Team access
Give every team member their own login and the right level of access. When someone leaves, remove them in one step and their access ends right away.
Team
Add with emailDr. Amna S.
amna@democlinic.example
Omar K.
omar@democlinic.example
Dr. Hira M.
hira@democlinic.example
Front desk
desk@democlinic.example
Access rules are enforced by the database, not just hidden buttons.
Many clinics run their booking tool on a single login that half the team knows. It feels convenient until the day it isn't.
A new front desk hire edits a treatment price by mistake. With one shared account, nobody can say who did it or stop it happening again.
A staff member moves on. Changing the shared password means telling everyone else the new one, so it often doesn't get changed at all.
Some tools simply hide menu items from junior staff. The data underneath is still reachable by anyone who knows where to look.
How it works
Team access lives in the admin panel. An admin can set up a new colleague in the time it takes to write their email address.
Enter the team member's email address. They receive an invitation and set up their own login, so no password is ever shared.
Pick admin, manager, practitioner or front desk. The role decides which parts of the panel and which data that person can reach.
When someone leaves or changes jobs, remove their access from the same screen. It takes effect instantly.
Team
Add with emailDr. Amna S.
amna@democlinic.example
Omar K.
omar@democlinic.example
Dr. Hira M.
hira@democlinic.example
Front desk
desk@democlinic.example
Access rules are enforced by the database, not just hidden buttons.
Everyone at your clinic is in one team list, whether they're a practitioner patients book with, someone who signs in, or both. Each person gets one of four roles:
Plenty of software controls access by hiding buttons. The data is still there; the menu just doesn't show it. That is a thin layer of protection.
Velvet Lead is built on a Postgres database with row-level security, provided through Supabase. The rules about who can see what are checked by the database itself on every request. If a role isn't allowed to see something, the database doesn't return it, whatever the screen shows.
On top of that, each clinic has its own separate database. Your patients' details and inquiries aren't stored alongside another clinic's data.
Each team member signs in as themselves. There's no clinic-wide password on a sticky note at the front desk, and no need to change it every time the team changes.
Personal logins also make daily work clearer. Leads can be assigned to a named team member, and the activity history on each lead shows the work done on it.
Staff turnover is normal in clinics. Front desk staff move on, temporary practitioners finish a contract, a marketing assistant only helps for a season.
When someone's time with you ends, remove their access in the admin panel. It stops right away. Nobody else's login is affected, and you don't have to reset anything for the rest of the team.
Your booking system holds names, phone numbers, email addresses, appointment history and marketing consent records. Patients expect that only the right people at your clinic can see those details.
Clear roles, personal logins and database-level rules are a sensible foundation. They don't replace your own clinic policies, but they make those policies far easier to follow. You can read more on our security page.
A dermatology clinic might give its practice manager a manager role and its front desk team staff access, while the owning doctor stays admin. A dental practice with rotating associates can add and remove people as schedules change.
A cosmetic surgery practice often has patient coordinators handling inquiries; each can have their own login with leads assigned to them by name. A private doctor's practice with a small team still benefits from personal logins rather than one shared account.
Honest limits
Roles protect the booking and inquiry data in your admin panel. Here are the boundaries.
FAQ
Add them to the team list with their email and choose a role: admin, manager, practitioner or front desk. If they already have an account it's linked; otherwise one is created and they're emailed an invitation.
Admins see everything, including who can sign in and the clinical audit log. Managers handle services, team, website, settings and the chatbot. Practitioners get the front desk tools plus clinical records and their own day. The front desk handles leads, bookings, check-in and walk-ins.
Remove their access in the admin panel and it ends instantly. Other team members keep working as normal, with no shared password to change.
It's enforced by the database. Velvet Lead uses a Postgres database with row-level security through Supabase, so data a role isn't allowed to see is never returned to that person.
Not currently. There are four roles: admin, manager, practitioner and front desk. Choose the one closest to each person's job.
Book a demo and we'll show you how to invite a team member, choose a role and remove access on our demo clinic.