Accounts, login & 2FA
How staff sign in, what each role can see, and setting up two-factor authentication.
Signing in
Staff sign in with either their phone number or email, plus their password. Phone is the sign-in ID assigned when you're invited — it's shown read-only on your own account page, since it's how the system identifies you. If your account has access to more than one clinic, you'll be asked to pick one after your password is accepted.
A demo login is available from the sign-in screen for trying the product — it logs into a sandbox demo clinic, resets its data each time, and never touches a real clinic's information.
Roles — what each person can access
Every staff member holds one or more roles at a clinic. The role decides which menu items appear and which actions the server will actually allow — the app never offers a button the API would reject.
- Owner / Admin (Clinic Admin or Manager) — everything: appointments, queue, patients, prescriptions, follow-ups, billing, pharmacy, lab, reports, messages and settings.
- Doctor — appointments, queue, patients, prescriptions, and lab (view/order if the Lab module is on). Not billing or settings.
- Receptionist — appointments, queue, patients, billing, follow-ups, and messages (if WhatsApp is on). Not prescriptions or settings.
- Pharmacist — pharmacy (dispensing, stock, purchase orders), and lab if the Lab module is on. Requires the Pharmacy module on your plan.
- Lab Admin / Lab Technician — lab orders and results; Lab Admin also manages the test catalogue and pricing. Requires the Lab module on your plan.
- Billing — invoices, payments and receipts.
Reports and Settings are reserved for the owner/admin role. Everyone else can still reach their own account and security settings — those two are always self-serve.
Setting up two-factor authentication (2FA)
2FA adds a second step at sign-in using a TOTP authenticator app (Google Authenticator, Authy, 1Password, etc.) — even if someone gets your password, they can't sign in without your phone.
- 1Go to Settings → Security.
- 2Click "Enable two-factor authentication".
- 3Scan the QR code with your authenticator app (or enter the manual key if you can't scan).
- 4Enter the 6-digit code the app shows, then confirm.
- 5Save the recovery codes you're shown — each one works once, and they're the only way back in if you lose your device. You won't see them again.
Once it's on, every sign-in asks for a code from your app after your password. From Settings → Security you can also regenerate a fresh set of recovery codes (this invalidates the old ones) or disable 2FA — both require your password to confirm.
Owners can also require 2FA for the whole team from Settings → Security → Team security. Staff without it set up will be prompted to enable it the next time they sign in.
Sessions
Settings → Security also lists your recent sign-ins by device, with the current one marked. If you think your account was accessed from somewhere it shouldn't have been, use "Sign out other devices" — it keeps you signed in here and signs out everywhere else immediately.
Changing your password (Settings → My account) also signs out every other device automatically, as a safety measure.
Click "Forgot password?" on the sign-in screen and enter your email. A reset link is sent there, even if you normally sign in with your phone number.
Use one of your saved recovery codes at the 2FA prompt to sign in, then set up 2FA again on a new device from Settings → Security. If you didn't save any recovery codes, ask another owner/admin at your clinic, or contact support.
Only the owner or a Manager can invite staff, from Settings → Staff & roles (or Settings → Doctors for doctors).
Yes, if you've been invited to more than one — you'll be asked to choose which clinic after signing in.