GB2597246A - Systems, methods and devices, and computer program products, for use in testing and verifying symptom-free status of individuals and/or premises - Google Patents

Abstract

A system for testing and verifying symptom-free status of individuals includes testing terminals and portable personal devices (PPD). The testing terminal includes a symptom testing device which may be a no touch thermometer and tests a user for symptoms such as a fever when they present themselves to the testing terminal. A contactless communication device transfers the new test result securely to the user’s portable personal device, such as a mobile phone, together with authentication information identifying the symptom-testing result as originating from a trusted testing terminal. The PDD can authenticate the identity of the user and receive the test result along with the testing terminal authentication information. At a later time and place, the PPD indicates in human and/or machine-readable form information which it can be determined that a symptom-free test result was obtained with a certain recency such as the last six hours, by a trusted testing terminal.

Description

SYSTEMS, METHODS AND DEVICES, AND COMPUTER PROGRAM PRODUCTS, FOR USE IN TESTING AND VERIFYING SYMPTOM-FREE STATUS OF INDIVIDUALS AND/OR PREMISES

FIELD OF THE INVENTION

[0001] The invention relates to systems, methods and devices, and computer program products, all for use in testing and verifying symptom-free status of individuals and premises.

BACKGROUND

[0002] In epidemic situations, such as the present COVID-19 pandemic, authorities, communities, businesses and individuals seek to return to commercial and social life. Visitors to shared spaces such as the premises of commercial, educational and other institutions cannot be sure that they are safe from disease as public spaces and businesses reopen. Customers cannot be sure that they are not passing on the disease to others. Likewise, businesses and institutions cannot provide staff and customer confidence that their premises are as safe as possible to visit and to dwell in.

[0003] From past epidemics, as well as the present pandemic, it has been recognised that modern technology might offer solutions, but the available solutions are not always attractive or viable to be used by the majority of the public in a wide range of shared spaces. Known solutions are limited in ambition, for example to facilitate contact-tracing response when symptoms have already emerged, and/or are available only to individuals who have already been tested, for example because they work in a role where the risk is relatively high for themselves and/or for others.

SUMMARY OF THE INVENTION

[0004] The invention in a first aspect provides a system for use in testing and verifying symptom-free status of individuals and premises, the system comprising one or more testing terminals and a plurality of portable personal devices, each testing terminal comprising: at least one symptom-testing device for testing a user who presents themself to the testing terminal to obtain a new symptom-testing result; and at least one short-range wireless communication device for transferring the new symptom test result securely to the user's portable personal device together with authentication information identifying the symptom-testing result as originating from a trusted testing terminal, each portable personal device comprising a data storage and processing device adapted for communication with the short-range wireless communication device of the testing terminal, and being configured: to authenticate the identity of the user; (ii) to receive via short-range wireless communication from the testing terminal authentication information together with a new symptom-testing result for the user; (iii) at a later time to indicate in human-and/or machine-readable form information by which it can be determined that a symptom-free test result was obtained by a trusted testing terminal with a certain recency.

[0005] The invention enables a portable personal device to serve as an authenticated "symptom-free" pass, that can be recognised and trusted across a wide network of participating premises. The implementation of the testing terminals and portable personal devices can be adapted to different situations, while operating within the same trusted network. In public health terms, the system illustrated provides not only a cordon sanitaire for participating establishments but also a community-wide symptom-screening function, feeding leads into test, track and trace programmes.

[0006] In some embodiments that provide a "fever-free" status as an example of symptom-free status, said symptom-testing device is a non-contact thermometer. A fever-free status as an initial symptom-free health status may be determined automatically by the testing device and/or by the portable personal device on the basis of the new symptom-testing result indicating a normal body temperature.

[0007] In some examples, the portable personal device is configured to maintain a current health status for the user that is dependent on the symptom-testing result received from the testing terminal and on time elapsed since receipt of the symptom-testing result, the current health status indicator indicating a symptom-free status for a predetermined period of time after receiving a new testing result indicating an initial symptom-free status, said current health status indicator being at least part of the information provided at said later time.

[0008] In some implementations, said initial symptom-free health status may be determined by the testing terminal on the basis of the new symptom-testing result. In other implementations, said initial symptom-free health status may be determined by the portable personal device on the basis of the received symptom-testing result.

[0009] In some implementations, the portable personal device is configured to display said information at said later time via a display included in the portable personal device. The display of said information may include said information in machine-readable form.

[0010] In some embodiments, said certain recency allows an elapsed time greater than or equal to two hours, optionally greater than or equal to four hours or five hours. For example, a symptom-free health status may last approximately six hours from the time of obtaining a symptom-free test result.

[0011] In some embodiments, said certain recency requires an elapsed time less than or equal to twenty-four hours, optionally less than or equal to twelve hours or ten hours or eight hours or seven hours. For example, a symptom-free health status may last approximately six hours from the time of obtaining a symptom-free test result.

[0012] The portable personal device may be configured to indicate said current health status on a display. The status may be read by a machine checking terminal and/or human operators at the entrance to premises.

[0013] The portable personal device may be configured to indicate at said later time both the received test result and a fimestamp of the received test result. Such an embodiment may be used to enable a type of portable personal device that has no active monitoring of the health status, for example being a contactless device without on-board power. The indication need not be by means of a display, but can be by contactless communication with a checking terminal.

[0014] Rather than requiring every user to have a special portable personal device, in some implementations the portable personal device is a personal communication device such as a smartphone, the personal communication device being configured by an installed application program to implement the features (i), (ii) and (iii) of the invention in the first aspect.

[0015] In some implementations, the portable personal device is configured to indicate said current health status by short-range wireless communication with a checking terminal.

The wireless communication can be by radio waves or other means stop [0016] Rather than requiring every user to have a smartphone, in some implementations the portable personal device is a smartcard, fob or token, the indication of current health status being read by a checking terminal by short-range wireless communication with a checking terminal.

[0017] The portable personal device may be further configured to present user authentication information when indicating current health status.

[0018] In some implementations, the portable personal device is configured only to accept symptom-testing results from the testing terminal if the user has completed to a symptoms questionnaire in the system sufficiently recently (for example earlier the same day).

[0019] The system may further comprise one or more checking terminals configured to read the indication of current health status of a user from the user's portable personal device and to grant or deny permission to enter a premises depending on the current health status indicated by the portable personal device. Such checking terminals may be associated with testing terminals, or of persons carrying the symptom-free parts..

[0020] In an embodiment where such a checking terminal is associated with one or more of said testing terminals, it may be configured to grant or deny permission to enter a premises depending on a current health status indicated either by the portable personal device on the basis of a previous symptom-testing result or on the basis of a new symptom-testing result generated by the testing terminal.

[0021] In some implementations, the system may be configured to generate a communication to a health authority in the event that the symptom-testing result does not indicate symptom-free status. Such communications may be pre-authorised, or authorised by user interaction after the symptom-testing result is known.

[0022] The invention in another aspect provides a testing terminal for use in a system according to the invention as set forth above.

[0023] The invention in another aspect provides a portable personal device for use as the portable personal device in a system according to the invention as set forth above. [0024] The invention in another aspect provides a checking terminal for use in a system according to the invention as set forth above.

[0025] The invention in another aspect provides a server for registering testing terminals, checking terminals, users and portable personal devices in the implementation of a system according to the invention as set forth above.

[0026] The invention further provides one or more computer program products, comprising instructions for configuring a programmable computing device to function as a testing terminal, a checking terminal, a portable personal device features, and/or a server in a system according to the first aspect of the invention set forth above.

[0027] These and other aspects and optional features of the invention will be understood from a consideration of the description of examples that follows.

BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Embodiments of the invention will now be described, byway of example, with reference to the accompanying drawings, in which: Figure 1, 2 and 3 illustrate schematically some known technological approaches to pandemic conditions; Figure 4 illustrates schematically the operation of a system including testing terminals and portable personal devices according to an embodiment of the present invention; Figure 5 illustrates the hardware and functional structure of one example of a premises terminal usable as a testing terminal in the system of Figure 1; Figure 6 shows the external appearance of one example of a portable personal device usable in the system of Figure 1; Figure 7 shows the hardware and functional structure of the portable personal device of Figure 6; Figure 8 shows the hardware and functional structure of a server usable in the system of Figure 1; Figure 9 shows in flowchart form various operations of the personal portable device and premises terminals in the system of Figure 1; Figure 10 illustrates schematically various modes of use of the system of Figures 4 to 9; Figure 11 shows the external appearance of a second example of a portable personal device usable in the system of Figure 1 and/or in alternative embodiments of the present invention; Figure 12 shows the hardware and functional structure of the portable personal device of Figure 11; and Figure 13 shows in flowchart form various operations of the portable personal device of Figures 11 and 12 cooperating with premises terminals in the system of Figure 1 and/or alternative embodiments.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

Background

[0029] In epidemic situations, such as the present COVID-19 pandemic, authorities, communities, businesses and individuals seek to return to commercial and social life. In some territories, populations feel that national guidance is opaque, public understanding and trust remain low. Consequently, customers cannot be sure that they are safe from disease as public spaces and businesses reopen. Customers cannot be sure that they are not passing on the disease to others. Likewise, businesses and institutions cannot provide staff and customer confidence that their premises are safe to visit and to dwell in.

[0030] From past epidemics, as well as the present pandemic, it has been recognised that modern technology offers a number of solutions, but these are not always acceptable socially, commercially, culturally or politically.

[0031] Figure 1, for example illustrates a known "digital check-in system" that logs the name, national identity number and mobile telephone number of individuals visiting hotspots and venues providing essential services, as well as the information of people working at places providing essential services. In many countries, national and/or regional "track and trace" service is established by medical and community authorities, which requires information about which individuals have been in proximity with which other individuals, over the past days, and for what length of time. The digital check-in system of Figure 1 is designed to support this, and such a system has been deployed for example in Singapore. Persons entering a premises P1, P2 present their government-issued ID (for example in card or electronic form) for electronic scanning at a premises terminal. A central database on the server SVR keeps records and contact details of everyone who enters the space (ID+) and who leaves space (ID-). In this way, should an individual be identified as a carrier of the disease at a later date, the other individuals who were present in the same space at the same time can be identified and contacted for testing, isolation, and treatment if appropriate. Additionally, the entry system may regulate the number of people in the space and apply other entry rules to promote social distancing.

[0032] Figure 2 illustrates a temperature screening system using hand-held or stationary infrared thermometers. Persons wishing to enter a premises P1, P2, P3 etc. must submit to a temperature test to determine whether they have a fever. Only persons without a fever (normal temperature; 'OK') are admitted to the space. Persons with a fever (elevated temperature; 1\10K) are turned away. Suitable thermometers are readily available and implemented by any commercial premises.

[0033] The Figure 1 system by itself provides confidence that any of the visitors can be traced, should another visitor later show symptoms. It does not tell individuals that they are in a space free of the infectious disease. For use in premises open to the public, it requires a national identification system and also requires consent of individuals to storage of their personal identifies and movements. The Figure 2 system provides individuals with confidence that some level of screening has been done to reduce the risk of symptomatic persons being present in the shared space. However the quality of the screening is determined by the individual premises, and the testing of every individual becomes burdensome on vendors and public alike, in a high street or similar situation where each individual may visit several premises in a short space of time.

[0034] Temperature screening as shown in Figure 2 can be combined with a private or national check-in system, such as the one illustrated in Figure 1. This brings the combined benefits of both solutions, but also the combined disadvantages. On the other hand, neither system provides information as to the actual disease-free status of the individuals present.

[0035] Figure 3 illustrates a third known approach, based on the concept of an electronic "health passport". The system works where individuals have had a diagnostic test, for example serology (antibody) test confirming that they are no longer infectious and/or have an assumed degree of immunity. In this system, a person H wishing to hold such a passport presents their ID and a sample S to their doctor or similarly medically qualified testing authority TA. The sample S is tested by a laboratory with result R. The test result, the holder's ID, and the date of the test result are recorded in a central database SVR. Assuming the result is that the person is disease-free/immune ('OK') the passport is printed/or activated electronically on the holder's smartphone or other device. Premises P1 and P2, require the health passport of their employees and visitors, and a scanning station checks the status of the passport before the person is admitted.

[0036] The theory of such a health passport it that lasts for a substantial period, during which time the health passport allows repeated entry to one or more restricted premises P1, P2 without testing each time. On the other hand, access to the known system requires that the holders are already a population who have been subject to diagnostic testing, and who are willing to have their identities recorded in the central database. In theory, at least, the passport may last for weeks, months or years, based on some known period of immunity after a seropositive test result, or a vaccine. However, at the time of writing, confirmation of seropositivity for COVID-19 is not yet validated as an indicator of non-contagion, and vaccines do not yet exist for mass application. The system of Figure 3 may therefore be of benefit primarily for highly-controlled environments and defined populations, such as a health service workforce.

Fever-free pass: Introduction

[0037] Figure 4 illustrates schematically the operation of a system including premises terminals and portable personal devices according to an embodiment of the present invention. Premises P1 has a premises terminal 402 which includes a non-contact thermometer 404 as a symptom-testing device for measuring the temperature (fever/no fever status) of persons entering the premises. Premises terminal 402 also includes an optical reader 406 and a contactless communications device 408 for short-range wireless communication with portable personal devices. Some or all of the devices 404, 406 and 408 of the premises terminal 402 may be mounted or integrated into a fixed station. Some or all of the devices 404, 406 and 408 of the premises terminal 402 may be hand-held. The devices 404, 406 and 408 of the premises terminal 402 communicate with one another and with a local processor 410 via communication links that may be direct or indirect, wired and/or wireless.

[0038] Premises terminal 402 in this example has the functions of both a testing terminal and a checking terminal in the language of the introduction and claims. In general, the system may include premises terminals that have both testing and checking functions, premises terminals that have only testing functions and/or premises terminals that have only checking functions.

[0039] One or more human operators OPR1 may also be present, performing and/or supporting the testing and/or checking functions instead of, or in addition to, the automated functions of premises terminal 402.

[0040] Each user of the system, for example the person U in the drawing, is equipped with a portable personal device (PPD) 420 for carrying symptom test results obtained via authenticated testing terminals. For the present example, it is assumed that the portable personal device is a smart phone, adapted by an application program (app) to implement the functions of the portable personal device mentioned in the introduction and claims. As will be explained later, other forms of portable personal device such as RFID cards and fobs may be used, either within the same system or to implement a different system.

[0041] Still referring to Figure 4(a), the person U approaches the entrance of premises P1 and has their temperature measured by thermometer device 404 of the premises terminal 402. Premises terminal 402 and/or operator OPR1 indicate the result. In this example, the temperature is normal ('OK') indicating a symptom-free, specifically "fever-free" status for person U. Not only is the person allowed to enter the premises, but they also present their personal portable device 420 to the contactless communications device 408 of the premises terminal 402. The temperature test result, and/or confirmation of currently symptom-free status is transferred directly to PPD 420, along with a timestamp and details of the premises terminal. Not shown in Figure 4, but discussed further below, premises terminal 402 and other testing terminals and checking terminals are part of an authorised network of terminals, having defined standards specifications for accuracy, data security and so forth. In short, the testing results transferred to the PPD are identifiable as coming from a trusted testing terminal, at a specific time.

[0042] Although not shown in the examples, an optional feature of a checking terminal is integration with automatic barrier entry systems, such as are found at many business and institutional premises as well as public transport stations.

[0043] Referring now to Figure 4(b), at a later time in the day, person U wishes to enter a different premises P2. Temperature testing is implemented at premises P2 by another premises terminal 432, where operator OPR2 uses a hand-held non-contact thermometer 434 as necessary. However, provided the temperature measurement taken at premises P1 is recent enough, a fresh temperature measurement is not required in order to demonstrate symptom-free status and to gain entry to the premises. Premises terminal 432 again includes checking functions using one or more of an optical reader 436, contactless communication device 438 and/or simple human vision of the operator OPR2. Any or all of these means can be used to interrogate PPD 420 and determine that a symptom-free test result was obtained by a trusted testing terminal within a certain elapsed time limit. For example, the person may be deemed symptom-free so long as they have received a 'normal' temperature testing result within the past six hours.

[0044] If a temperature test indicated a high temperature (fever symptom) the customer is denied entry to the premises, and any pre-existing symptom-free status is revoked in the portable personal device. More detail of the implementation in different embodiments will be explained below. Furthermore, in the event of a fever symptom in the testing result, the PPD 420 displays a consent page asking if the person is willing to receive a call from the official contact tracing team and also undertake a diagnostic test. For example, the government in England provides an "NHS Track and Trace" service, while in Scotland, the system is known as "Test, Track, Trace, Isolate and Support" scheme (TTTIS). We shall refer below simply to these schemes and authorities as "test, track and trace" (TT&T), without regard to any differences between these systems and/or equivalent schemes in other countries.

[0045] In this way, the portable personal device 420 serves as an authenticated "symptom-free" or "fever-free" pass, that can be recognised and trusted across a wide network of participating premises. In public health terms, the system illustrated provides not only a cordon sanitaire for participating establishments but also a community-wide symptom-screening function, feeding leads into test, track and trace programmes. The system, when widely adopted, diminishes the need for social distancing rules necessary to address the COVI D-19 pandemic which radically lowers the quality of life, damages the economy and diminishes prosperity. It is also suitable for other infectious diseases epidemics.

[0046] Furthermore, the system described enables a market-driven solution to community-wide symptom-screening and simultaneously a state-of-the-art cordon sanitaire for participating businesses. For high street merchants and other in-person venue public institutions and businesses, premises terminals 402, 432 can be provided as a subscription-based quality-assured scheme where establishment staff are trained, supported and held to adhere to best-practice standards of COVID-19 related safety measures within their premises. Critically they will require and sometimes provide temperature assessment to ensure a "Fever-free Zone". This is achieved through traceable temperature assessment with the approved thermometer device.

[0047] For customers, participation is enabled by a mobile phone app which requests entry of symptoms each day and shows a pass which lasts for, for example, 6 hours. In addition to the temperature testing results, in the example embodiment, the pass will only work if answers to a symptoms questionnaire have been submitted in advance of presentation at the entry to participating premises. This pass is triggered by a 'normal' temperature assessment in a participating location and allows low-friction access to businesses and venues participating in the same scheme. Customers entering the premises, as well as those staff and customers already inside, will gain reassurance that, while the presence of asymptomatic carriers cannot be 100% excluded, everyone in the space has at least passed the temperature test. As explained below, the system may also ensure that everyone present has recently completed a symptoms questionnaire. Participating premises can attract customers, by display of a "Fever-Free Zone" emblem.

[0048] Although a "fever-free" status is described as lasting for six hours, based on judgement of risk and knowledge of the development of a particular disease, it will be understood that different time period can be set, and the time period can be updated in the system as experience and/or regulations change. Moreover, the system can be designed so that different premises can impose a different time limit, for example based on the duration for which the user is expected to dwell, and/or the particular activities provided that premises.

[0049] In addition to the above benefits, the system once widely adopted can be adapted to provide additional benefits to users and premises alike. In some jurisdictions (for example England at the time of writing), premises such as public houses are required to keep a register of names and contact details of all customers who entered in a given period. This is to allow tracing of those individuals, in the event that one of them should later be identified as a carrier or likely carrier of the disease. The system can be expanded, after obtaining user consent, so that the premises terminal and/or the server will register the ID of each customer who entered using their "fever-free" pass. The burden of maintaining the list is then reduced for the premises management. Additionally, such an implementation of avoids privacy issues that may arise from speaking or writing one's name and contact details in a public place, not to mention the risk of transferring infection while updating the register.

[0050] The pass can also be potentially be extended to store and present other forms of health status such as official notification of seropositivity Cif and when this become a validated state of non-contagion), or a vaccine (as and when this becomes available). In either of these scenarios, the system can readily be adapted to incorporate the functionality of the "health passport" system described above with reference to Figure 3.

Fever-free pass: Implementation examples [0051] Figure 5 shows the hardware and functional elements of a premises terminal 500 suitable for use as the premises terminals 402, 432 of the system of Figure 4 and/or for use in other varieties of testing terminal and/or checking terminal implementing other embodiments of the present invention. Following the same pattern of labelling as in Figure 4, premises terminal 500 includes a non-contact thermometer device 504, optical reader 506 and contactless communication device 508. Processor 512 communicates with devices 504, 506 and 508 via input/output interfaces (101, 102, 103) for such devices. Processor 512 is naturally provided with storage STO and one or more network interfaces NIF for communication with other devices, including the server, described below with reference to Figure 8. Numerous other hardware features common to data processing and communication systems are implicitly present but not shown separately, for example power supplies, real-time clock.

[0052] Processor 512 also communicates with one or more operators and administrative staff through a user input/output module U10. For example, input and output to a human operator can be provided through one or more built-in displays, or a separate display 542 such as a tablet computer. As illustrated, display 542 may in particular display test results with 'OK' or 'not OK' status, informing the operator of the symptom test results for each visitor, and optionally triggering them to allow or deny access.

[0053] Functions of the premises terminal for the purposes of the present disclosure are defined by program instructions of a premises application (PREMAPP) 550. These instructions and associated data structures are stored in the storage STO, and they configure the processor to implement the functions of the testing terminal and/or checking terminal that are described and claimed herein. Instructions may be delivered on a hardware data carrier (for example a USB memory device, not shown separately), and/or delivered over the network interface NIF. Program instructions define several modules, according to the desired functionality of the premises terminal. Example modules illustrated in Figure 5 are an administration module ADMIN a test operations module TSTOPS, a portable personal device operations module PPDOPS, a reporting module RPT and a quality assurance module QA. Implicitly present but not shown are software modules of the operating system, including basic user interface functions common to computing devices.

[0054] Depending on the scale of the operation and individual premises, and depending on existing IT infrastructure, a wide range of computing devices can be adapted for use as the premises terminal. In a simple case, a smart phone or tablet device can be adapted by downloading the premises application 550 and installing it in the same way as any other application. The operating system may be iOS or Android, for example, in which case the app could be downloadable from the appropriate app store (Google or Apple). Alternatively, implementation may be in the form of a Responsive Web application. To maximise take-up of the system across the widest range of premises, a minimal installation may even comprise such a smart phone/tablet app and a separate handheld thermometer. A symptom test result can be transferred electronically, or even by manual input from the thermometer to the premises terminal app. This may be done by the operator with the hand-held thermometer 434 in Figure 4(b), for example, entering the test result directly or indirectly to the checking terminal Provided the operator, the thermometer and the premises terminal app have appropriate certification, training and authentication individual users and other vendors can have confidence in the "fever-free" status recorded by that premises terminal.

[0055] Data structures (PREMDAT) created and/or used by the premises application 550 are indicated at 552. As part of the authorisation process with validation of temperature test results, these data structures include a registered premises identifier PID, information about the premises and its status within the fever-free scheme PINFO and any preferences set up by the premises operator PPREF. For each premises terminal there is similarly stored premises terminal identifier PTID, more information about the premises terminal with that identifier PTINFO. In this way, several terminals at the same premises can be connected via a local area network and controlled by the same processor 512.

[0056] As mentioned above, the system can be designed so that different premises can impose a different time limit, for example based on the duration for which the user is expected to dwell, and/or the particular activities provided that premises. These parameters can be recorded and controlled using these data structures. For example, a record may include formation of the minimum time remaining of the six hours, required to admit a person. Signage at the premises entrance, website etc. can alert users, for example with a message like "Minimum TWO hours Fever-Free status required for entry". Participating premises may be listed through the PPD application, so that users can check ahead what duration may be required. Instead of a remaining duration from a standard six hours, the criterion may be expressed and encoded differently, for example "Maximum FOUR hours since Fever-Free test".

[0057] Additionally, a log of activity per premises terminal and/or per premises is also stored (LOG). Precisely what goes into the log can be controlled to implement any desired privacy and/or reporting requirements. For example, aside from events relating to the administration, testing and validation of the premises terminal itself, event logs may be restricted to anonymized data, and reports may be restricted to statistical reports such as footfall, occupancy levels and the like. Identification of customers presenting themselves for entry and/or testing need not be stored, which may be important for promoting acceptance of the system. Alternatively, or in addition, anonymized records of body temperature results and/or statistics may be stored for refinement of the system and/or information of public health authorities.

[0058] It is a matter of implementation, whether all of the devices of the premises terminal are provided as a package, or whether the processor 512 is supplied merely with interfaces for coupling to suitable devices provided by the customer, or a system integrator. References in the introduction and claims to the testing terminal and checking terminal should be interpreted accordingly. It will also be appreciated that devices such as the optical reader 506 and contactless communications device 508 serve other functions as well as the "fever-free" pass function. For example, in a public transport setting, such devices may be already provided as part of a ticket barrier installation, or a pass-based access to a commercial or institutional building. Similarly, commercial premises may also include optical scanning devices, contactless payment terminals and the like. These devices can be used to provide the "fever-free" pass function, in addition to their existing uses. It is a matter of implementation whether processor 512 is also shared with other functions, which are represented, for example, as applications APP2 and APP3 in Figure 5. In that regard, it may be envisaged that the premises application 540 is installed within an existing computer device, or is formed partly by cooperation with pre-existing computer devices, so that the entire premises terminal does not have to be a stand-alone device with the associated footprint, duplication of processes and expense that that might entail. [0059] Referring now to Figure 6 and 7, one implementation of a portable personal device (PPD) 600 is illustrated, suitable for use as the device 420 in the system of Figure 4. As in the example PPD 420 of Figure 4, this device is implemented by suitable programming of a programmable portable computing device, such as a smartphone or tablet, having a touchscreen 602 within a housing 604. Shown in a large detail is an example display showing the user interface of the "fever-free" pass application. The screen provides visual confirmation of the user's identity, including for example photo 610 and for example a scheme membership number UID and other details UINFO. This photograph guards against misuse of the fever-free pass I an individual other than the one who underwent the test. Other types of identification and authentication can be used as well as or instead of a photograph, based on a range of trusted authorities. Assuming the user has a current health status that is fever-free, a prominent and colour-coded icon 612, for example a check mark on a bright green background, is displayed along with dynamic information 614, for example current time and date. Dynamic information guards against fraudulent use of, for example, screenshots saved earlier. In addition to the human readable elements 610, 612, 614, machine-readable codes 616 may also be displayed so that the pass is readable using the optical reader 506 of a premises terminal 500. These codes, which may for example be OR codes, bar codes and other custom codes, may also include dynamic elements, in a known manner.

[0060] It will be understood that, in case of an expired fever-free status, or in the worst case and actual fever test result, different icons 620, 622 will be displayed instead of the checkmark icon 612. Instead of a green background, icon 620 may be displayed with an orange or amber background, while the fever status icon 622 may be displayed on a red

background.

[0061] Additionally, the display may show (either constantly or on demand) a time remaining of the symptom-free status. This allows the user to plan their next testing terminal, for example, if they have more premises they want to visit that day or if they know they will be visiting a premises that applies a minimum time remaining as a condition of entry.

[0062] Referring to Figure 7, internal components of PPD 600 include a processor 620 and various indications and other hardware typically found in smartphone devices. Not shown but implicitly present are other hardware elements such as a battery, camera, microphone, loudspeaker, vibrator, real-time clock. Specifically shown are: the user input/output interfaces U10 for communicating with touchscreen 602, a GPS interface for satellite location services; interfaces DAT, TEL and SMS for mobile data, telephony and short messages (texts), respectively; WLAN interface WIFI; Bluetooth interface BLT for short-range wireless communication and near-field communications interface NEC. The NFC interface (also known as RFID) is the example choice for the short-range wireless communication with testing terminals, checking terminals and premises terminals generally. Of course, other types of communication interface can be used for that, including Bluetooth, or optical, sonic, haptic and the like. For example, instead of NEC connection, or as an additional option, PPD 600 could use a camera to read a digital code such as a OR code, displayed by a premises terminal 500, to receive testing results and/or other information.

[0063] Functions of the portable personal device for the purposes of the present disclosure are defined by program instructions of a PPD user application (PREMAPP) 650. These instructions and associated data structures are stored in the storage SIC associated with processor 620, and they configure the processor to implement the functions of the PPD described and claimed herein. Instructions may be delivered on a hardware data carrier (for example a USB memory device, not shown separately), and/or delivered over one of the interfaces DAT, VVIFI etc., listed above. Program instructions define several modules, according to the desired functionality of the portable personal device. Example modules illustrated in Figure 7 are a registration module REG, a pre-test questionnaire module PREQ, a test result processing module TRES, a status monitoring module SMON, a status reporting module SREP and an alert module ALRT. Implicitly present but not shown are software modules of the operating system, including basic user interface functions common to computing devices. The operating system may be iOS or Android, for example, in which case the app could be downloadable from the appropriate app store (Google or Apple). Alternatively, implementation may be in the form of a Responsive Web application. Also implicitly present are other applications APP4, APP5 as commonly found on a smartphone or similar device.

[0064] Data structures (U DAT) created and/or used by the PPD user application 650 are indicated at 652. As part of the registration process with authentication of ID and contact details, there are stored a user identifier UID, user information such as name, address, contact telephone UINFO, and user preferences UPREF, including for example privacy settings and permissions mentioned below.

[0065] Additionally, PPD user app maintains a log including historic test results and other events, and current health status and/or the information required to determine current health status. Various example entries are shown. A first entry PREQ-TIM records the completion of a morning symptoms questionnaire, with symptom-free answers, and timestamp. Later on, records show test results obtained during the day, with premises terminal identifier PTID, timestamp TIM, test result TOK, and a duration DUR of validity for the test result (for example 6 hours). The test result field TOK may record only a simple OK/NOK fever/fever-free status, and/or it may record the actual temperature measured and/or other parameters of the test. The timestamp and duration can be used by the status monitoring module SMON to monitor the validity and expiry of the fever-free status. This can be implemented in a variety of ways, for example comparing a current time against the latest timestamp plus the duration value or, alternatively, regularly decrementing the duration value towards zero.

[0066] As shown by an entry PEXP in the log, a first fever-free status expired after six hours, and subsequently on the same day a new temperature test was made at an authorised testing terminal, leading to a new record with fields PTID, TIM, TOK and DUR. On another day, a similar sequence of events is logged again with a morning symptoms questionnaire. For illustration, the final entry in the log shown represents a failed (elevated temperature) test result, with status TNOK and information STTIS indicating whether the test track and trace authorities have been notified.

[0067] It will be appreciated that these fields are only examples, and different data may be stored and/or different formats used, in a practical implementation. It should also be appreciated that, unlike other solutions such as the one shown in Figure 1, all necessary data for functioning of the system, including sensitive data about the user's health status and/or movements can be stored in the user's own device, to the extent that it is stored at all. This level of decentralisation may be expected to allow a greater take-up within populations of potential users who may otherwise be reluctant to enrol and share identifying information and health information and location tracking information with commercial service providers and/or government bodies. Optionally, some user-specific data may be logged in the "cloud" under control of the server computer of the "fever-free" pass system provider, where the user has chosen to register and maintain an account.

[0068] Figure 8 shows hardware and functional elements of a server computer for administering and coordinating the network of premises terminals and portable personal devices implementing the functionality "behind-the-scenes" of the system of Figure 4. Although a single server computer is shown, it will be understood that a network of servers and/or cloud-based computing services may be involved in the practical implementation of the functions described. Within server 600, a processor operates, with storage STO, network interfaces NIF and user input/output functions U10 for communication with operators.

[0069] Functions of the server computer 800 for the purposes of the present disclosure are defined by program instructions of a server application (SVRAPP) 850. These instructions and associated data structures are stored in the storage STO associated with processor 820, and they configure the processor to implement the functions of the server described and claimed herein. Instructions may be delivered on a hardware data carrier (for example a USB memory device, not shown separately), and/or delivered over one of the interfaces NIF. Program instructions define several modules, according to the desired functionality of the server computer. Example modules illustrated in Figure 8 are a system administration module SYSADMIN, a registration management module REGMGR and a report management module RPTMGR. The report management module RPTMGR communicates with submodules for different types of reporting, for example a public health reporting module PHRPT, a premises reporting module PREMRPT and a test, track and trace reporting module TTTRPT. Implicitly present but not shown are software modules of the operating system, including basic user interface functions common to server computers, as well as other applications, if desired.

[0070] Data structures (UDAT) created and/or used by the PPD user application 650 are indicated at 652. As part of the registration process with authentication of ID and contact details, there are stored a user identifier UID, user information such as name, address, contact telephone UINFO, and user preferences UPREF, including, for example, privacy settings and permissions mentioned below.

[0071] Data structures (PREM REG) created and/or used by the premises application 850 for the management of the authorised premises and premises terminals are indicated at 552. These data may mirror to a large extent the data 552 described above in relation to the premises terminal processor 512, but collected in a registry of all authorised premises, vendors and terminals. Thus, as illustrated, data structures include for each premises a registered premises identifier PID, information about the premises and its status within the fever-free scheme PINFO, and any preferences set up by the premises operator PPREF. For each premises terminal operated by the same premises account there is similarly stored premises terminal identifier PTID, and more information PTINFO about the individual premises terminal.

[0072] Additionally, a log of activity per premises terminal and/or per premises is also stored (LOG). Precisely what goes into the log can be controlled to implement any desired privacy and/or reporting requirements. For example, aside from events relating to the administration, testing and validation of the premises terminal itself, event logs may be restricted to anonymized data, and reports may be restricted to statistical reports such as footfall, occupancy levels and the like, which may be reported through premises reporting module PREMRPT. Identification of customers presenting themselves for entry and/or testing need not be stored, which may be important for promoting acceptance of the system. Alternatively, or in addition, anonymized records of body temperature results and/or statistics may be stored for refinement of the system and/or information of public health authorities through public health reporting module PH RPT.

[0073] Data structures (UREG) created and/or used by the server application 850 for the management of individual users and portable personal devices are indicated at 854.

These data may mirror some or all of the data stored in the individual users' portable personal devices, but collected in a registry of all users. Thus, for example there may be stored for each user a user identifier UID, user information such as name, address, contact telephone UINFO, and user preferences UPREF, including, for example, privacy settings and permissions mentioned below. There may also be stored authentication information identifying the portable personal device(s) that may be associated with the individual user, such as mobile phone number, Sim card ID, !MEI etc..

[0074] Optionally, depending on the privacy design of the entire system and/or user privacy settings, there may be stored a log of activity. The log may be limited to information essential for account management. The log may optionally record completion of daily pre-test symptom questionnaires. The log may optionally record test results in OK/NOK format, and/or actual temperatures. The log may optionally record only those test results which identify a fever condition or other abnormal health status. It may be through the server communicating with the app that the user is prompted to contact test, track, trace and isolate services, and it may be recorded whether the user consented, either in advance or after the test result, for their contact details to be forwarded to a test, track and trace team (TT&T). Even if individual test results are not stored, whether by system design or by user preference, the system may optionally be configured to keep anonymized results and statistics may be gathered in support of the reporting modules.

Operating method flowcharts [0075] Based on the example system and devices described above with reference to Figure 4 to 8, Figure 9 shows in flowchart form various activities of the portable personal device and premises terminals implementing the "fever-free" pass and "cordon sanitaire" functions. Various modules or subroutines are illustrated in separate flowcharts.

[0076] Starting with the "NEW DAY" routine, PPD 600 requires the user to answer a questionnaire about symptoms, before they can access the "fever-free" pass functionality. The SYMPTOMS Q&A step prompts the user to answer questions such as whether they feel they have an elevated temperature, whether they have a dry cough, shortness of breath, loss of smell/taste, and/or other symptoms that are known to be predictors of the COVID-19 disease (or symptoms adapted to whatever other disease may be deemed threatening in future). Only if these questions are answered in the negative (no symptoms) is the device ready for use "out and about". If any of the symptoms is positive, the user is provided with advice on self-isolation and/or seeking treatment and/or further testing for confirming or excluding COVID-19 diagnosis.

[0077] Assuming that the user is out and about with their portable personal device, they may approach premises P1 as their first entry into the "fever-free zone" system (Figure 4(a)). Processing TEST carried out under control of PPD app 650 on the portable personal device 420/600 is shown on the left-hand side of Figure 9, while processing TEST carried out under control of premises app 550 at the premises terminal 402/500 is shown in the right-hand column. The user presents themselves for testing, and the thermal scan is conducted under control of the premises app. The user presents PPD 420 to the contactless communication interface 508, with the temperature test result and timestamp transferred and received into the portable personal device. The result is logged at least in the PPD data structure 652. If the result is adverse, the user decides whether to retry after waiting period. It will be understood that persons who are actually fever-free may temporarily present with an elevated temperature, whether through exertions, hot flushes or the like. Re-presenting themselves to the thermometer after a few minutes may yield a fever-free result.

[0078] When a fever-free result is received, health status is updated in the portable personal device app, so that the "green" status and icon 612 may be displayed on demand for up to 6 hours. When a fever result is obtained and/or confirmed after retrying, a "red" status with icon 616 is logged and displayed, and the user receives advice about isolation and/or referral for testing and contact tracing. In an example embodiment, after an elevated temperature result, the user is asked whether they agree to their contact details and test result being forwarded to public health authorities to initiate a test, track, trace activity. Alternatively, the smartphone device can be set to call directly for advice.

[0079] The test result is also known in the premises terminal and may be displayed to a manual operator and/or used to control an automatic entry barrier. A fever-free result leads to entry being allowed. Optionally, subject to privacy design and registered user preferences, the entry may be logged, with or without information as to the individual and/or the test result. An elevated temperature result leads to denial of entry, optionally logging, reporting and referring, and advice to the user. Advice may include for example to wait for a few minutes, in case the temperature is only high temporarily.

[0080] Subsequently, as shown in Figure 4(b), the same user wishes to enter premises P2, while their fever-free test result is still less than six hours old. In this example, PPD app 650 includes a MONITOR process, which monitors time and changes the status to orange (icon 620) after the predetermined interval, six hours in this example. In the meantime, as shown in Figure 4(b), the same user wishes to enter premises P2, while their fever-free test result is still less than six hours old. As explained already above, a new temperature test is not required. The user approaches the premises terminal 430 and presents their PPD 420 to the contactless communication terminal and/or optical reader and/or human operator, to share the "fever-free" or "green" status. Under control of premises app 550, premises terminal 430, which may or may not have testing terminal function at all, reads the status from PPD 420. If the status is fever-free (green), entry is allowed to premises P2. Optionally a log entry is made, with or without identifying information of the user. If the status is not fever-free (for example orange or red status), entries denied. Optionally a log entry is made, with or without identifying information of the user.

[0081] Referring to Figure 10, the range of experiences enabled by the above described system is illustrated schematically. Various users equipped with their own portable personal devices present themselves for entry to premises P1, P2 and so forth. User U1 presents a smartphone-based PPD to a premises terminal for a temperature test. Fever-free status is communicated from the terminal to their PPD and they are allowed to enter.

Another user U2 has a simpler portable personal device in the form of a contactless smart card (described below). This user has previously been tested, and is within the six hour fever-free period. Information by which it can be determined that a symptom-free test result was obtained by a trusted testing terminal within the past six hours is obtained by machine reading data from PPD. Entry is allowed. A third user U3 presents themselves with a smartphone-based PPD showing the fever-free status as shown in the example of Figure 6. The "green" status and the dynamic data are read by a human operator, who also can verify the photographic ID of the user. Entry is allowed.

[0082] Meanwhile, at another premises P2, a fourth user U4 presents themselves for testing.

Unfortunately, the test result indicates they have symptoms in the form of an elevated temperature, and entry is denied. The "red"/NOK test result is communicated to the user's PPD by contactless communication. After obtaining permission of the user, communication is initiated with the test, track and trace service (TT&T). This communication may be an outgoing phone call from the user's PPD. Alternatively, it may be permission to send a notification to the TT&T service, who will in due course contact the user to progress diagnostic testing, contact tracing and so forth. The system, through the app, may direct the user to isolate in the meantime.

[0083] Figure 11 and 12 illustrate respectively the external appearance and the internal hardware and functions of the simplified portable personal device (PPD) 1100. This device is based on the common RFID and/or contactless smartcard technology. Embedded within the card is limited processing power, limited storage and an NFC interface (shown dotted in Figure 11). On the exterior of the card is some identifying information and a photograph of the user for authentication. The ticket may be similar to a public transport smart ticket or other access pass.

[0084] As shown in Figure 12, the hardware within the simplified PPD 1100 is more limited than the fully-featured smartphone version illustrated in Figure 7. Within the processor and storage of the simplified PPD, software modules TRES and SREP perform broadly the same function as in the PPD 600 of Figure 7. Within the on-board storage, an event log is stored, with similar structure and meaning to the one in the PPD 600 of Figure 7. In the case where the smartcard has no display and no continuous power, a status monitoring module SMON will most likely be omitted. In such a case, rather than calculating and updating a current health status on board the PPD 1100, the current status has to be derived by the checking terminal. The timestamp and duration from the log can be used by the checking terminal to monitor the validity and expiry of the fever-free status, by comparing a current time against the latest timestamp plus the duration value, from which it can be determined that a symptom-free test result was obtained by a trusted testing terminal within the predetermined time limit, such as six hours.

[0085] The functionality of the simplified PPD 1100 may also be adapted to other form factors, such as a fob or key, or a Bluetooth enabled device. Bluetooth interface BLT is shown dotted, for this example. PPD functionality may also be implemented in wearable devices such as smart watches, which nowadays are often equipped with NFC communications, including payment functions. While the smartcard PPD of Figure 11 has no built in display, in another example and "electronic paper/"electronic ink" display can be provided, and updated to display new information using power from the contactless communication interface NFC when PPD 1100 is presented to a testing terminal and/or checking terminal.

While the smartcard of Figure 11 has no built-in display or on-board power, another device might have a battery BATT, and a low-consumption display such as an LCD or "electronic paper"/"electronic ink" display to display information periodically updated even while the device is away from a testing terminal and/or checking terminal. These types of display are known in security and retail display occasions, can readily be adapted for use in the present system to display human-and machine-readable status information, as well as a user photograph or other ID.

[0086] As mentioned in reference to Figure 10, the simplified PPD 1100 can be used in the same system as smartphone-based PPD's 600. It provides a solution for users who for whatever reason do not have or cannot use the smart phone and app. Alternatively, the whole system may be based on simplified PPD functions, with no smartphone version. [0087] Figure 13 comprises flowcharts for various operations, similar to those in Figure 9, but adapted to the simplified PPD. For example, the "NEW DAY" module requires a symptoms questionnaire to be answered online, over the Internet, and/or for example by telephone.

After the questionnaire is completed, the PPD is enabled to be used, either by direct communication, or by information sent from the server to premises terminals. For this purpose, the simplified PPD 1100 may be supported by protocols by which the premises terminal interrogates the server as to the current status of an individual PPD.

[0088] Subsequently, the TEST functionality on the simplified PPD is limited to receiving test results and time stamps and logging them. Decisions about status are made in the premises terminal (P1) with results and status transmitted to the PPD according to the test results. As mentioned above, it is a matter of implementation whether the PPD log includes only temperature results, only OK/NOK results, or both, as well as the timestamp.

[0089] Since the simplified PPD 1100 lacks the functionality to invite and facilitate communication with TT&T services in the event of an abnormal test result (elevated temperature in the case of a fever test performed using a thermometer) the function may be provided for the user to register pre-authorisation as part of their user preference settings. If they have done so, the system may be authorised to send their contact information directly to the health authorities for follow-up testing and contact tracing.

[0090] In the case where the simplified PPD has no power source, it was mentioned above that status monitoring, including calculating expiry of a "fever-free" status will have to be performed by the checking terminals, for example premises terminal P2 at the foot of Figure 13.

Conclusion

[0091] By the above disclosure there is enabled the provision of a managed network of participating businesses with quality-assured body temperature assessment using a clinical standards-compliant infra-red thermometer Results are sent wirelessly to an app on a customer's mobile phone turning an indicator screen green so that it acts as a city-wide pass ("fever-free" pass). A countdown of six hours alerts the users when "fever-free" pass expires. during that time the verified person can visit any participating site, show their pass, and get frictionless access to a "Fever-Free Zone" indoor location.

[0092] The "fever-free" pass provides the customer with a pass for frictionless access to "fever-free" participating businesses that lasts 6 hours, and confidence that they are at the least risk of catching or spreading COVID-19 in a participating establishment. The choice of body property to be tested by a testing terminal is not limited to body temperature, but could be adapted to other symptoms that can be detected immediately in a non-invasive manner. The infrastructure, including the symptom test and the duration of any "symptom-free" health status can be adapted to new diseases, and/or new learning about the properties of COVI D-19.

[0093] The "fever-free" pass provides business owners with: a quality-assured means of providing a "fever-free" internal space for staff and customers; the ability to minimise risk to employees; an extra service to stimulate footfall of a one-time daily temperature assessment touchpoint for independent assessment and verification of body temperature; added value to customers of a compliant temperature assessment service to top up their "fever-free" pass for six hours.

[0094] By tying the right to access commercial spaces with the responsibility to have a proven normal body temperature, "fever-free" pass is an acceptable way of keeping the high street safe. Leads can be generated directly for the official test, track and trace systems, where systems currently being developed for COVID-19 (for example in Scotland and England) are only fed by medically diagnosed cases. The product creates a state of the art "Cordon Sanitaire" for a city to open up with optimum safety and offer meaningful assurances of low risk of transmission to prospective tourists. The "fever-free" pass also provides a pathway for opening up music festivals, group activities, national sporting, and other close-proximity events. With broad adoption, the fever free pass becomes an emergent crowd sourced pan-community infectious disease screening programme [0095] The above description illustrates only some examples by which the principles disclosed and claimed herein may be implemented. These examples should not be regarded as limiting on the scope of the claims. Various modifications and variations are possible, including but not limited to the ones mentioned above. Accordingly, the scope of protection is defined only by the appended claims, with due account being taken of equivalents.

Claims (20)

1. CLAIMS1. A system for use in testing and verifying symptom-free status of individuals and premises, the system comprising one or more testing terminals and a plurality of portable personal devices, each testing terminal comprising: at least one symptom-testing device for testing a user who presents themself to the testing terminal to obtain a new symptom-testing result; and at least one short-range wireless communication device for transferring the new symptom test result securely to the user's portable personal device together with authentication information identifying the symptom-testing result as originating from a trusted testing terminal, each portable personal device comprising a data storage and processing device adapted for communication with the short-range wireless communication device of the testing terminal, and being configured: to authenticate the identity of the user; (ii) to receive via short-range wireless communication from the testing terminal authentication information together with a new symptom-testing result for the user; (iii) at a later time to indicate in human-and/or machine-readable form information by which it can be determined that a symptom-free test result was obtained with a certain recency by a trusted testing terminal.
2. 2. A system as claimed in claim 1 wherein the portable personal device is configured to maintain a current health status for the user that is dependent on the symptom-testing result received from the testing terminal and on time elapsed since receipt of the symptom-testing result, the current health status indicator indicating a symptom-free status for a predetermined period of time after receiving a new testing result indicating an initial symptom-free status, said current health status indicator being at least part of the information provided at said later time.
3. 3. A system as claimed in claim 2 wherein said initial symptom-free health status is determined by the testing terminal on the basis of the new symptom-testing result.
4. 4. A system as claimed claim 2 or 3 wherein said initial symptom-free health status is determined by the portable personal device on the basis of the received symptom-testing result.
5. 5. A system as claimed in any of claims 2 to 4 wherein the portable personal device is configured to display said information at said later time via a display included in the portable personal device.
6. 6. A system as claimed in claim 5 wherein the display of said information includes said information in machine-readable forrn.
7. 7. A system as claimed in any of claims 2 to 6 wherein said certain recency allows an elapsed time greater than or equal to two hours, optionally greater than or equal to four hours or five hours.
8. 8. A system as claimed in any of claims 2 to 7 wherein said certain recency requires an elapsed time is less than or equal to twenty-four hours, optionally less than or equal to twelve hours or ten hours or eight hours or seven hours.
9. 9. A system as claimed in any of claims 2 to 8 wherein the portable personal device is configured to indicate said current health status on a display.
10. 10. A system as claimed in any preceding claim wherein the portable personal device configured to indicate at said later time both the received test result and a fimestamp of the received test result.
11. 11. A system as claimed in any preceding claim wherein said symptom-testing device is a non-contact thermometer.
12. 12. A system as claimed in claim 10 wherein a fever-free status as an initial symptom-free health status is determined automatically by the testing device and/or portable personal device on the basis of the new symptom-testing result indicating a normal body temperature.
13. 13. A system as claimed in any preceding claim wherein the portable personal device is a personal communication device such as a smartphone, the personal communication device being configured by an installed application program to implement the features (i), (ii) and (iii).
14. 14. A system as claimed in any preceding claim wherein the portable personal device is configured to indicate said current health status by short-range wireless communication with a checking terminal.
15. 15. A system as claimed in any preceding claim wherein the portable personal device is a smartcard, fob or token, the indication of current health status being read by a checking terminal by short-range wireless communication with a checking terminal.
16. 16. A system as claimed in any preceding claim wherein the portable personal device is further configured to present user authentication information when indicating current health status.
17. 17. The system as claimed in any preceding claim wherein the portable personal device is configured only to accept symptom-testing results from the testing terminal if the user has completed to a symptoms questionnaire in the system sufficiently recently (for example earlier the same day).
18. 18. A system as claimed in any preceding claim further comprising one or more checking terminals configured to read the indication of current health status of a user from the user's portable personal device and to grant or deny permission to enter a premises depending on the current health status indicated by the portable personal device.
19. 19. A system as claimed in claim 18 wherein said checking terminal is associated with one or more of said testing terminals, and is configured to grant or deny permission to enter a premises depending on a current health status indicated either by the portable personal device on the basis of a previous symptom-testing result or on the basis of a new symptom-testing result generated by the testing terminal.
20. 20. A system as claimed in any preceding claim wherein the system is configured to generate a communication to a health authority in the event that the symptom-testing result does not indicate symptom-free status.