Clinic security settings

Two rules on this page apply to everyone at your clinic: whether two-step verification is compulsory, and whether staff can trust a device to skip the code. As the data controller, your clinic decides.

Before you start

• Only owners can change these settings.
• Before you require two-step verification, tell your team. Each person needs a UK mobile phone to hand the next time they use Clinicify.
• Set up two-step verification on your own account first. See Set up two-step verification.

Steps

1. Select your name at the bottom of the sidebar, then Clinic settings.
2. Under Team & access, select Security.
3. Tick or untick either setting:
   • Require MFA for all staff: off to start with.
   • Allow “always trust this device”: on to start with.
4. Select Save changes in the bar at the bottom of the screen.

What happens next

When you require two-step verification

• Anyone on your team who hasn’t set it up is taken to the setup page the next time they open a page in Clinicify, and can’t reach anything else until they’ve finished. This includes other owners.
• Team members who already use it carry on as before.
• Nobody can turn off their own two-step verification while the rule is on. They’ll see Your clinic requires MFA for all staff, so it can’t be turned off.

When you turn off “always trust this device”

• Staff no longer see Always trust this device when they enter a code.
• Devices people trusted earlier stop being trusted straight away, so everyone who uses two-step verification is asked for a code at their next sign-in.

Turn it off if your team shares computers, or if any computer at your clinic is used by the public.

Good to know

• Two-step verification codes are sent by text to UK mobile numbers only.
• If a team member changes their number while the rule is on, they can’t switch two-step verification off to set up the new number. Untick Require MFA for all staff, save, let them set it up again, then turn the rule back on.
• Trusting a device only skips the text message code. Staff always sign in as normal.
• These settings are separate from each person’s own Security page under Your preferences, where they manage their own code, sessions and trusted devices.