout, and it assumes there is a device lock to fall back to. Some phones have neither a biometric nor a passcode set, and then there is nothing to prompt with.
This is not a rare edge case for this audience: a passcode is one more thing to remember, and people who find technology difficult are exactly who this app is for.
What ships today is a placeholder, not a decision. The unlock gate explains the situation and lets the user continue. It was chosen because silently doing nothing and hard-refusing both seemed worse than saying something true. The journal is still encrypted at rest either way — the device lock is a second layer, not the only one.
Options (from 0018)
What is needed