Allergen Safety
The Declaration That Can
Never Disappear
Every allergen declaration, signed, timestamped, and preserved forever.
What Happened at Heathrow
Natasha Ednan-Laperouse was fifteen years old. She was traveling from London Heathrow to Nice with her father and a friend. Before boarding, she bought a baguette from a Pret a Manger outlet in the terminal.
The baguette contained sesame seeds baked into the dough. They were not listed on the label. Natasha had a severe sesame allergy. She asked the staff whether the sandwich contained allergens. She was told to check the label. The label said nothing about sesame.
Ninety minutes after eating the sandwich, she suffered an anaphylactic reaction at 38,000 feet. She died before the plane landed.
The subsequent inquest found that Pret a Manger's labelling practices were lawful under the regulations then in force. The UK's Food Information Regulations at the time exempted packaged-for-direct-sale products from full allergen disclosure requirements. Nothing Pret did was illegal.
But the failure was not only legal. It was a data problem.
The allergen was present. The declaration existed — somewhere in a specification document. An update had happened at some point. But the chain broke between the ingredient and the label. Between the declaration and the customer.
Natasha's Law passed in 2021. It requires full ingredient and allergen labelling on all food prepared and packaged on the same premises where it is sold. The law changed. The legal gap closed.
The data problem it exposed has not.
Natasha's Promise
When ChefLife's allergen management system was designed, one rule was written before any other:
No allergen declaration is ever deleted. Ever.
When a recipe's allergen information changes in ChefLife, the previous declaration does not disappear. It becomes superseded — clearly marked as historical, grayed out in audit views, but present. Permanently present. Linked forward to the new declaration, which links backward to it.
Superseded is not the same as deleted. A deleted record cannot be retrieved. A superseded record can be queried, audited, printed, and presented to a lawyer, an inspector, or a coroner. It is the actual record, exactly as it existed at the moment it was active — not a reconstruction, not an approximation.
This is what we mean by the name. Natasha Ednan-Laperouse's name is in the ChefLife codebase. It is a reminder of what is actually at stake when data can quietly disappear.
Three States. No Ambiguity.
Most allergen systems are binary: contains or doesn't contain. That binary isn't honest. A kitchen that fries fish and then uses the same fryer for chips does not have a "free from" situation for fish-allergic guests. The risk is real. The declaration should reflect it.
ChefLife uses three states, assigned at the ingredient level and propagated upward through recipes:
Present
The allergen is a deliberate ingredient. It is in the recipe by design. A sesame bun. A peanut sauce. A dairy cream. There is no ambiguity here — this dish contains this allergen.
May Contain
The allergen is not a deliberate ingredient, but cross-contact risk exists. This arises from two sources: an ingredient supplier's cross-contamination warning on their product specification, or a kitchen station that processes the allergen and may transfer trace amounts to other dishes prepared there. Both are tracked separately and both contribute to this state.
Free From
The allergen is absent from all ingredients, and there is no cross-contact risk from station or supplier. This state requires positive confirmation — not just the absence of a "contains" flag, but verified absence at every layer of the data flow.
How States Flow Through the System
Allergen data enters at two points: the ingredient and the kitchen station.
At the ingredient level, each allergen is assigned one of the three states when the ingredient is created or updated. If a supplier reformulates — adding a sesame-based binding agent to a previously sesame-free spice blend, or changing their production line to share equipment with a nut facility — the ingredient declaration is updated. The old declaration is superseded, not overwritten. The supply chain change is preserved in history.
At the station level, ChefLife tracks environmental allergens: the flour that aerates in a pastry station, the nut dust from a grinding station, the shellfish stock that simmers in a shared pot. Any recipe assigned to a station inherits that station's environmental allergen risk automatically. The chef doesn't need to remember. The system carries it.
The recipe inherits from both layers. The final declaration on a recipe is the honest sum of everything that touches it — ingredients, stations, supplier warnings — resolved to the highest applicable state for each allergen.
A Record You Can Point to in Court
Consider a specific scenario.
In March, you serve a chicken sandwich. The allergen declaration shows: gluten present (bun), dairy free from, sesame free from. In April, you switch bread suppliers. The new supplier's buns are made on a shared line with sesame products. You update the ingredient. ChefLife creates a new allergen declaration: sesame now reads May Contain.
In June, a customer contacts you. They ate your chicken sandwich in March — before the supplier change — and they are trying to document what they ate for a medical record. They need the allergen declaration that was active in March.
In most kitchens, the answer is: "We updated our records, we don't have the old version."
In ChefLife, the answer is: here is the declaration that was active from March 1st to April 14th. Its UUID. Its timestamp. The name of the user who created it. Its cryptographic signature, which proves it has not been altered since it was written.
What the Identifiers Mean
Each declaration carries a UUID — a universally unique identifier that is assigned once and never reused. It is how the record is addressed in the database, in the audit log, and in any query. It cannot be guessed, fabricated, or reassigned.
The cryptographic signature is a hash of the declaration's contents at the moment it was created. If the record is retrieved six months later and the signature still validates, the contents have not changed — not by accident, not by an administrator, not by anyone. The signature is the proof of integrity.
The supersession links are bidirectional: the old record points forward to its replacement, and the new record points backward to its origin. There are no orphaned links. Following the chain in either direction always resolves to a complete record.
What Every Declaration Contains
The fields below represent the record structure for a single allergen declaration. Every field is immutable once the declaration is created. Updates produce a new declaration; they do not overwrite the existing one.
| Field | Type | Description |
|---|---|---|
declaration_id | UUID | Permanent unique identifier. Assigned once, never reused or reassigned. |
active_from | TIMESTAMPTZ | When this declaration became the active record. Set at creation, immutable thereafter. |
superseded_at | TIMESTAMPTZ | NULL if currently active. Set when a new declaration supersedes this one. Never cleared. |
superseded_by | UUID / FK | Forward link to the declaration that replaced this one. NULL if active. Set simultaneously with superseded_at. |
supersedes_id | UUID / FK | Backward link to the declaration this one replaced. NULL if this is the original declaration for this recipe. |
signed_by | USER FK | The user who created and signed this declaration. Linked to the team member record at time of signing. |
content_hash | TEXT | Cryptographic hash of the allergen states at signing. Allows integrity verification of the record at any future point. |
allergen_states | JSONB | The declared state for each allergen at time of signing: Present, May Contain, or Free From. Jurisdiction-specific allergen list. |
The Law Where You Operate
Allergen requirements differ by jurisdiction. Natasha's Law mandates disclosure of 14 allergens in the UK. The FDA's rules in the United States cover 9 major allergens. Health Canada maintains its own requirements. FSANZ governs Australia and New Zealand. The law where your kitchen operates is the law that applies to your declarations.
ChefLife's allergen system is jurisdiction-aware. The allergen list presented in your account is determined by your organization's registered jurisdiction — the same jurisdiction setting that governs overtime calculations, record retention periods, and employment law requirements throughout the platform. You cannot accidentally use the wrong list.
Natasha's Law — United Kingdom
14 allergens. Full ingredient declaration required on all food prepared and packaged on the same premises where sold. In force since October 2021.
FDA Big 9 — United States
Milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, sesame. Major food allergen labelling requirements under the Food Allergen Labeling and Consumer Protection Act.
Health Canada
Enhanced labelling requirements under the Safe Food for Canadians Act. Priority allergens and gluten sources must be declared in plain language on all pre-packaged foods.
FSANZ — Australia & New Zealand
Food Standards Australia New Zealand. Mandatory declaration requirements under Standard 1.2.3. Allergens must be declared wherever present, including as components of compound ingredients.
The Principle
"If it existed, it still exists."
Applied to allergen declarations: the record you signed in March still exists in June. The record signed before the supplier changed still exists after it changed. Every declaration ChefLife has ever written is in the database, linked, signed, and available for audit. No declaration has ever been deleted. None ever will be.
This is not a feature. It is an architectural constraint that was built in from the beginning, because the alternative — a system where records can be quietly removed — is a system that cannot be trusted. And in food service, data you cannot trust is not just bad business.
It is a safety risk.
In Development
Allergen management is coming to ChefLife.
The allergen management system described here is currently in active development. If you operate under Natasha's Law, the FDA Big 9, Health Canada requirements, or FSANZ standards — and you want to be notified when it's available — join the waitlist.