The situation
A nursing home holds a unique legal and moral position: it is simultaneously someone's workplace, someone's business, and, for dozens of people, their home. Into its front door every day come family members, friends, contractors, healthcare visitors and regulators. The question the home must always be able to answer is not complicated, but it is absolute: who is in the building, right now, and can you prove it after the fact.
Like most of the sector, Crossways answered that question with a paper visitor book. A paper book is familiar, requires no training and costs nothing. It is also slow, incomplete on busy days, difficult to search, and it degrades. Ink fades, pages tear, handwriting is misread. When the question arrives in its hardest form, at speed, under pressure, on a specific afternoon three weeks ago, the paper book answers with silence.
This is not an administrative gap. In a nursing home setting, an accurate record of who is on site touches safeguarding, touches regulatory inspection under the Care Quality Commission, and touches every family's basic expectation that the building their mother lives in knows who is walking its corridors. The visitor record is infrastructure. It was being kept on stationery.
Through Evuve, my design and technology studio, I designed and built Crossways' visitor management system: a digital sign-in flow, a live register of everyone in the building, and a permanent, inspection-ready record. This is the study of how it was built and why every part of it is the shape it is.
The constraints
Three populations had to be served simultaneously, and each one constrains the design differently.
Staff on shift are time-poor and interruption-rich. Any system that adds seconds to a busy afternoon will be quietly defeated by the people it is meant to help. Their constraint is speed.
Visitors are often arriving in an emotional moment. A family member visiting a relative in declining health is not in a frame of mind to enjoy software. Many visitors are older, and some are not confident with technology at all. Their constraint is dignity and simplicity.
The person doing the audit, whether internal or from the regulator, cares about only one thing: an unbroken, trustworthy record. Their constraint is integrity.
And around all three sits the legal frame: safeguarding expectations, the CQC inspection regime, and data protection under GDPR, which in a nursing home setting is not an abstraction. Records contain names of visitors linked to residents. The data design had to be as rigorous as the interface was gentle.
Discovery
The work began at the front desk, not the whiteboard. I needed to see the real choreography: how a visitor actually arrives, who greets them, what the staff member's hands are doing while they greet them, and exactly when and where the record was made. The pattern that emerged was the pattern the paper book had taught the building. The record was an afterthought, completed after the human moment, often by memory.
That observation set the entire design thesis: the system had to move the record into the arrival itself, so that the act of recording is the act of welcoming, not a second task stacked on top of it. If signing in feels like a form, people will treat it like one.
The decisions, and what was rejected
The record must be made at the point of arrival, not after. Everything else follows from this. A record reconstructed later is not a record; it is a recollection. Rejected: keeping a simple log sheet filled in at the end of visiting hours, which would have been cheaper to build and worthless under pressure.
The live register is the product; the sign-in flow is just its front door. The real deliverable is the answer to "who is in the building right now", always current, always on screen where staff can see it without asking. Rejected: a report-based system that stores sign-ins and lets staff generate a list when needed. A report answers yesterday's question. A register answers the one that matters.
The permanent record must be designed for the worst day, not the average one. Inspection records are read rarely, under scrutiny, by someone who does not work in the building. So the record view was designed as a first-class surface, not a database export. Rejected: "it's all in the system, we'll find it if we need it", which is what the paper book already said.
Visitors sign in on a device that belongs at a reception, not in an office. A wall-mounted tablet at the desk keeps the arrival human: the staff member stays present, the visitor stays greeted, the system stays out of the way. Rejected: a staff-typed system where visitors dictate their details at the counter, which rebuilds the queue the paper book created, and a bring-your-own-phone QR approach, which fails the older visitor completely.
The interface must be usable by someone who has never seen it before, in an emotional moment, without help. That is the actual usability bar in a nursing home. Every screen was tested against it: large targets, plain language, one decision per screen, no jargon, no accounts, no app.
Data protection by minimisation. The system holds what the duty of record requires and nothing else. Every field had to justify itself against three questions: does safeguarding need it, does inspection need it, does the care of residents need it. Anything that failed all three was cut at the schema, not hidden in a settings screen.
The process
First, the arrival was mapped end to end: the moment of entry, the greeting, the recording, the notification that the person has arrived and is at the desk, the visit itself, and the departure. Each step was examined for one thing: where does this break when the afternoon is busy. Those breakpoints were designed against first.
Then the data model: who a visitor is in this system, how visits relate to residents, how the register is composed, and how the permanent record is structured so that inspection queries resolve directly, without interpretation.
Then the interface, drawn last, once the structure underneath could carry it. Sign-in was reduced to the shortest honest path. The register view was designed to be legible from a metre away, because the staff member reading it will usually be mid-task.
Then the record architecture: complete, ordered, unambiguous, and boring to read in the best way, because on the day it is needed there will be no patience for cleverness.
Then it went to the front desk, where all software meets reality, and the friction that survived the design had to be worked out by watching, not assuming.
Craft details
Three interface decisions carry most of the weight. The sign-in flow asks for identity in the order a human would give it, so the visitor never feels processed. The live register is a single, flat, chronological truth: nobody on the team has to assemble it, so nobody can assemble it wrongly. And the inspection view reads like a document, because its audience reads documents.
Underneath, the system decisions are the same ones that hold up any building: one source of truth for presence, records that are append-only in spirit, and a separation between the live state, which is fast and disposable, and the permanent record, which is neither.
The outcome, stated honestly
Crossways now has a visitor system with digital sign-in, a live register of everyone in the building, and permanent records that stand up to inspection. Staff at the desk are faster on the busiest days than the paper book ever allowed, because the record makes itself while they greet. Visitors sign in without help. The audit question has an answer that takes seconds.
The numbers, from the system's own records between launch in October 2025 and November 2026: more than 630 visits logged, every one closed with a recorded check-out, with a scheduled automatic check-out catching visitors who leave without signing out. Visitors are offered an optional rating at check-out; 104 have left one, averaging 4.9 out of 5, and 94% gave five stars.
What I would measure next: the time from arrival to a completed sign-in, and the share of visits closed by the visitor rather than the automatic check-out, which shows whether the departure step is working.
Beyond the numbers, the failure mode of the paper record, the silent gap between who was present and who was written down, has been designed out of the building. That was the work.
What the work taught
Systems that protect people fail in the gap between the human moment and the administrative one. You cannot close that gap by demanding better compliance from tired people. You close it by moving the record into the moment itself, so that the kind thing and the correct thing become the same action. That principle now shapes everything the studio builds: never design the record around the paperwork. Design the arrival so the paperwork designs itself.