How it works offline, and what protects your patients’ data
This page describes what the software actually does, without overstating it. What has not been built yet says so.
Working with no connection
After the first sign-in, the device copies its clinic’s data into a local store inside the browser and keeps the application files. From then on every screen reads from that copy, not from the network.
- The target is fourteen full days with no connection at all, limited only by the device’s storage
- Patients, the chart, visits, plans, prescriptions, appointments, the queue, invoices, payments and stock movements are all created and edited offline
- Settings, the service and price list, staff, the audit log and long-range reports need a connection: they are reference data that should never conflict
- A permanent indicator reads synced, syncing, or offline with the number of changes waiting, plus the time of the last successful sync
- Connectivity is measured by a light ping with a five-second timeout, not by the browser’s online flag alone
Sync and conflicts
A sync cycle pushes first and pulls second. The server numbers every change in the clinic with a rising number, and the device asks for everything after the last number it has, so it can never skip a page.
-
The change is saved on the device
The record and its place in the send queue are written in one transaction, before the word “done” appears. Closing the tab or losing power after that loses nothing.
-
The queue is sent in order
Every change carries its own id, and the server applies an id exactly once. Re-sending after a dropped connection never creates a second record.
-
What the device missed comes down
The server numbers every change in the clinic, and the device asks for everything after the last number it holds — a page at a time, compressed.
Three rules, by kind of record
Records that are only ever added
Payments and their allocations, stock movements, tooth events, visit addenda. They always apply and never conflict; a correction is a reversing entry.
Editable fields
Patient details, the medical history, appointment fields, plan items, a visit inside its edit window. The change carries the old and new value for each field; if the server’s value has moved on, the change that arrived last is applied and the value it replaced is recorded on the conflicts screen. Fields the change did not touch are never altered.
Statuses and locked records
Appointment status, issuing and voiding an invoice, issuing a prescription, a visit after it locks. The current status is checked on the server; an invalid transition is rejected, and the current record comes back with the reason and the right way to fix it.
- Two patient files created on two devices for one person are both kept and flagged for merging; neither is deleted automatically
- Two overlapping appointments created on two devices are both kept and flagged for staff to resolve; neither is cancelled automatically
- An expired subscription never stops the server accepting changes from devices: no data is lost over an invoice
- If the server is ever restored from a backup, devices push back what the restore lost and then download the dataset again
Device numbering
Every device in a clinic carries a short code: A, B, C. File, invoice and receipt numbers are written as that code plus the device’s own counter — A-0153. That is how two devices can issue two invoices at the same moment while both are offline, without a single number colliding, and without any number changing after sync. A device that is wiped and registered again takes a new code, so an old number is never reused.
Signing in on a shared PC
The front-desk machine is used by several people, and it stays open between patients. So it locks after an idle time you choose, and unlocks with a 4 to 6 digit PIN that works with no connection.
- The session is kept encrypted on the device and only its owner’s PIN opens it
- Every change is attributed to the member who entered it, not to the machine
- Five wrong attempts force a full online sign-in; the local data and any waiting changes are kept
- Signing out is blocked while a change is still waiting, unless the clinic admin confirms, and the change is exported first
What you should know: browser storage on the device is not encrypted by default. That is why we rely on the PIN lock, on wiping the data at sign-out and when a device is revoked, on a device limit per plan — and why we ask clinics to keep an operating-system password on every machine.
Roles and permissions
There are four roles and they are fixed in code: clinic admin, dentist, receptionist, accountant. One membership may hold several, and its permissions are their union. A solo dentist holds all four, and the team-sized choices disappear from their screens.
- The server checks the clinic and the permission on every request and on every change arriving by sync. The interface hides what is not allowed, but the server decides
- Clinics are isolated from one another: the clinic id never comes from the browser, only from the device token
- The last clinic admin cannot be removed
- An audit log keeps who changed what and when, the value before and after, and from which device
Backups and data ownership
A clinic’s data belongs to the clinic. We process it on the clinic’s behalf and use it for nothing else.
- Regular backups of the database and attachments by the hosting provider
- A full copy of the clinic’s data: CSV and JSON files with the images
- Platform staff reach clinical data only by signing in temporarily as a clinic user, with a written reason and a time limit, and it shows in the clinic’s own audit log
- Hosting is outside Palestine, and we say so when the account is opened
- Clinical and financial records are kept with no time limit while the clinic subscribes
What is not ready yet
Offline work, sync and the PIN lock ship in release 1.1, and SMS in 1.2. The first release needs a connection — but the database carries the sync columns from day one, so no clinic has to move its data later. We write this here because honesty is part of trust.
It starts with a short call
Send the request and we will call you, work out the size of your clinic, open the account and set up your price list together. No card, and no self-signup.