The patient or a relative opens the link from a chat, enters the code and birth date, and the MRI opens in the browser, with no app and no account. A wrong code or date gets the same refusal, so nobody can guess one part at a time.