Team and security
Roles and permissions
What each role can do, making your own roles, changing one person’s access, and seeing the app as them.
The permissions
Add and edit clients, Import clients, Download client list, Remove client files, See clinical records, Book clients and take consent, Take and void photos, Withdraw consent, Manage time off, Finances, Gift cards: check and sell, Gift cards: change balance and cancel, Give refunds, Payment settings, Business settings, Team and permissions, Treatments and prices, Download treatment list, Website, Marketing, Client emails, AI features, Plan and billing, Audit log, and the Data & compliance ones: Log a data request, See Data & compliance, Handle requests, holds and the archive, Ask for records to be deleted, Approve deletion and Edit the data policy. Approve deletion and Edit the data policy are for Admins only and can’t be given to anyone else. Book clients and take consent, Take and void photos and Withdraw consent only work with See clinical records on, because they involve health information. See clinical records is more than hiding screens: health information is encrypted with its own key, and only people with this permission are given it. Turning it off re-locks clinical records with a new key the person doesn’t have.
Your PIN again for sensitive changes
Changing a role’s permissions, one person’s access or someone’s role asks for your PIN again, even though you’re logged in. One PIN covers the next five minutes of changes. Deleting a client or a file asks every time. After five wrong PINs it waits 30 seconds.
Roles
Admins can do everything. Managers run the business day to day: by default they can add, edit, import and download clients, manage everyone’s diary and time off, see finances, change treatments and prices, the website, marketing, client emails and AI features, see the audit log, and handle data requests (Data & compliance). They don’t see health records, change the team or permissions, payment settings, business settings or billing, and can’t be booked. Change what Managers, Practitioners and Reception can do, or Reset to defaults. New role: give it a name, choose what it Works like (Practitioner can be booked and shows on your website; Manager and Reception can’t be booked) and which role’s permissions to start with. Changes save straight away. Rename or Delete role any time. Delete role removes one of your own roles: anyone who has it goes back to the role it was based on.
One person’s access
In their staff file’s Access tab, change their permissions (they’re marked Custom access), reset their PIN, View as to see the app as them, or Reset to role to undo their changes. Admins can always do everything: change their role in Profile to limit them. You can’t change your own access.