Give each person the access their work needs.
Twenty demo roles combine role privileges, organization/branch, patient assignment, information category, purpose and time. Administrative rank does not automatically unlock clinical records. These are proposed product rules, ready for clinic review.
Updated platform policy: Platform administrator and Platform support can access all tenant data and all settings, including private notes, photos, voice recordings, messages, billing, staff, integrations and audit events. This overrides the assignment and private-record restrictions below for these two roles only. Clinical signature attribution and independent approval workflows still apply.
How access is decided
Organization membershipBranch or care assignmentRole and clinical privilegeRecord category and sharingPurpose, release and expiry
A permitted page is only the start: the records, fields and actions within it are separately limited. The samples enforce those interaction rules, including direct navigation and attempted actions. All data is fictional and still contained in the downloadable file.
Roles from platform to patient
| Layer / role | Sample person and scope | Shared with this role | Restricted | |
|---|---|---|---|---|
| Platform | Platform administrator | All tenants, all data and all settings | All patient records, private notes, photos, voice recordings, messages, financial data, staff, audit events, integrations and settings across tenants. | No data or settings restrictions in this prototype. Clinical signature attribution and independent approval workflows still apply. |
| Platform | Platform support | All tenants, all data and all settings | All patient records, private notes, photos, voice recordings, messages, financial data, staff, audit events, integrations and settings across tenants. | No data or settings restrictions in this prototype. Clinical signature attribution and independent approval workflows still apply. |
| Organization Clinic owner | Youssef · owner Sina Cairo operations; clinical access requires a separate credentialed role | Clinic financial accounts, operational staffing and aggregate activity. | Clinical narratives, original audio, clinical photos and prescribing. | |
| Branch Branch manager | Dalia · branch manager Nasr City branch operations | Identity/contact, appointment status, operational tasks and branch accounts. | Clinical notes, diagnostic images, raw audio and medical signing. | |
| Clinical governance Medical director | Dr Mona · medical director Sina Cairo clinical oversight roster, including both branches | Clinical care and oversight information for the declared quality-review responsibility. | Ownership alone, payroll, platform tenant data and unrelated organizations. | |
| Treating team Consultant / surgeon | Dr Allam · consultant Assigned surgical episodes P-0104 and P-0105 | Assigned charts, care plans, relevant photos, results and team handoffs. | Other doctors’ unassigned patients, payroll, owner finances and author-private drafts. | |
| Supervised care Junior doctor / resident | Dr Karim · resident Assigned to P-0104 under Dr Allam | Assigned care-team chart and supervised note/order drafts. | Final medical signatures, independent prescription release, bulk export and unassigned charts. | |
| Nursing Nursing lead | Hana · nursing lead Assigned nursing roster P-0104–P-0106 | Care plans, relevant safety information, nursing observations and assigned recovery tasks. | Medical prescribing/signatures, author-private notes, unrelated finances and unrestricted original recordings. | |
| Nursing Staff nurse | Salma · nurse Assigned recovery care for P-0105 | Assigned recovery plan, allergies/medication status, observations and nursing handoff. | Prescribing, medical sign-off, clearance decisions, other patients and private notes. | |
| Clinic operations Care coordinator | Mariam · coordinator Assigned logistics for P-0104 and P-0105 | Contact details, appointment plans and administrative readiness tasks. | Narrative medical notes, diagnoses in campaign data, raw audio, clinical images and full financial ledgers. | |
| Clinic operations Reception / registration | Nadia · reception Nasr City patient directory and appointment queue | Minimum identity/contact details, booking type, arrival and queue status. | Diagnoses, clinical history, medical media, prescriptions and full billing accounts. | |
| Clinic operations Finance / cashier | Ahmed · finance Nasr City billing accounts | Billing identity, service labels, quotes, deposits, receipts and reconciliation. | Full chart, raw voice, clinical photos, private notes and clinical editing. | |
| Clinical services Pharmacist | Dr Farah · pharmacist Medication fulfilment task for P-0105 | Assigned authorized medication orders, allergy status and relevant safety context. | Independent prescribing, changing prescriber orders, full narratives and unrelated patient charts. | |
| Clinical services Lab / imaging technician | Tarek · diagnostics Assigned diagnostic orders P-0104 and P-0105 | Order identifiers, minimum identity, specimen/study instructions and result drafts. | Unrelated clinical history, clinical release authority, finance and general chart browsing. | |
| Clinic operations Inventory officer | Mostafa · inventory Branch stock and coded case references | Items, lots, serials, expiry and case usage references without patient identities. | Patient directory, clinical notes, prescriptions, raw media and financial accounts. | |
| Outreach Marketing / lead moderator | Sara · marketing Assigned enquiries and purpose-approved campaign assets | Assigned opt-in enquiry contact information and separately approved publication assets. | Patient chart, procedure history, clinical images by default, conversion into clinical records and patient lists. | |
| Governed secondary use Research analyst | Rania · research Approved deidentified sample cohort only | Approved coded cohort, limited fields and aggregated outcomes. | Names, contacts, record reidentification keys, original photos/audio and care-team records. | |
| Independent oversight Privacy / audit officer | Mina · privacy Access metadata, disclosure requests and consent review | Access metadata, grant purpose/expiry and minimum request information. | Routine clinical narratives, prescribing, bulk chart reading and silently changing clinical history. | |
| Personal access Patient | Nour · patient Own released records for P-0104 | Own explicitly released summaries, own appointments and bills, and personal submissions. | Unreleased drafts, staff-only commentary, other patients and changing signed records. | |
| Delegated personal access Guardian / authorized proxy | Layla · proxy for Omar P-0105 appointments and messaging only; sample grant expires in 24 hours | Only the categories in the active, revocable proxy grant. | Clinical notes/results, financial records and images outside the explicit grant; no family-wide access. |
What is shared, and what stays restricted
| Information | Appropriate sharing | Boundary | ||
|---|---|---|---|---|
| Patient identity and contact | Registration team, assigned care team, billing identity where needed | No platform/support, research or general marketing directory. | ||
| Clinical plans, allergies and medication status | Assigned treating clinicians and nursing team; relevant safety subset for pharmacy | Administrative views get readiness/booking status, not the narrative chart. | ||
| Medical drafts | Author and explicitly assigned supervising clinician | Not patient-released; junior doctors cannot sign final medical records. | ||
| Private working notes | Author; named colleague through a recorded, expiring share | No automatic owner, receptionist, nurse or patient access. | ||
| Nursing documentation | Assigned care team; nurse signs their own nursing note | Does not grant prescribing, medical note signing or patient release authority. | ||
| Photos and original audio | Authorized clinical purpose and assigned professional; raw recordings need separate controls in production | Clinical photography permission is not publication, research or marketing permission. | ||
| Billing and payments | Finance, authorized branch operations and owner; patient’s own billing summary | No access to the full clinical chart merely because a person handles invoices. | ||
| Patient messages | Administrative thread for scheduling staff; clinical thread for assigned clinicians; released/personal conversation for patient | Temporary read-only access cannot send clinical messages. | ||
| Diagnostic and pharmacy work | Assigned task, minimum identity and relevant order/safety data | Technicians draft results; pharmacy fulfils authorized orders; neither independently releases clinical advice. | ||
| Stock and implants | Inventory team gets lots, expiry, movements and coded case references | No patient name or chart required for routine stock management. | ||
| Marketing | Assigned opted-in leads and separately consent-approved publication assets | No default clinical photos, diagnoses, patient lists or clinical conversion rights. | ||
| Research | Approved deidentified or coded fields for a specific study | No identity, contact, raw photos/audio, record keys or automatic new patient access. | ||
| Audit and privacy | Access-event metadata, reasons, approvals, expiry and revocation | Audit duty does not grant routine clinical reading or editing. | ||
| Patient / guardian | Patient sees own signed-and-released notes; proxy receives only named categories for a time period | Signing alone does not publish a record. Proxy relationship alone does not grant full chart access. | ||
| Platform | Platform administrator | All tenants, all data and all settings | All patient records, private notes, photos, voice recordings, messages, financial data, staff, audit events, integrations and settings across tenants. | No data or settings restrictions in this prototype. Clinical signature attribution and independent approval workflows still apply. |
Try the integrated workflows
- Reception vs consultant: switch the demo persona; reception sees identity and appointment details, while the assigned consultant sees the clinical episode.
- Supervised documentation: choose Junior doctor, write a draft, then switch to Consultant and review/countersign it. Signing does not publish it to the patient.
- Patient release: the consultant releases a signed note; switch to Patient to see that record. Withdraw release and verify it disappears from the portal while the clinical record remains.
- Nursing authority: a nurse writes and signs their own nursing record. Medical prescribing and medical sign-off remain unavailable.
- Private draft: create an author-only note or use the seeded private working note. Share it with a named assigned colleague; revoke that grant in Roles & sharing.
- Temporary access: Consultant requests P-0106 with purpose and duration. Medical director approves. The consultant can read the permitted record but cannot write notes or messages for that temporary patient. Privacy officer can revoke it.
- Care-team assignment: Medical director adds a persona to a patient’s roster. The role still determines clinical versus administrative fields and actions.
- Staff responsibilities: Owner or branch manager records a staff assignment. Clinical roles stay pending until a different medical-director persona reviews them.
- Proxy scope: Guardian sees Omar’s appointments and messages only. The privacy officer can revoke the proxy grant.
- Mobile: use the role picker, bottom navigation, More menu and quick-action sheet. Patient/reception/nurse/doctor experiences use the same access rules.
Approval and exception rules
- Deny unspecified actions.
- Tenant boundary first, then branch/care assignment.
- Clinical and administrative authority are distinct.
- Draft, sign, countersign, release, share and export are separate privileges.
- Private working drafts need a named share, even within a care team.
- Temporary access requires an independent medical-director approval, is read-only and expires after 15/30/60 minutes.
- Revocation removes records on next interaction or expiry refresh.
- Patient release can be withdrawn without deleting the signed clinical record.
- Proxy example is appointments/messages only with expiry and revocation.
- New operational staff roles can be recorded by owner/manager; clinical roles need separate medical-director approval.
- Care assignments are authorized by clinical governance.
- Stable patient IDs, not names, bind records and invoices.
- No emergency override is enabled in this prototype.
Staff assignment entries are roster examples; they do not create real accounts. Multi-role staff and emergency exceptions need explicit organization policy before production implementation. A technician’s draft or a pharmacy fulfilment review is not a medical signature or a prescribing privilege.
Production requirements
This HTML demonstrates access behavior; it does not secure medical records. A user can inspect the fictional source and browser storage. No authentication service, encrypted clinical storage or server-enforced authorization is implemented.
- Authenticate each staff identity and tenant membership; role selector is demo-only.
- Enforce policy at server, database rows, private object storage, API and exports.
- Validate clinical credentials and signing scope.
- Use server time, revocable grants, reliable audit and appropriate offline lease controls.
- Encrypt devices/recordings; scope cached data and define remote revocation behavior.
- Apply the policy to search, summaries, notifications, tasks, downloaded attachments and every integration.
- Separate retention and consent for audio, clinical photos, marketing, teaching and research.
Machine-readable companion: role and sharing policy. The full 48-feature roadmap remains preserved in the feature register.