I keep thinking about this. You said the restoration device would be left with trusted friend(s). So let the friend do the verification. Two keys needed to restore the account. Perhaps two TOTP codes, generated by two yubikeys. The friend won't give their TOTP out if it's not the owner of the account. TOTP lets them verify the person remotely if needed. The account owner goes for their stashed key, friend gives it to them, owner TOTP goes in, friend TOTP goes in, account restored. Tie all these various codes to the account during initial setup. 

 We can't let a friend have any roles on the recovery process because that creates legal liability on the friend to keep the information (which is medical) secure. In the US, if a friend has access, the friend must be HIPAA trained and compliant. So, instead, what we want is to use the friend's physical security to host encrypted information that only the owner of the account can decrypt.  

 Ah I see. I didn't realize it was that formal. Dang, biometrics is the way, then. Back to square one.  

 I just got one of these Lexar F35 drives. It was about 30 bucks. It might do what you need. Some things: 

- It does require Windows to set up, unless someone smarter than me can make it work in Wine. The app seems simple.
- Fingerprint programming is easy and fast.
- Users get assigned roles as admin or "other users." Admin can add and remove users. All get access to secured partition.
- The app lets you choose the size of the secured partition. I got a 64GB drive and it will partition all of it secure if you want.
- It unlocks the secure partition on Windows and Linux.
- I could NOT get it to unlock secured on Android phone (Pixel 8). Tried external powered hub, also. 
- I abused it a little by yanking it during write, startup, etc. and it didn't lose anything.

If you want me to try anything else, let me know.  

 Thank you! Is it possible to setup multiple users that don't see each other's info AND that the admin doesn't see their info as well? 🤔 

 I don't think so. All users who have a fingerprint enrolled can see the secure partition. Any of (I think) 10 fingerprints gets you access to the secure side. They can be 10 different people. The only elevated privilege for admin is the fingerprint add. It's very simple. I'd bet it's hackable, but that's way out of my league.