Client portal

The client's side, and only their side.

A client sees their own appointments, the documents their practice released to them, and the messages between them. Nothing else — the boundary is structural, not a setting somebody has to remember.

Getting in

A link, not another password

A client can sign in with a link sent to the address the practice already has. People in therapy do not need one more credential to lose, and a password reset at the wrong moment is a reason not to come back.

Paperwork

Consent signed and kept

Intake and consent documents are signed in the portal and stored with the evidence — which version, when, and the signature itself — rather than as a tick box somebody would have to vouch for later.

Messages

Secure, and on the record

Messages sit with the client's record instead of in a personal inbox. Anything the practice sends automatically is marked as automatic, so a client can tell a system notice from something their clinician wrote to them.

Family

Access for a contact, separately

A parent or partner can be given their own access with their own sign-in, rather than sharing the client's. Two people, two accounts, two audit trails.

What each of them actually opens.

No practice management, no other clients, no chart. And a contact given their own access does not simply get a shorter menu — switch between them and the difference is not what is hidden, it is what exists.

Rowan & Field Therapy

Signed in as Dana, the client Her father, a contact

There is no button to pay. Insight Notes records a payment, it does not take one — so the portal shows what is owed and says nothing it cannot do.

Asking for a time

A request, and a clock that starts immediately.

A client can ask to be seen without ringing during office hours. What they send is a request, not a booking — it waits for a person, and nobody lands on a clinician's calendar without one saying yes.

The deadline for answering is stamped the moment the request arrives, from the turnaround the practice set for itself. A clock started later is a clock somebody can forget to start, and the person waiting has no way to know the difference.

Closing the door does not empty the room: A practice at capacity turns new requests off, and the ones already waiting still get an answer. Dropping them on a settings toggle would be a quiet way to abandon people who are expecting a reply.
Not in ten minutes, and not last Tuesday: A practice sets how much notice a request needs, and a time in the past is refused outright. Both are the practice's own settings rather than numbers chosen here.

One thing, said to everybody

The email that has ever ended a practice is the one sent to everybody at once.

A closure, holiday hours, a clinician leaving: things a practice needs to tell every client. One mis-addressed reminder is an incident. One mis-addressed broadcast is a breach with a client count attached, so this path is built to remove the failure rather than to be careful around it.

No recipient list

Each person gets their own message

Not one message to many addresses. One secure message per client, in their own thread, with no shared list existing at any point — so the mistake of putting forty clients of a mental-health practice in each other's view is not one the product can make.

Contentless email

The notice is in the portal

The body is the practice's own words, but the fact that a named person hears from a mental-health practice is not. Email says a message is waiting; the portal holds what it says.

As it resolved

Who it reached is kept, not recomputed

The audience is recorded as the list it actually was. Re-running the query a year later returns a different set of people, and "who did this reach" is a question that has to stay answerable long after the caseload has moved on.

And who it missed

Skipped people are named

A client who could not be reached is recorded with the reason rather than silently dropped, because that is the list somebody has to pick up the phone about. Pressing send twice is refused outright — a practice that did needs to know, not to have the second press quietly absorbed.

A client can say their record is wrong

From their own account, without asking anybody. What they say arrives with the practice rather than changing the record on its own, and both values are then kept: what the record said, and what they say it should say.

Overwriting the first would erase the fact that a person had to correct it. That history is exactly what the right to amend a chart exists to preserve, and a misspelled name or a wrong date of birth deserves the same treatment — those are the details that follow somebody onto every claim and every letter.

A portal that cannot show the wrong chart.

The client's side runs on its own authentication, separate from staff entirely, and every record it reads is scoped to that client before anything is rendered. A portal that leaks is not a bug report, it is a breach notification — so the separation is built into how the data is fetched rather than into what the page remembers to hide.

How records are protected

The rest of it

Start with the week you are already having.

Set up a practice, put a real week in the calendar, and see whether it fits before you move anything across.

Start free Read the documentation