Roles
Owners control clinic-level administration and billing. Admins handle day-to-day setup. Healthcare providers review and approve clinical reports. Assign the least privilege that allows each person to do their work.
- Keep ownership limited and ensure the clinic has a recovery path.
- Do not use an admin role as a substitute for healthcare-provider designation.
- Remove access promptly when someone leaves the clinic.
Invitations and membership
An invitation should be sent to the person's work email and accepted by that person. Verify the clinic before accepting an invitation. Membership is clinic-specific and should not be shared across organizations.
Activity log
The activity log records security-sensitive and workflow changes such as membership, template publishing, SDK keys, and other administrative actions. Use filters to investigate a known event rather than exporting unrelated activity.