Unguessable links
Tracking and prescription links use long random keys, not token numbers or phone numbers, so one patient cannot guess another’s.
Security & privacy
Health data, seen by the right people only.
Roles you control module by module, clinical notes that stay with the treating doctor, and an activity log that records who did what, with the values before and after.
- Doctor-only clinical notes
- Every change logged
- Data belongs to the clinic
01 Access control
Everyone gets the access their job needs, no more.
Reception, doctors, nurses, accounts and managers each get a role. You decide what every role can do, module by module.
- Reception
- Doctors
- Nurses
- Accounts
- Managers
Permissions per module
For every role, choose view, add, edit, delete or manage, separately for queues, appointments, patients, medical records, billing, reports and settings.
Doctors run their own queue
A doctor’s role can be limited to their own patients and queue. Reception and managers can be given every doctor.
Invitations that expire
Staff join through an email invitation that expires after 7 days. Resend or revoke it before it is accepted.
Deactivate in one click
When someone leaves, deactivate them: they are signed out everywhere and their history stays in the log.
02 Clinical privacy
Medical notes are for the treating doctor.
The front desk can run the day, book, check in, bill and print, without reading what the doctor wrote.
Who sees the consultation notes
- Treating doctorHistory, examination, diagnosis and prescriptions for their patient.Full notes
- Roles you give full medical-records accessThe notes, because the clinic chose to grant it.Your choice
- Another doctorOnly after writing a reason. The reason, name and time go to the activity log.With a reason
- Reception & accountsAppointments, bills and follow-ups. They can print the issued prescription, not the notes.No notes
Notes stay with the treating doctor
History, examination, diagnosis and prescriptions are visible to the doctor who treats the patient, not to everyone with a login.
Break-glass, with a reason
Covering for a colleague? A doctor can open another doctor’s patient after writing a reason. The reason, name and time go to the activity log.
Reception prints without reading
The front desk can print or send a prescription the doctor has issued, without opening the consultation notes.
TV shows token numbers
Waiting-room screens show token numbers only by default. The clinic can choose to add first name and initial.
03 Audit trail
A complete record of who did what, and when.
When a fee changes, a bill is discounted or a record is opened, the activity log already knows. Click any entry to see the whole change.
What gets logged
- Bookings
- Calls
- Check-ins
- Bills
- Discounts
- Prescriptions
- Record access
- Role changes
- Settings
Who, what and when
Bookings, calls, check-ins, bills, discounts, prescriptions, record access, role changes and settings, each with the person and the time.
Before → after values
Every change keeps the old value and the new one, so “who changed the fee?” has an answer.
Searchable and exportable
Filter by person, module, action or date range and export the result to CSV for your own records.
04 Patient-facing screens
Private links. Public screens that say very little.
Patients track their turn and open their prescription without an app or a password, so those links are built to reveal as little as possible.
Only what the patient needs
The tracking page shows the token, first name and initial, the doctor and the live queue, never the mobile number or past visits.
- Patient pages ask search engines not to index them
- Prescriptions shared as a private link, not an attachment
- Patients cancel or reschedule from the same link
Waiting-room TV, minimal by default
Screens show token numbers and rooms. Adding first name and initial is a clinic setting, off unless you turn it on.
- Pair with a 6-digit code, no staff login on the TV
- Each screen shows only the doctors you assign
- Online / offline status for every screen
05 Records integrity
Medical records that cannot be quietly rewritten.
What the doctor recorded on the day stays on record. Corrections are visible, explained and attributed.
Completed visits are locked
Once a consultation is completed and the prescription issued, the visit is read-only.
Amendments keep the earlier version
A correction becomes a new version with the reason. Both versions stay on the record.
Merge instead of delete
Duplicate patients are merged: visits, prescriptions, bills and follow-ups move to the record you keep.
06 Data handling
Your clinic’s data, kept to its purpose.
ClinicWorkFlo is being designed with India’s Digital Personal Data Protection Act, 2023 in mind. Here is what that means in the product, and what we are putting in place before launch.
Data belongs to the clinic
We process patient data only to provide the service to that clinic, never for advertising.
Separate for every clinic
Each clinic’s patients, staff and records are kept apart from every other clinic’s.
Need-to-know access
Roles, own-queue doctors and doctor-only notes limit who sees health data.
Accountable use
Record access outside a doctor’s own patients needs a reason, and every change is logged.
How we will host it
PlannedClinicWorkFlo is pre-launch. These are the commitments in our launch plan; we will update this page as each one goes live.
- Encrypted connections (HTTPS) for every page and screenPlanned
- Encryption at rest for the database and uploaded documentsPlanned
- Regular backups with point-in-time restore, tested before launchPlanned
- A full export of your clinic’s data if you ever leavePlanned
- Session time-outs on shared reception computersPlanned
07 IT questions
Questions your IT team will ask.
Straight answers about access, logging, records and data, including what is still planned.
The treating doctor, and roles the clinic has given full access to medical records. Other doctors must write a reason to open the record, and that reason is recorded in the activity log. Reception and accounts see appointments, bills and follow-ups, not the notes.
Yes. Roles are set module by module, view, add, edit, delete and manage, for queues, appointments, patients, medical records, billing, reports and settings. Built-in roles give you a starting point; you can change them or create your own.
Changes to bookings, tokens, patients, consultations, prescriptions, bills, staff, roles, TV screens and settings, plus opening a record outside your own patients. Each entry shows who, when, and the values before and after the change.
Not silently. A completed visit is locked. A change becomes an amendment with a reason, and the earlier version is kept alongside it.
They are merged, not deleted. Visits, prescriptions, bills and follow-ups move to the record that is kept, and the merge is logged.
The token number, first name and initial, the doctor and the queue status. Not the mobile number, not the visit history. Links are long, random and unguessable, and patient pages ask search engines not to index them.
We are designing ClinicWorkFlo with the Digital Personal Data Protection Act, 2023 in mind, purpose-limited use, access controls, logging and data that belongs to the clinic. We do not claim a certification. If your organisation has a security questionnaire, send it to us and we will answer it honestly.
The clinic. We process patient data only to provide the service to that clinic, and each clinic’s data is kept separate from every other clinic’s.
No. ClinicWorkFlo runs in the browser on the computers, tablets and TVs you already have. TV screens pair with a 6-digit code instead of a password, so no staff login is left on a shared screen.
Want to see the controls for yourself?
We will walk your team through roles, record access and the activity log on a short call.