04 real roles
Owner, Doctor, Front desk and Accounts, each scoped to what that job actually needs.
Enforced server-side
Not a UI toggle — a request for something outside a role's permissions is refused by the API itself.
Invite by email
Add staff by email; they set their own password, no shared logins.
Why access control breaks down without it
A shared login means nobody can tell who actually did what.
Front desk staff end up able to open clinical notes they were never meant to see.
Permissions "enforced" only in the interface can be bypassed by anyone who finds the right URL.
Revoking access when someone leaves means changing a password everyone else also uses.
Plans
Starter
1 doctor, 1 receptionist
Professional
3 doctors, 2 staff
Premium
10 doctors, 6 staff
Roles and permissions are included on every plan. See the full plan comparison for seat limits.
Try roles on your own team
7-day free trial, Professional-tier limits, no card required.
Start your free trialQuestions clinic owners ask
Is role enforcement just hidden menus, or is it real?
It's enforced on the server. A front-desk login that tries to reach a clinical note directly is refused by the API itself, not just hidden from the menu.
Can I invite staff without sharing a login?
Yes — invite by email and each person sets their own password. Every action is tied to the person who actually did it, not a shared account.
