# Meduvo Kiosk Device Lockdown Runbook

This runbook is the production control for item 26 in `MISSING_MODULES_PLAN.md`.
The Flutter/web kiosk shell blocks in-app navigation, but production clinics
must also lock the operating system so patients cannot leave Meduvo, open
settings, browse other apps, inspect notifications, or access saved accounts.

## Required Controls

Apply one of these controls before any tablet is used with real patients:

1. iPadOS supervised device with Apple Business Manager plus MDM single-app mode.
2. iPadOS Guided Access for very small pilots where MDM is not yet available.
3. Android Enterprise dedicated-device mode with lock-task / single-app mode.

Do not rely on browser fullscreen, Flutter route guards, or staff verbal
instructions as the only kiosk protection.

## iPadOS MDM Baseline

- Enroll the iPad as a supervised device in Apple Business Manager.
- Assign it to the clinic MDM.
- Push a single-app mode profile pinned to the Meduvo Patient app bundle id.
- Disable Control Center, Notification Center, app switcher, Siri, screenshots,
  AirDrop, Safari, iCloud account changes, passcode changes, and installing or
  deleting apps.
- Restrict external keyboard shortcuts if a keyboard is attached.
- Allow only the Wi-Fi networks used by the clinic.
- Require automatic OS updates through the MDM maintenance window.
- Confirm the MDM can remotely clear a lost device.

## iPadOS Guided Access Pilot

Guided Access is acceptable only for short pilot testing when MDM is not yet
deployed.

- Enable Guided Access in iPadOS accessibility settings.
- Set a staff-only Guided Access passcode.
- Launch Meduvo Patient and start Guided Access before handing over the device.
- Disable touch regions only if a clinic workflow requires it.
- End Guided Access only after staff receives the tablet back.
- Record which staff member started and ended the session.

## Android Enterprise Baseline

- Enroll the tablet as a fully managed Android Enterprise dedicated device.
- Set Meduvo Patient as the lock-task allowlisted app.
- Disable status bar expansion, recent apps, home button escape, notifications,
  system settings, unknown sources, account changes, USB file transfer, screen
  capture, and app installation/removal.
- Enable automatic app update policy through managed Google Play.
- Allow only clinic Wi-Fi networks.
- Require MDM remote lock and wipe.

## Clinic Handoff Procedure

1. Staff confirms the tablet is physically labeled for the clinic room.
2. Staff confirms the OS is already in single-app / Guided Access mode.
3. Staff launches the Meduvo handover activation screen.
4. Staff scans or enters the handover payload and verifies the identity screen.
5. Staff hands the locked tablet to the patient.
6. Patient completes screening/consent.
7. Staff retrieves the tablet and ends or resets the kiosk session.

## Acceptance Check

Before go-live, test all of these on each device model:

- Home/app switcher cannot leave Meduvo.
- Pull-down notification/control panels are blocked.
- Long-press power or lock-screen behavior does not expose PHI.
- Incoming non-Meduvo notifications do not display.
- Device reboot returns to the managed app state.
- Lost-device remote wipe works from MDM.
- Meduvo's in-app `Get Staff Assistance` path clears the handover session.

## Ownership

Clinic IT owns the OS/MDM controls. Meduvo application code owns only the
in-app kiosk shell, handover token scoping, identity confirmation, and session
cleanup.