For Clinical Teams
What this tool records, how a patient uses it, and what it deliberately does not do.
YourTubie Passport is a self-management tool for people living with artificial nutrition at home, enteral tube feeding and parenteral nutrition. It gives a person one place to keep their feed regime, their line and tube care, their observations, their stock and their emergency information, and one card to hand to a clinician who has never met them before.
It is built and maintained by a long-term patient, and is in daily use by its author. It is not a commercial product, and it is not a clinical system.
Both of these are the same material in print form, if that is easier to pass round or bring to a meeting.
The second one is written for someone new to tube feeding rather than for a clinician. It walks through the demonstration site screen by screen, so it is worth passing on to a patient who might find the tool useful.
Why it exists
People on home artificial nutrition carry a large amount of information that no single record holds in one place: which feed, at what rate, over how many hours; which line, inserted when, changed how often; which lock, which antibiotic, which organism last time; who to ring out of hours. Most of it lives in a person's head, in a folder, or across systems that do not talk to each other.
That works until the moment it matters most: an unplanned admission, an out-of-hours call, a clinician who has not met the patient before. At that point the person who knows the regime best is the patient, and they are often the least able to explain it.
This was built after exactly that experience. Almost every feature exists because of a specific gap: a question that could not be answered quickly, a history nobody could see, a number that could not be produced. Where something looks oddly specific, that is why.
How a person actually uses it
The tool is organised around what someone has to do, not around what is easy to store. In practice a week looks like this.
Setting up, once
They fill in their passport: name, date of birth, NHS number, diagnosis, nutrition type, line or tube and which side, allergies, emergency contact, GP, nutrition nurse, homecare pharmacy and delivery company. Then their feed prescription: feed, pump, rate, duration, bag size, and the energy and protein per bag. Their care team's contact details go in once, and their regular medicines.
This is the slow part, and it is done once. Everything afterwards is quick.
Every night, when the feed goes up
They open the feed companion, start the bag, and the app tracks it running: time elapsed, volume delivered, time remaining. If the pump alarms and the feed is stopped early, that gets recorded as what was actually delivered rather than what was prescribed. Consumables used for the connection are deducted from their stock automatically as they connect and disconnect.
Through the day, in seconds at a time
Weight, temperature, fluids and mood go in when they are taken. If they manage any food or drink by mouth, it goes in the food diary with how much they actually managed and how they were afterwards. If they do their line care, the site condition is logged. None of these take more than a few taps, which is the point, a form that takes five minutes does not get filled in on a bad day.
When something goes wrong
A line infection, an admission, a blockage: recorded as a complication, with the organism if it is identified, the treatment, and the outcome, including being discharged to self-care at home. Over years this becomes the line history that nobody else holds in one sequence.
At an appointment, or in an emergency
They open the emergency card: one screen with nutrition type, access, allergies and contacts, led by a catheter-related bloodstream infection warning telling a treating clinician to stop the infusion and not use the line if the patient is febrile. It prints to a single page. For a planned handover there is an SBAR summary generated from what is already recorded.
Where it helps
Where feeding is temporary
Someone tube-fed for a defined period is usually learning an unfamiliar routine while unwell. The value is structure while that learning happens: somewhere to keep the regime, a prompt when a device change is due, a record of what was tolerated as oral intake is reintroduced, and an emergency card for the stretch where they are managing at home but not yet confident. When feeding stops, the record remains.
Where feeding is long-term or permanent
Someone years into home parenteral nutrition has the opposite problem: they know their regime intimately, and no system holds that knowledge in a form anyone else can read quickly. The value is continuity and evidence. Every lock, organism and complication in sequence; weight and bloods trended over years rather than between appointments; a tolerance record built from hundreds of small observations.
For the clinical team
This is deliberately not a shared clinical system and does not try to be a record the service is accountable for. What it offers is a better-prepared patient: someone who arrives with their regime, history and questions already assembled, and who can hand a treating clinician a legible summary in an emergency. Anything from it that belongs in the clinical record still has to be entered there by the team, exactly as it would be from any patient-held diary.
What it deliberately is not
- It does not give medical advice. It calculates nothing clinical, recommends no treatment and adjusts no regime. Every page carries a disclaimer directing the person to their nutrition team, and to 999 in an emergency.
- It is not a medical device as it stands, precisely because it does not interpret data or drive a clinical decision. If it were extended to do so, flagging a result as abnormal, suggesting a rate change, that would likely change, and would need proper assessment first.
- It is not monitored. Nobody is watching the data. Someone entering a worrying observation must still contact their team.
- It is not affiliated with the NHS, any manufacturer, pharmaceutical company or homecare provider.
How information is protected
- Registration is invite-only. There is no open sign-up. Invitations are single-use, expire after 14 days, and bind to the email address they were issued to.
- Clinical content is never visible to an administrator. The admin area shows account-level information and record counts only, how many entries exist, never what is in them. You can confirm this yourself with the administrator sign-in above.
- Every record is scoped to its owner at the point it is read, changed or deleted, so one account cannot reach another's data.
- Traffic is encrypted, session cookies are restricted, and every state-changing action is protected against cross-site request forgery.
- No tracking or advertising. A single session cookie to keep the person signed in, and no third-party analytics.
- Peer support is moderated, with reporting, blocking and published community guidelines.
If it were used more widely
There are two realistic routes, and they place responsibility very differently.
Option A: hosted independently, to NHS information-governance standards
The author continues to host and maintain it, brought up to the standard expected of anyone holding patient data.
| Requirement | What it involves | Indicative cost |
|---|---|---|
| Dedicated UK hosting | Its own server in a UK data centre holding this application and nothing else, with encryption in transit and at rest, key-only administrative access, firewalling, monitoring and nightly encrypted off-site backups. | ~£12-15 / month |
| ICO registration | Data-protection fee, payable once per organisation rather than per application. | ~£40-60 / year |
| Data Protection Impact Assessment | Formally required for health data. Groundwork prepared in-house, then reviewed and signed off by a qualified data-protection professional. | ~£300-800 once |
| Data Security & Protection Toolkit | NHS self-assessment, renewed annually. | Free |
| Processing agreement, privacy notice, retention policy | Agreement signed with the hosting provider; published privacy notice; a defined position on how long data is kept and how someone exports or deletes theirs. | — |
Indicatively around £700-1,200 in the first year and £350-400 a year thereafter, mostly the server and the ICO fee. Development and maintenance are not charged.
The limit of what can be self-certified
The technical work: hardening, encryption, backups, isolation, access control can be done in-house, and the impact assessment and toolkit groundwork can be drafted in-house. Compliance itself cannot be self-certified. A qualified data-protection professional needs to review the assessment and confirm the position before any patient data beyond the author's own is held. That review is the one step that cannot be substituted.
It is also worth stating plainly that opening the tool to other patients would bring UK GDPR duties immediately, independently of anything the NHS asks for.
Option B, handed over to the trust
The alternative is to give the tool to the service outright: source code, database structure, deployment instructions and documentation, for the trust to host on its own infrastructure.
From a governance point of view this is the cleaner option, and in most cases the more realistic one. The application then sits inside an existing information-governance framework, under an existing data protection officer, on infrastructure already assured, with an existing route for incidents and subject-access requests. None of that has to be rebuilt, and the liability sits where the accountability already sits.
The practical requirements are modest: a standard PHP and MySQL application with no unusual dependencies, which will run on ordinary web hosting. Support during a handover, and any adjustments the service wanted first, would be provided without charge.
A suggested next step
Rather than choosing between those now, the most useful next step would be to look at the tool as it stands: particularly the emergency card, the line history and the food diary, and say whether the information it captures is the information the service would actually want a patient to bring. That answer shapes everything else, and costs nothing to establish.
Costs quoted are indicative at July 2026 and are not a quotation. Nothing on this page constitutes legal, regulatory or data-protection advice.