Sign in and sessions

PracFlow uses one-time passcodes rather than passwords, for you and for your clients. A code is sent to your phone or email and is valid for ten minutes. Because there is no stored password, there is nothing to be reused across sites or leaked in someone else's breach.

The practical consequence is that access to your practice follows access to your phone number or mailbox. Secure those accounts properly, and avoid staying signed in on a shared or public computer.

Conversations carry an extra PIN on top of your sign in, because message threads may contain clinical detail.

Client confidentiality inside your practice

Records are scoped to your practice, and within a practice to the clinicians assigned to a client. A team member does not see the whole caseload by default; they see clients where they are the primary or an additional therapist.

Owners can tighten this further by masking client email addresses and phone numbers from members, and by restricting who can view form responses. See Business Settings.

Files you upload, including note attachments, report PDFs, signatures and payment proofs, are stored in cloud storage and served through links that expire, typically after an hour. A copied document link does not remain accessible indefinitely.

Audit logs

Audit Logs records who created, changed or deleted what. Filter by date range, the area of the system, and the type of action. Owners and admins can also filter by user; members see only their own actions.

Open any entry to see the full detail of the change. In a group practice this answers questions like who cancelled a session or who altered a fee without anyone having to reconstruct it from memory.

What remains your responsibility

PracFlow provides the technical controls, but professional and legal obligations stay with you as the clinician.

• Obtain informed consent, including for storing records digitally. Publish your consent form text in Business Settings.
• Apply the correct role when inviting team members, and deactivate people promptly when they leave.
• Only record clinical information you need, particularly diagnostic codes on documents that will be shared.
• Check who a document is going to before you send it, especially reports and charge slips.
• Meet your own jurisdiction's requirements for record retention and data protection.
• If you use external AI tools on your notes, remove identifying information first. PracFlow publishes a de-identification tool for this.