Feature

The menu is cross-checked against every resident's record before anyone sits down

Monday, 11:30. The kitchen publishes the lunch menu in the dashboard: pumpkin soup, hake in sauce and crème caramel. When it set up the dishes it had marked fish on the hake and milk and egg on the crème caramel. The moment it publishes, Bedel cross-checks those dishes against the records: every affected resident gets a WhatsApp saying today's lunch menu contains allergens on their record, with the alarm icon in front if their allergy is severe, and the kitchen sees on its screen who it is, which room, what severity and in which dish.

What the kitchen does or a resident writes, and what happens next

What the team does or the resident writes	What Bedel does
The kitchen sets up a dish in the dashboard and marks its allergens	It saves it with the mandatory allergens it has marked, out of the EU's 14, plus any extras the centre uses: lactose separately, vegan, halal. It does not work them out from the dish's name
The team adds an allergy to a resident's record	With its severity (severe, moderate, intolerance or preference), who has confirmed it and a note that is stored encrypted
The kitchen publishes the lunch menu	It cross-checks each dish against the records and warns each person affected on WhatsApp that today's lunch menu contains allergens on their record; if the allergy is severe, with the alarm icon. If it is published again within 6 hours, the warning is not repeated
The resident has a verified family member who has given consent	The family member gets a template saying that the menu for that service contains an allergen on their son's or daughter's record, and that if they need an alternative they can reply there
"I'm coeliac"	It goes on her record as self-declared, the kitchen gets the notice and can confirm it. If she names an allergen that is not on the list, such as kiwi, the kitchen is told anyway, as text
"What's for lunch today? I'm allergic to shellfish"	It replies with the published dishes and says which ones he should not eat. For a severe or moderate allergy, it always asks him to confirm with the kitchen before eating
"I'm allergic to nuts and my tongue is swelling up"	It does not save a record or reply with a calm acknowledgement: the message is treated as an emergency and goes to the team

Each resident's record

Each resident has an allergen record with what they cannot or will not eat and how serious it is. The team fills it in from the dashboard or the resident does it on WhatsApp, and the kitchen knows on every line where the information comes from, so it can confirm it.

Severity in four grades: severe allergy, moderate allergy, intolerance and preference.
Who confirms it: the resident, the family, a medical certificate or the team.
What is self-declared on WhatsApp never lowers what was already there: a record confirmed by the team or by a certificate is not overwritten, and severity does not go down because of a message.
The record's notes, which is where clinical detail usually goes, are stored encrypted.

The cross-check when the menu is published

The warning does not depend on anyone remembering. The kitchen labels each dish once, by hand, with the 14 allergens of Regulation (EU) No 1169/2011 and the centre's extras; when it publishes the menu for a service, Bedel cross-checks it against every record and writes to each affected resident.

The warning goes out even if the resident's 24-hour window is closed, as a template.
A severe allergy gets the alarm icon in front.
If the menu is for today, it suggests writing "menú hoy" (today's menu) to find out which dishes they can eat; if it is for another day, to ask.
If the kitchen taps "Publish" again within 6 hours, the warning is not repeated; after that, it is, because the menu may have changed.

The family, only if verified and with consent

An allergen warning to the mother or father of an adult resident cannot go out just because. It goes only to a verified family member, one the resident has confirmed with a button or, if they did not answer within 48 hours, one the team has approved, and who has also given consent to receive these warnings.

It arrives as a WhatsApp template, also outside the 24-hour window.
It gives the service and the day, and says the menu contains an allergen on their relative's record; it gives no further health information.
If the family replies asking for an alternative, the conversation continues on the same number.
How a family member is verified and what they are told, in family communication.

The kitchen screen and what Bedel replies

Whoever is standing at the stove needs names, not counts. The kitchen screen in the dashboard shows, for today's menu, each affected resident with their room, their severity and the dish containing the allergen. And when someone asks on WhatsApp, Bedel replies with the published dishes, without inventing any.

It says which dishes someone with allergies on their record should not eat.
It never states that a dish is safe: the allergens it sees are the ones the kitchen has labelled, and they may be incomplete.
For a severe or moderate allergy, it always asks them to confirm with the kitchen before eating, even if the dish is not listed with their allergen.
It does not talk about traces or cross-contamination; if a day's menu has not been published, it says so.

Health data: switched off until the centre signs

An allergy is health data, a special category under the GDPR, and each resident's consent is collected by the centre, not by Bedel. That is why allergen records come switched off: until the centre declares in writing that it takes on that consent, the database rejects any health data.

The switch is not just another tick box: turning it on stores the centre's declaration, as clause 5 bis of the data processing agreement requires.
The gate is in the database itself, so no path, whether the dashboard, the Excel file or WhatsApp, can get round it.
The record's notes are encrypted with AES-256-GCM; the allergen and the severity are not, because the menu cross-check runs on them, and they are protected by role-based access.
The right to erasure also deletes allergen records.

What it does not do

The warning to the resident does not say which allergen or which dish: it says the menu contains allergens on their record and invites them to ask.
It does not detect allergens from the dish's name: if the kitchen does not mark egg on the omelette, Bedel does not know.
It does not send the kitchen a daily allergen summary: the kitchen sees it on its screen in the dashboard.
It does not talk about traces or cross-contamination, and never says a dish is safe: that belongs to the kitchen.

Frequently asked questions

Which allergens does it recognise?

The 14 mandatory ones in Regulation (EU) No 1169/2011: gluten, crustaceans, egg, fish, peanuts, soya, milk, tree nuts, celery, mustard, sesame, sulphites, lupin and molluscs. The centre can add extras, such as lactose separately or labels such as vegan or halal. Bedel does not infer them from anything: the kitchen marks them on each dish when it sets it up.

Does the warning reach a resident who has not written for days?

Yes. WhatsApp only lets the centre send ordinary messages within the 24 hours after the person's last message; outside that window, the allergen warning goes out as an approved template. It is triggered when the kitchen publishes the menu, not when the resident writes, so it does not depend on them having asked about food that day.

Is the family warned too?

Only a family member who is verified and has given consent. Verified means the resident has confirmed with a button that this person is who they say they are or, if they did not answer within 48 hours, that the team has approved it. The warning gives the service and the day and says the menu contains an allergen on the record, with no further health information.

Can a resident declare their allergies on WhatsApp?

Yes. If she writes "I'm coeliac" or "I'm allergic to nuts", it goes on her record as self-declared and the kitchen gets the notice to confirm it. A message like that never lowers a severity that was already there and never overwrites a record confirmed by the team or by a medical certificate. If she also describes a reaction in progress, it is not filed away: it is treated as an emergency.

Who is responsible if a dish was labelled wrongly?

Whoever serves the food. Allergen information is provided by the centre or whoever runs its kitchen, under Regulation (EU) No 1169/2011 and, for food served without packaging, Spanish Royal Decree 126/2015. Bedel works with what the kitchen labels, never says a dish is safe and, for a severe or moderate allergy, always asks the person to confirm with the kitchen before eating.

How is this data protected?

It comes switched off: until the centre signs that it takes on each resident's consent, the database does not accept any health data. The record's notes are stored encrypted, access is by role and the right to erasure deletes them along with the rest of the person's data. The detail is in clause 5 bis of the data processing agreement.

Related features

For each type of centre

Features →