Gating a dive course on the medical form, not on trust

What does bindro actually enforce before it takes money?

Three things, and it is worth being precise about which three, because the difference between them is where centres get caught out. bindro enforces that the medical questionnaire has been answered, that the liability waiver and the medical fitness declaration have been accepted, and that the signed RSTC statement has been uploaded. All of that is checked on the money path itself, not in the browser, so a booking that skips any of it is refused with the missing field named and no order behind it.

It also enforces the age floor. A date of birth below ten is refused when the booking is made, with the rule named, and a date it cannot read is refused too rather than waved through — a rule that garbage bypasses is not a rule.

What it does not enforce is the MONEY consequence of an answer. A diver who ticks "Heart or circulatory condition" still reaches payment: what their answer raises is a physician-clearance requirement, and that requirement is enforced at the door rather than at the till. So the booking completes and the dive does not, until somebody at your centre signs the clearance off. If you need the money to wait as well, that is application review, in the next section.

How do I make sure nobody pays before I have read their form?

Turn on application review for the course. With it on, a booking does not create an order at all: it files an application, the diver is told it is with you, and their place is held while you decide. No payment intent is created, which is a stronger guarantee than an unpaid order — there is nothing to capture, so there is no sequence of events that charges them by accident.

The approvals page in the console lists what is waiting, with the submitted answers alongside each application and a link that opens the uploaded RSTC statement. Reading the document is the point: a countersignature is a signature you have to look at.

Approving emails the diver a link to pay, and only then does the checkout reach payment. Rejecting releases the place back on sale, tells them, and scrubs what they submitted rather than leaving a rejected diver’s health answers sitting in your queue.

• Application review is per event, so a discover-scuba session can sell instantly while the Open Water course beside it waits for a human.
• The queue needs order-write, so a divemaster on door duty cannot open it.
• An application that is left too long expires and returns the place to sale rather than holding it forever.

What happens when a diver declares a condition?

A requirement is raised against that diver, by the platform, as the booking confirms. Any answer that declares a condition does it — including an answer the option list has never seen, because the config names the benign answers rather than the concerning ones, so a question added to the questionnaire later needs clearance by default instead of being waved through until somebody remembers to list it.

The consequence is at the boat. Until somebody at your centre signs it off, check-in refuses that diver and they are not on the roster a device syncs for the day, so a volunteer offline cannot admit them either. The refusal says "physician clearance outstanding" and stops there: it names the requirement, never the condition.

You clear it from the console, on the Physician clearance list beside your approvals: the diver, the course, the declaration that was asked and how long they have been waiting, with one action to record that you hold the countersigned form. bindro does not print what they declared on that screen — the answer is health data and the sign-off is your judgement, not a form the platform grades.

• The clearance is raised on the money path, in the same transaction as the booking, so a paid diver and an unsigned requirement can never disagree.
• It gates the door, not the payment. Use application review as well where the money must wait for a human too.
• Signing it off is a deliberate act by somebody with order-write — a divemaster on door duty cannot lift it from the door screen.

What will bindro never decide for me?

Fitness to dive, in every form. bindro does not evaluate a medical answer, does not decide whether a countersignature is adequate and does not know what your insurer requires. The one rule it applies is "this declaration needs a physician’s countersignature", which is a routing decision and not a clinical one — it never becomes "this diver is fit". The assistant configured for this vertical is instructed to escalate every medical question to a human without exception, for the same reason.

It also decides nothing about certification. No agency is integrated: no eLearning code is bought or issued, no PIC is submitted, no card is produced. The completion certificate bindro can print carries hours and a serial from an attendance record you generated, and calling it a qualification would be false.

Say both of those out loud in your own conditions. A diver who believed the booking system had cleared them medically is a diver who has been misled by the gap between two systems, and the gap is easy to close with a sentence.

How long do the answers and the signature survive?

Differently, and this is the sharpest edge in the whole vertical. The signed acceptance record — who signed, the exact wording shown, a digest of that wording, the retention period — is written inside the same transaction as the payment and keeps a seven-year retention, matching the limitation period the requirement was written for.

The answers themselves do not. Every diver record in this vertical is classed as health data, and the retention sweep anonymises health-classed records twelve months after that diver’s last session: the identity and the answers go, and the booking, the money and the attendance count stay for reconciliation.

So a year after a diver last dived with you, bindro can prove they signed and cannot show you what they answered. If your insurer expects the questionnaire itself years later, export it while it is live and keep your own copy.

What should go into my own procedure?

Write down which half is the software’s and which half is yours, because the expensive failures live at the join. The software guarantees the form was completed and the money waited; your staff guarantee that somebody competent read it.

Name the person who works the approvals queue and how quickly, because a held place expires and a diver waiting on a decision will phone somebody. Name the person who works the clearance list too, and what they do with a countersigned form when it arrives — the platform raises the requirement and holds the door, and everything between those two is yours. Name who exports the medical answers you need to keep, and when.