A patient account page that holds nothing clinical

The page shows appointments coming up, appointments already had, what is left on a course, a points balance and referral code, and a setting for whether the patient hears about offers.

It does not show medical forms, consultation notes, treatment records, photographs or anything else from the clinical record. That is deliberate. A medical record is read with a practitioner who can answer the question it raises, not alone on a phone on the bus. Plenty of products would sell you the opposite as a "patient portal". We think being clear about this is worth more than the feature would be.

A password means a patient inventing one, forgetting it, and your front desk resetting it. It also means your clinic holding another secret it would rather not hold.

A link emailed to the address your clinic already writes to proves the same thing with none of that: that the person asking reads that mailbox. It is the assumption every booking confirmation and manage link has always been built on. The link is short-lived, and after that the browser stays signed in for a month so the page is actually convenient to use.

Sign-in links and sessions are stored as hashes. A hash can confirm that the link somebody just presented is the right one, but it cannot be turned back into a working link.

The practical consequence: if a copy of the database were ever taken, it would not contain a set of usable keys to every patient's page. It is the same instinct behind row-level security on the clinic side, where what a team member can see is enforced by the database rather than by hiding buttons.

"When is my next appointment?" "How many laser sessions have I got left?" "What's my referral code again?" "Can you stop sending me offers?"

All four are now a page the patient can open at ten at night, which is when they were going to wonder about it anyway. The offers setting matters especially: a patient turning marketing off themselves writes straight to the consent log, so they immediately drop out of every campaign audience without anybody at your clinic doing anything.

Every booking still has its own private manage link in the confirmation email, which is how a patient cancels within your cancellation window. That works for patients who never sign in at all, including the ones who booked over the phone.

The account page sits alongside it, for the patient who wants the whole picture rather than one appointment. Both are on your own domain, in your own brand, as part of your clinic website.