Labfy results now land in the Corona-Warn-App
A PDF in an inbox is a poor entry ticket: it gets lost, it is trivial to fake, and whoever is on the door cannot check it. A signed certificate in an app is none of those things.

- Author
- Published
- Reading time
- 4min
- Series
- Pandemic software Part 4 of 5
Nine months ago we
This post explains why that matters, how it works, and what we learned scaling a health-data platform from zero to hundreds of sites in a single year.
Why the app integration matters now
Since autumn, the 3G rule — geimpft, genesen, getestet; vaccinated, recovered, tested — governs access to restaurants, events, workplaces and public transport across Germany. For anyone who is not vaccinated, a recent negative rapid test is the entry ticket, and it has to be shown dozens of times a week.
A PDF in an email inbox is a poor entry ticket. It gets lost, it is easy to forge, and the person checking the door cannot verify it. A result inside the Corona-Warn-App, by contrast, is cryptographically signed, shows a clear validity status, and is checked the same way everywhere.
For test centres, being "in the app" went from a nice feature to a customer expectation. People now ask at the door: "Does the result go into the Corona-Warn-App?" With Labfy, the answer is yes.
How the integration works
The Corona-Warn-App has supported rapid test results from partner test centres since spring. Labfy connects to that interface as a registered partner. The flow from the citizen's perspective:
- Book and register through the test centre's Labfy booking page as usual.
- Opt in to receiving the result in the Corona-Warn-App during registration. This is a separate, explicit consent.
- Scan a QR code on arrival. Labfy generates a test-specific QR code that the person scans with the Corona-Warn-App, which links this test to their app — without Labfy ever learning anything about their app or their other tests.
- Get the result in the app. When staff record the result in Labfy, it is transmitted to the app's backend, signed, and appears in the app within minutes. Negative results become an EU-compatible test certificate; positive results additionally trigger the app's warning flow so contacts can be alerted.
The email and SMS delivery still happens in parallel, so nobody is forced to use the app.
Privacy: what Labfy does and does not see
The integration is designed so that Labfy and the test centre learn nothing new about the person. We transmit the result against a one-time test identifier. We do not receive device identifiers, we do not know whether the person has other results in the app, and the Corona-Warn-App never sends data back to us. This mirrors the
What 300+ test centres taught us
Scaling Labfy from pilot to hundreds of sites taught us a few things that apply far beyond pandemic software.
Onboarding time is the product. Operators were opening centres in days. A platform that took a week to configure would have lost every deal. We cut onboarding to under a day by defaulting every setting and letting operators change them later.
Peak load is not average load. Mondays at 7 a.m. and the evenings before public holidays produced traffic an order of magnitude above the weekly average. Our infrastructure is built to scale horizontally for exactly those windows.
Regulations change faster than roadmaps. Reimbursement rules, certificate formats and reporting requirements changed repeatedly during 2021. Being a SaaS platform meant one deployment updated every centre at once, instead of 300 separate upgrades.
Support is a data-protection function. Every support request touches medical data. We trained the support team on GDPR principles before they answered a single ticket.
What is next
Over the winter we are focusing on three areas: faster reimbursement reporting for the new billing rules, extended multi-site analytics for operators with ten or more locations, and support for employee testing programmes in companies.
On this page
Where does this leave your system?
A post can explain how something works; it cannot say what that means for the system you already run. Thirty minutes with an engineer, not a salesperson, and no follow-up sequence.
