Support / Administrator guide

Administrator guide

For IT staff and whoever looks after Lulu on your organization's computers. Version 1.0. This guide holds no student information.

Lulu is an athletic training records app. It runs on macOS 12 or later (Apple silicon and Intel) and Windows 10 or 11 (64-bit), with an iPhone companion that pairs with the Mac app (coming soon). Records stay on each computer, encrypted. Lulu has no server and no accounts, and it makes no internet connections.

---

1. What gets installed

Prerequisites:

• Windows needs the Microsoft Edge WebView2 Runtime. It's part of Windows 11 and of current Windows 10. The installer checks for it and never downloads anything.
• Windows Hello must be set up for each user (a PIN is enough).

2. Downloads and checking them

Every release comes with SHA256SUMS.txt. Check a download before installing it:

• macOS: shasum -a 256 "Lulu EMR 1.0.0 (Mac) UNSIGNED.dmg"
• Windows: certutil -hashfile "Lulu EMR 1.0.0 (Windows) Setup UNSIGNED.exe" SHA256

Code signing. Lulu EMR 1.0.0 isn't code-signed yet, which is why its file names say UNSIGNED. The first time it opens, macOS says it can't check it for malicious software, and Windows shows "Windows protected your PC". The download page explains how to open it anyway, and you only have to do it once per computer. Later releases will be signed with the publisher's Apple Developer ID and notarized (macOS) and Authenticode-signed (Windows), so they'll open without a warning. Either way, check the SHA-256 checksums.

3. Installing

macOS

• .dmg: open it and drag Lulu to Applications.
• .pkg: double-click it. It shows the license and installs to /Applications.
• Silent, for MDM (Jamf, Kandji, Intune): sudo installer -pkg "Lulu EMR 1.0.0 (Mac) UNSIGNED.pkg" -target /. The package ID is app.lulu.desktop.pkg.
• First launch: each user sets up their own encrypted records with Touch ID or their Mac password, and chooses a recovery passphrase. Keep it somewhere safe and separate from the Mac.

Windows

• Interactive: run Lulu EMR 1.0.0 (Windows) Setup UNSIGNED.exe.
• Per user, silent: "Lulu EMR 1.0.0 (Windows) Setup UNSIGNED.exe" /S
• All users (administrator), silent: "Lulu EMR 1.0.0 (Windows) Setup UNSIGNED.exe" /ALLUSERS /S
• Intune: package the Setup .exe as a Win32 app.
  • Install command: … /ALLUSERS /S.
  • Uninstall command: "C:\Program Files\Lulu\Uninstall Lulu EMR.exe" /ALLUSERS /S.
  • Detection: the uninstall registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\app.lulu.desktop.
• First launch: each user sets up their records with Windows Hello and a recovery passphrase.

License keys

• One key per computer. A Group license covers 4 computers and up to 4 athletic trainers; an Individual license covers 1 of each. Each computer needs its own key, made for that computer's code: a one-way code (XXXXX-XXXXX) derived from the Mac's hardware UUID or Windows' MachineGuid.
• Activation. The first time Lulu EMR opens, it shows the license screen with the computer's code. On the website's Activate page (from any device), enter the code and the email address used to pay, then paste the key into Lulu EMR. Purchases are recorded the moment PayPal confirms the payment. Purchase-order customers email the codes and receive keys by email.
• Offline. Lulu EMR itself never contacts a server. Keys are checked on the computer against the publisher's signature and the computer's code, and no firewall exception is needed. Keys never expire, and each covers every release of its major version (for example, every 1.x release).
• Before a key is entered, the license screen allows only the demo (made-up records) and an encrypted export of existing records. Records are never deleted or withheld. Phone Sync pauses until the Mac is licensed.
• Mass deployment. Install with the .pkg or the setup program as usual, then activate each computer once with its code.
• Replaced computers. A new computer has a new code. If all of a license's keys are in use, the publisher moves a key to the new computer on request.

4. Backups

Lulu makes local encrypted backups automatically, in its data folder under Backups\:

• Daily: one per day the app is used; the newest 60 are kept.
• Before-Changes: taken before every restore, merge or upgrade; the newest 40 are kept.
• Manual: made with Back up now; the newest 30 are kept.

A backup is never overwritten, and each one is read back and checked when it's written.

Off-site copy (recommended): Settings → OneDrive Backup.

• Lulu writes encrypted, versioned backups into a folder the user picks inside the OneDrive folder. Microsoft's OneDrive app uploads them; Lulu itself never connects to Microsoft.
• The backups open only with the backup passphrase or the printed recovery key. Neither is stored anywhere.
• The folder holds records only: encrypted backups, encrypted documents, the encrypted key file and a plain-text READ ME. Lulu never puts a copy of itself (app, installer or viewer) in OneDrive. The read-only Lulu EMR Viewer, for opening a downloaded backup folder on any computer, comes with each release download and is listed in its SHA256SUMS.txt.
• If the folder holds a viewer file (… Viewer.html) from older software, Lulu offers to move it to the Trash or Recycle Bin (OneDrive Backup card).
• If OneDrive is briefly unavailable (just logged in, the computer just woke), the backup waits and retries. The sidebar turns red only after 30 minutes, and warns if no backup has succeeded in 3 days (adjustable).

Your file-level backup tool (Time Machine, Windows File History, an endpoint backup agent) can safely copy the data folder. Everything in it is encrypted.

5. Restoring

• On the same computer: Settings → Backups & restore → Restore… next to any backup. People see what would change, then choose Merge or Replace. An encrypted "before-restore" copy is made first.
• On a new computer:
  1. Install Lulu, open it and set up the records (Touch ID or Windows Hello, and a recovery passphrase). It starts empty.
  2. Bring the records in. Either:
     • From an exported file (.emrx): Settings → Sharing & export → Import or merge a file…, then enter the export passphrase; or
     • From OneDrive: Settings → OneDrive Backup → Restore from a OneDrive backup, then enter the backup passphrase or the recovery key.
  3. In the review, choose Replace everything (the new copy is empty), or Merge.
• Attached documents (PDFs and photos) travel with OneDrive backups. An exported .emrx holds the records and each document's details, but not the document files.
• Between Mac and Windows: encrypted exports (.emrx) and OneDrive backups use the same format on both, so a backup made on one restores on the other.
• If a computer's key is lost (new hard drive, Keychain or Windows profile reset): Lulu asks for the recovery passphrase and restores the key. If that's lost too, restore from an export or the OneDrive backup instead.

6. Upgrading

Install the new version over the old one; records, backups and settings are kept. Lulu reads every older record format. People should quit Lulu first (the installers ask).

Updates are manual: Lulu never checks for updates or downloads anything. Watch for new releases, check their SHA-256, and install.

7. Uninstalling

To remove records as well, which is permanent:

1. Export an encrypted copy first, if the records are still needed.
2. Delete the data folder (§1).
3. Delete the key:
   • Mac: in Keychain Access, delete "Lulu data key" and "Lulu OneDrive backup key".
   • Windows: the key file is inside the data folder, so step 2 removes it.

8. Network and permissions

• No internet:
  • Lulu's page runs under a Content-Security-Policy that blocks every network connection.
  • The Mac and Windows apps contain no networking code for the internet, no telemetry, no analytics and no update checks.
  • No firewall exceptions are needed.
• The demo (Settings → About & what’s new): made-up records in memory only. While it runs, Lulu writes nothing (no saves, backups, OneDrive copies, documents, imports or exports), Phone Sync pauses, and the real records are read from disk again behind the lock when it ends.
• iPhone pairing (Mac only):
  • The Sync helper talks to the paired iPhone over the local network (Bonjour service _lulu-link._tcp), or over peer-to-peer Wi-Fi when the network keeps devices apart.
  • It talks to the Mac app only at 127.0.0.1:51847.
  • Everything sent to the phone is end-to-end encrypted per phone.
  • macOS asks once for Local Network permission.
  • Pairing an iPhone with the Windows app isn't available in 1.0.
• A lost, stolen or replaced iPhone:
  1. Unpair it in Settings → Phone Sync. It stops syncing at once and is told to erase its copy if it ever connects again.
  2. Turn off its OneDrive access, if it had any.
  3. Erase it with Find My or your MDM.
  4. Pair the replacement.

  The phone's copy is encrypted with a key that never leaves that device. Changes it hadn't synced are lost; everything synced is on the Mac.

• Permissions Lulu asks for:
  • Touch ID or Windows Hello: a yes or no answer only.
  • On the Mac, Automation for Microsoft Outlook, only when someone uses Email on a home program.
  • Files: only what people pick in open and save dialogs.

9. Diagnostics and support

If something goes wrong:

1. Ask the person to open Settings → About → Diagnostics… and save the file.
2. Send that file to support.

The file contains no names or record contents. Lines are scrubbed of names, emails, phone numbers and chart IDs. Nothing is ever sent automatically.

Support: see Settings → About.

10. Kiosk (athlete sign-in station)

The kiosk shows only a sign-in screen; leaving it needs the kiosk PIN, Touch ID or Windows Hello. If the computer slept, its screen locked, or the kiosk ran longer than the auto-lock time, the lock screen follows, so the PIN alone doesn't open the records. Repeated wrong PINs lock the pad for longer each time (up to 30 minutes).

For a dedicated sign-in station, use a standard (non-administrator) account, because no app can block every system shortcut:

• macOS: a separate user account set up for the kiosk.
• Windows: Assigned Access (kiosk mode) for that account.

11. Known limits in 1.0

• Windows:
  • iPhone pairing isn't available.
  • Attached documents can't yet be printed directly; save a protected copy and print it from a PDF reader.
• macOS: the app can't stop Spotlight (⌘Space) or a screen lock during the kiosk.