Everyone on their own account and permissions, and you know who did what, and when

Invite by the person's email or by code

An email invite can only be accepted by the account with that email, and only once; a code invite can be accepted by whoever receives its link. Every invite expires after 72 hours, and pending invites stay in a list where you copy the link or cancel the invite.

Five ready-made roles

Clinic manager, veterinarian, receptionist, groomer and photographer, each with its starting permissions. The server fences the photographer account to product photos and the online store's products and storefront, with no access to orders.

A staff profile for each person

Name, photo, phone, email, specialty, join date and a short bio. At the top of the page: team size, active staff, who is waiting to join, and who is working in the app right now.

Removing someone ends their access

When a staff member leaves and you remove them, their access to the clinic is closed on the server in the same step and their invite code is voided. Adding, editing and removing staff are recorded in the activity log with who did it.

A switch for each permission

From the calendar, adding patients and editing medical records to the till, stock, sales reports and settings: start from the role's defaults, then switch each permission on or off for each person.

Sensitive ones stay off unless you allow them

Five permissions are marked sensitive: profit and revenue, deleting invoices permanently, clinic settings, staff management, and payroll. They are off for every role except manager, and granting one shows its name and asks you to confirm.

Locking the shared computer

A manager locks the shared reception computer from their account. The day's work stays open, and until the manager PIN is entered it locks reports and the activity log before today, profits, invoice deletion, staff editing, and stock editing unless you allow it.

Manager access for 10 minutes

A staff member types the PIN and the server grants manager access for 10 minutes, then it ends. Every five wrong tries lock the PIN, for 5 minutes the first time and then double each time up to 24 hours, and every unlock and every wrong try goes into the activity log.

An activity log with names

Sales, refunds, invoice edits and deletions; stock, prices, purchases and expenses; pets, doses and vaccines; staff and settings changes; sign-ins and the manager PIN. Money and stock entries are kept for a year, everything else for 90 days.

Filters that take you to the action

Pick the period (today, yesterday, 7 days, 30 days, this month, last month or your own range), then the type of action from chips with counts, or the staff member, or search by action, staff name or pet name. The chart shows a single day hour by hour and longer ranges day by day; tap a bar to zoom into it.

"Was → now" for every edit

The log shows each changed field's value before and after the edit. A deleted invoice stays visible in it with who deleted it and when, and nobody in the clinic, the manager included, can edit or erase a line of the log.

"Online now" and "last seen"

A green dot shows who is working in the app this moment, and when everyone else was last seen. Each person's app checks in once a minute while it's open, and the list refreshes every 30 seconds.

Dated salaries, and a run that freezes once approved

A raise is a new row that applies from its date, so older payslips keep the salary of their day. The monthly run is calculated and reviewed, then approved, which freezes its payslips and deducts advance instalments, then paid and closed. Spot a mistake? Undo the recorded payment if there is one, then un-approve and the instalments return to their balances; both work until the period is closed.

Additions and deductions with reasons

Fixed allowance, on-call, overtime, bonus and retroactive difference; absence, unpaid leave, social security, income tax, lateness, cash shortage, damage and penalty. Bonuses, penalties, shortages, damage and similar items aren't accepted without a written reason, and any item can be reversed in full or in part while its record stays in the history.

Advances and draws

An advance is paid from the cash drawer or by transfer and recovered in monthly instalments, deducted when the run is approved. A draw against the month's pay comes off that month's salary in full. A write-off stops the instalments with a written reason and erases nothing from the history.

A deduction cap, and a payslip that explains itself

You set the day-rate basis (base ÷ 30 or ÷ working days), which absence is worked out from, and a maximum share for deductions; anything above it carries to next month, penalties and other discretionary items first. The payslip prints with your clinic's logo, how each line was worked out, and two signature lines, and the payment is recorded in expenses at the net paid.