Practitioner access to a client chart depends on the workspace setting: Open charts (the clinic default). Practitioners in the clinic can open clinic client charts for treatment. Actions remain attributable through the activity log. Clinic administrators are not restricted by the practitioner care-team rule. Strict chart access. A practitioner can open a chart only while they are the client's primary practitioner, a secondary practitioner, or have unexpired emergency break-glass access. Clients manage primary and secondary practitioners from their care-team page. Appointments, conversations, prescriptions, medical tests, and uploads are not direct chart-access sources. However, public booking, a staff-created appointment, and starting a new client/practitioner conversation automatically enroll the practitioner in the client's care team. That membership is the access source. Documents are always more restrictive. A practitioner can access a client's document metadata or file only through care-team membership (or a valid break-glass grant), even when the clinic otherwise uses open charts. Clinic admins retain tenant-wide document access, while clients can access their own documents according to sharing rules. Clients always retain access to their own records. Changing the primary practitioner demotes the previous primary to secondary; removing a practitioner revokes that care-team access and can also cancel upcoming appointments when the client chooses that option.

Security & privacy

Q: Access control by role

The product has three workspace roles: Client, Practitioner, and Admin. Clients access their own information, practitioners use clinical workflows, and administrators manage their workspace. A role in one clinic does not grant access to another clinic, and there is no workspace role that spans providers.

Virtual Clinic separates every provider's data and applies access checks inside each workspace. This page explains the controls users encounter in the product.

Isolated workspaces

Every clinic operates on its own subdomain and dedicated database schema. Records are separated at the data layer, not only filtered in the interface. Independent practitioners are also scoped so one practitioner cannot browse another practitioner's records. An account may use the same email in several workspaces, but each workspace keeps a separate account and clinical record.

Protected browser sessions

After sign-in, the browser session is stored in secure, HTTP-only cookies. Page scripts cannot read those authentication cookies. Unsafe requests also require a separate CSRF token, which protects against another website causing actions in your signed-in session. Sessions are scoped to the provider where you authenticated and are rejected in a different workspace. Sign out on a shared device when you finish.

Access control by role

The product has three workspace roles: Client, Practitioner, and Admin. Clients access their own information, practitioners use clinical workflows, and administrators manage their workspace. A role in one clinic does not grant access to another clinic, and there is no workspace role that spans providers.

Chart access

Practitioner access to a client chart depends on the workspace setting:

Open charts (the clinic default). Practitioners in the clinic can open clinic client charts for treatment. Actions remain attributable through the activity log. Clinic administrators are not restricted by the practitioner care-team rule.
Strict chart access. A practitioner can open a chart only while they are the client's primary practitioner, a secondary practitioner, or have unexpired emergency break-glass access. Clients manage primary and secondary practitioners from their care-team page. Appointments, conversations, prescriptions, medical tests, and uploads are not direct chart-access sources. However, public booking, a staff-created appointment, and starting a new client/practitioner conversation automatically enroll the practitioner in the client's care team. That membership is the access source.

Documents are always more restrictive. A practitioner can access a client's document metadata or file only through care-team membership (or a valid break-glass grant), even when the clinic otherwise uses open charts. Clinic admins retain tenant-wide document access, while clients can access their own documents according to sharing rules.

Clients always retain access to their own records. Changing the primary practitioner demotes the previous primary to secondary; removing a practitioner revokes that care-team access and can also cancel upcoming appointments when the client chooses that option.

Break the glass

Under strict access, a practitioner can request temporary emergency access by recording a reason. Access lasts for the configured period (24 hours by default). The event is written to the audit trail and appears in the clinic's break-glass report so administrators can review who accessed the chart, why, and when.

Audit trail

When the Activity Log module is enabled, the workspace records significant actions with the user, time, action type, and description. Clinic administrators can review those entries. Break-glass events are audited even though they temporarily expand chart access.

Encryption in transit

The production service accepts HTTPS connections, so information exchanged between the browser and Virtual Clinic is encrypted in transit. Keep your device and browser updated, use a unique password, and never share your sign-in credentials.