30 Sept 2026
Trust, enforced: branch walls in the database, private patient photos & invoices that add up
Security you can explain in one sentence: staff see only their own branch because the database itself says no, patient photos open only through links that expire, and every invoice, payment and refund leaves a numbered trail with a name on it.
What you are buying
In plain terms: the rules you set for who sees what are no longer polite requests that each screen tries to honour. They are enforced underneath the app, in the database itself. A receptionist at your Thonglor branch cannot open a Silom patient — not through search, not through a report, not by accident. And every baht that moves now leaves a numbered trail with a name on it.
Five walls we built in September
- Branch walls in the database — every branch-scoped table now checks which branches the signed-in person is assigned to, and the database refuses other branches' rows, whatever the request asks for. Clinic-wide records stay visible to everyone allowed to see them.
- Your clinic, your own database role — each clinic's data sits in its own schema, owned by its own database role. One clinic's connection has no permission on another clinic's tables.
- Private patient photos & documents — before-and-after photos, scans and uploaded files live in private storage. Staff open them through a signed, short-lived link (30 minutes by default).
- Clinical actions need clinical permissions — prescribing and signing clinical notes now have their own permissions, held by clinical roles. Reception keeps the patient admin it needs; archiving a patient is an administrator's call.
- A record of who browsed patient lists — opening one patient was already written to that patient's audit trail. Now opening the patient registry or the clinical hub is recorded too: who, which screen, how many rows. Never the search terms, never the names.
What happens if…
| If someone… | What happens now |
|---|---|
| 🔍 searches for a patient who belongs to another branch | Nothing comes back. The database filters the rows before the app ever sees them. |
| 🔗 forwards the link to a before-and-after photo | The link stops working within the half hour. Patient photos never sit at a public address. |
| ✍️ at the front desk tries to sign a doctor's note or write a prescription | Not allowed. Those actions belong to clinical roles. |
| 📋 scrolls through the full patient list at 11 p.m. | It is recorded: who opened which list, when, and how many records it showed. |
| 🧾 changes the clinic's tax rate next year | Old invoices keep the rate they were issued at. History is never rewritten. |
The money trail
Security is not only about who sees a chart. It is also about who touched the money.
Numbers in sequence
Invoice numbers now run in order, one series per prefix per year — INV-2026-000041, INV-2026-000042 — the way a tax invoice should read.
Tax rate frozen per invoice
Each invoice remembers the tax rate it was raised at. Change your rate next year and this year's invoices stay exactly as issued.
Payments & refunds attached
Every payment and every refund is linked to the invoice it belongs to — not just mentioned in a note someone has to find later.
Every money action has a name
Invoice created, edited, sent or voided; payment taken; refund given. Each one is recorded with who did it and when.
Five questions to ask any clinic software vendor
- If a staff member runs a report, is it the database that stops them seeing other branches — or just the screen?
- If a patient photo link is forwarded, does it still open next week?
- Can the front desk sign a doctor's note?
- Do invoice numbers run in sequence, per year?
- Can you see who opened your full patient list last night?
Our answers: the database · no · no · yes · yes.
Why "secure by design" is more than a slogan
A lot of software protects data in the screens: hide a button here, filter a list there. That holds until someone finds the one screen that was missed. When the rule lives in the database, the missed screen gets the same answer as every other one — no. That is the difference between a promise and a safeguard, and it is what you want to point to when a patient asks how their records are protected under Thailand's PDPA.
Owner's tip: staff see the branches they are assigned to, set on each branch's staff screen. Someone who works Mondays at Thonglor and Fridays at Silom belongs on both; a manager who oversees everything belongs on all; new accounts start in one.
Comments
Ask us anything about this update
Get started
Schedules, charts, and pipeline — in one workspace.
Prefer a human conversation first? Talk to our team.
- Free 7-day trial
- Free setup call
- We import your patients for you