In this article
Owners, managers, and IT admins add staff, assign roles per branch, limit the scope of medical record data, set up separation of duties, and review access regularly. Every access change is recorded in the audit log together with its before and after state.
Adding a user
- Open Admin → Users & roles, the Users tab, then Add user.
- Enter the name, email, WhatsApp number, profession (doctor, dentist, midwife, nurse, pharmacist, analyst, radiographer, therapist, physiotherapist, staff), and display title (dr., drg., Bd., Ns., apt.).
- For healthcare workers, enter the NIK (national identity number), STR (registration certificate) and SIP (practice license) numbers, and the SATUSEHAT Practitioner ID (IHS). The NIK is stored encrypted and displayed masked.
- Choose branches: all branches, or specific branches.
- Tick the roles. For each role you can set:
- Data scope: Own patients, Branch, or Entire clinic (leave empty to use the role default).
- Valid until: for locum doctors, interns, or consultants. After that date the permissions are removed automatically, without having to deactivate the account.
The number of users and healthcare workers is limited by your plan. When the limit is reached, add the "Additional users" add-on or upgrade your plan.
Built-in roles
| Role | Access summary | Default data scope |
|---|---|---|
| Owner | All modules and settings. Cannot be changed or delegated. | Entire clinic |
| Clinic Manager | Operations, reports, users, approval of POs/payroll/discounts/voids. No medical record content. | Entire clinic |
| Doctor | Consultation, diagnosis, prescriptions, diagnostic orders, confidential medical records | Own patients |
| Midwife | MCH and midwifery care, confidential medical records | Own patients |
| Nurse | History taking and vital signs. NIK masked, no confidential medical records. | Branch |
| Therapist | Physiotherapy and aesthetic treatments | Branch |
| Registration Admin | Registration, queue, booking. No medical record content. | Entire clinic |
| Pharmacist | Prescriptions, pharmacy stock, creating POs (approved by a manager) | Branch |
| Warehouse Staff | Goods receipt, stock transfers, stock take | Branch |
| Laboratory Analyst / Radiographer | Diagnostic results | Branch |
| Cashier | Invoices, payments, cash closing. Patient NIK/phone/address masked. | Entire clinic |
| Finance Staff | Claims, receivables, payables, manual journal entries (draft) | Entire clinic |
| Accountant | Journal approval, reports, tax, period closing | Entire clinic |
| HR | Employees, schedules, payroll (approved by a manager), doctor fees | Entire clinic |
| Marketing / CRM | Membership, vouchers, broadcasts. Patient data masked. | Entire clinic |
| Auditor | Read-only: audit log, access reviews, finance, stock, HR. No medical records or patient identity. | — |
| IT Admin | Users, roles, integrations, API, security. No clinical or patient data. | — |
The full list of permissions per role and per endpoint is in the technical document docs/security/rbac-matrix.md.
Medical record data scope
- Own patients: a doctor only sees the visits they handle (plus open queue entries in their branch that have no doctor yet, so they can claim them when starting the consultation) and patients they have treated before. Patient search is restricted as well.
- Branch: all visits in the branches where the user is assigned.
- Entire clinic: no restriction.
Example: the clinic's doctor in charge can be given the Entire clinic scope on their own assignment only, without changing the Doctor role for other doctors.
Confidential medical records and identity data
- A visit can be marked confidential (HIV/STI, mental health, reproductive health, substance use, other), and a patient can be marked confidential so that their entire medical record is protected.
- Only roles with the "View confidential medical records" permission (built-in: Doctor, Midwife) can open the content. Every access and every denied attempt is recorded in the audit log.
- In the queue list, confidential visits still appear (so care can continue), but the chief complaint and history are hidden.
- Without the "View full patient NIK, phone, and address" permission, the NIK, phone number, and address are masked by the server, not just on screen.
Custom roles and the permission matrix
- Permission matrix tab → enter a name for the custom role → Create role.
- Use the search box (for example "void", "NIK", "journal") and tick permissions per module.
- Click Review changes to see which permissions are added and removed, then Save changes.
Security rules:
- You can only grant permissions you hold yourself (other permissions are locked). Removing permissions is always allowed.
- Permissions with a padlock are administrative permissions; roles containing them can only be assigned by users who hold those permissions.
- The Owner role cannot be changed. The permissions of built-in roles cannot be changed; create a custom role for other combinations.
- No user (except the Owner) can change their own roles or branches, and an organization always keeps at least one Owner.
Delegating a role during leave
Users with the "Delegate own role" permission (built-in: Doctor, Midwife, Pharmacist, Finance, Accountant, Manager) open Admin → My access & delegations → Delegations → Create delegation, then choose a colleague, the role, an end date (at most 90 days), and a reason. A delegation:
- takes effect immediately and ends automatically on time;
- lapses if the delegator no longer holds the role or their account is deactivated;
- cannot be delegated further, and the Owner role cannot be delegated;
- can be revoked at any time by the delegator, the recipient, or a user admin.
Separation of duties and approval limits
Separation of duties tab (permission "Manage separation-of-duties policy"):
- Maker-checker: purchase orders, manual journal entries, discounts above the threshold, invoice voids above the threshold, and payroll cannot be approved by the person who created them. Manual journal entries and discounts are on by default; click Apply recommendations to turn them all on.
- Approval limits per role: maximum discount (%) and maximum void amount. A cashier with a 3% limit who gives a 5% discount automatically waits for approval; an approver whose limit is lower than the discount is rejected. Leave empty for no limit. The Owner never has a limit.
Regular access reviews
- Effective permissions tab: choose a user and branch to see each permission and where it comes from (role, branch, delegation, validity period).
- Access review tab: a summary of stale accounts (no sign-in for more than 90 days, configurable), accounts with admin access, accounts without 2FA, and assignments that expire soon. Click Download CSV to archive the review (recommended every quarter). Downloads are recorded in the audit log.
- The Auditor role can open access reviews and the audit log without access to patient data.
Deactivating a user
Set the user's status to inactive when a staff member leaves. All of that user's sessions and mobile device tokens end. Do not share accounts: medical records must record the identity of the healthcare worker who wrote them.