Alerts for a veterinary practice

What this actually looks like

Owners of a hospitalised animal refresh their phone all afternoon. A sealed practice channel lets you say “Case 219 — out of surgery, awake, collection from 16:00” with no phone number, no name and no email address anywhere in it. Owners join with an invite code printed on the admission form.

How you would set it up

1. Create a private channel for the practice and put its invite QR code on the admission form and in the waiting room.
2. Post case-number updates through the day, and schedule the routine ones — vaccination reminders, worming season — well ahead.
3. Keep it to what an owner would act on. A channel that posts twice a day is a channel people keep.

Private means sealed, not merely unlisted

A private channel is not one that is simply missing from a directory. It requires an invite code both to subscribe AND to read anything about it, and a request without one gets exactly the same “not found” as a handle that never existed — because a different answer would let anybody confirm that a school’s or an ops team’s channel exists by guessing its name. Invite codes can carry a use limit and can be revoked; revoking is a timestamp and by default removes nobody who already joined.

Draft, schedule, send — and what cancelling cannot undo

Composing and sending are deliberately different permissions, so the person or script that writes an alert can be forbidden from publishing it. A scheduled alert becomes visible at its time without anything having to run at that minute, which means a server that was briefly down delivers late rather than never. Cancelling is honest about its limits: it stops an alert reaching phones that have not fetched it yet and does nothing at all to the phones that already have it. An alert cannot be unsent.

Nothing that could identify anybody

Subscribing needs no account, no email address and no phone number. What a subscription actually holds is a random identifier the app generated, a platform, an app version, a language and a time zone — coarse enough that hundreds of millions of people share one. There is no name, no contact detail, no advertising identifier and no location, and there is no export that would let an operator build one. You cannot leak a list you never collected.