The roster

One person, one record

"Swimmer", "coach" and "guardian" are things a person does, never separate records. The coach whose own child swims is one person with two roles, not two rows that drift apart. Moving house updates one address.

What you can do today

Roster (needs read_roster, which nearly every staff role carries) gives you:

• A search by name across the club's people
• A person page with their details, household, roles and status
• Edit on the person page (needs manage_club_members): names, date of birth, contact details, meet-entry gender and gender identity. A date of birth you type is recorded as staff-entered, and every edit writes an audit row naming which fields changed — never their values

This is the screen you use to answer "who is this and are they ours". Below the details the person page carries:

• Medical — the one-line deck alert, for anyone holding read_medical_summary. The full file (allergies, medications, insurer) opens only on Open medical file, needs read_medical, and writes an audit row every time. Whoever opens it can correct it, and set or clear the alert the gate shows.
• Emergency contacts — the person's own list, read first, then their family's. read_roster reads them; manage_club_members adds, corrects and removes. A coach cannot add a name the desk will read out.
• Notes — staff notes about the person, each at a tier: staff, admin only, or safeguarding. The safeguarding tier never loads with the page; the Safe Sport lead presses Read safeguarding notes and every note shown is audited. You can edit or pin your own operational note, and delete it. A safeguarding note is filed, never edited — a correction is a second note. Families never see any of these.

People are not added from the roster. A person joins the club through a family: add them on their household's card (see Households and the family card), invite them, or approve the family's registration.

If a contact restriction is on file for the person — "do not release this child to this adult" — the person page shows it in red to anyone holding run_gate or manage_club_members, along with any voided or lapsed ones, struck through. A registrar (manage_club_members) can file one and void one from the same place. There is no edit: a wrong filing is voided and filed again, so the history stays readable.

Portal access for an adult

On an adult's page, Portal access lists who may see that adult's record on their behalf — usually a parent keeping an eye on billing after an 18th birthday. A registrar can grant billing and schedule access and revoke any grant with a reason; a revoked grant stays listed as history. Medical and chat access are the adult's own decision and cannot be granted by staff.

Once any grant exists for an adult, sharing a household no longer shows their record to anyone else.

The gate photo

The person page is where the gate photo is taken. Anyone holding run_gate or manage_club_members can take or upload one, replace it, or remove it. On a tablet the button opens the camera.

• The photo is cropped to a square of at most 400 pixels on the device, before anything is sent. The full-size original never leaves it.
• Only run_gate sees the photo itself. It is never a link that can be copied or forwarded, and a family never sees it — not even their own child's.
• Every capture and removal is written to the audit trail.

What a person record holds

The medical split is deliberate. A deck coach gets the summary they need to keep a child breathing. Nobody on deck needs a policy number, and every read of the full record writes an audit row naming who looked.

Archiving

A person can be archived rather than deleted. An archived person is red at the gate and the fix is to restore the record, not to wave them through — that refusal is one the front desk cannot override.

What is not built yet

• Archiving or merging a person from this screen — editing is live; the archive and merge tools are not

Bringing a whole roster in from a spreadsheet is Importing your club.