Roles & Permissions
Your clinic's roles, what each one can do, and how to make your own
Every member of your clinic has one role. Roles belong to your clinic: you can edit the built-in ones and make your own in Settings → Team → Roles.
The built-in roles
| Role | Who it's for |
|---|---|
| Owner | The account that created the clinic. Always has every permission |
| Manager | Runs the clinic with you: same as the owner for bookings, patients, Finance, expenses, settings and the team, except salaries and the owner-only actions below |
| Reception | Reception and front desk: bookings, check-in and payments |
| Doctor | A clinician who sees their own patients in the Doctor Portal |
| Finance manager | The accountant or partner who runs the money: takes payments, sees Finance and adds and edits expenses, without booking, the inbox or settings. Only the owner gives it |
| Doctor's assistant | Works with one or more doctors: calls the queue, checks patients in, sees patients, uses the stock. Each doctor decides about the full record and payments. See Doctor's Assistants |
These six roles can be edited but not deleted. Only the owner can rename the Owner role; its permissions always stay "everything", so the owner can never lock themselves out.
The Team page, the invite cards and the role menus show each role by your clinic's name for it: if you rename Reception, the new name shows everywhere.
Permissions
Each role has a set of permissions, each one a switch:
| Group | Permission |
|---|---|
| Schedule | Book, move and cancel appointments · Check patients in and move visits along · Open and end the clinic day |
| Patients and inbox | See the patients list and files · Open the inbox and reply to patients |
| Money | Take payments from patients · See Finance: revenue, statement, cash flow · Add and edit expenses |
| Stock | Use the stock: receive, adjust, add items |
| Team | Manage attendance and leave · See and pay salaries |
A permission that's off hides the page from the menu, and Docistra refuses the action, even from a typed link. A page opened directly without its permission says Your clinic role doesn't open this page.
Sensitive permissions
See Finance: revenue, statement, cash flow, Add and edit expenses and See and pay salaries are marked Sensitive: they show the clinic's money and the team's pay. They belong to the owner:
- Only the owner can turn one on or off on a role. A manager sees those switches locked, with a tooltip.
- Only the owner can invite someone into, move someone into, or move someone out of a role that holds one. That includes Finance manager and any role you made with Finance on. A lock icon next to the member shows what a manager can't change.
- When a manager presses Duplicate, the copy starts with those switches off.
- A manager can still remove such a member from the clinic.
The Manager role starts with Manage attendance and leave but without See and pay salaries: salaries stay with the owner until they give that permission to a role. See Payroll.
Access level
When you make a role you also pick its Access level:
- Reception: front-desk work. A Reception-level role never opens the clinic's Settings or the Team page, whatever its switches say.
- Manager: everything, including Settings and the Team page. Only the owner can pick it.
The access level sets what a role can never do; the switches take things away (a "Call center" role without Take payments from patients) or give a Reception-level role a manager area (See Finance and Add and edit expenses).
Clinical records follow their own rule, whatever the role: only doctors write them. An owner or manager reads them only if they're also one of the clinic's doctors, or if the owner turned on clinical read in Settings → Organization → Access. A doctor's assistant reads them only where their doctor allows it (Doctor's Assistants).
For an accountant or a partner who should see the money but not change settings, use Reception access with See Finance and Add and edit expenses on. That's what the Finance manager role is.
Make a role
Open the Roles tab
Go to Settings → Team and open the Roles tab, then press New role.
Name it
Type the name in English or Arabic. When you leave the field, Docistra translates it into the other language; that field shows Translating… until it's done, then you can edit it.
Pick the access level and the permissions
Choose Reception or Manager (owner only), then turn on what this role can do. Press Save.
A role you make is always built on Reception or Manager. Open any role to change it; the change applies right away to everyone with it. If someone else saved the role while you had it open, Docistra tells you instead of overwriting their change. Duplicate starts a new role from it. Delete works only when nobody has the role (and no invite is waiting with it).
Give someone a role
- Existing member: on the Team tab, pick their role from the menu next to their name. Picking Doctor's assistant asks for their doctors first.
- New member: when you invite them, pick Manager (owner only), Reception, Doctor's assistant (when the clinic has doctors) or Finance manager (owner only), or one of your own roles under Or one of your clinic's roles.
The Manager role, the roles built on Manager, and every role with a sensitive permission are the owner's to create, edit, give or take away.
What the built-in roles can do
| Owner | Manager | Reception | Doctor | |
|---|---|---|---|---|
| See appointments | All | All | All (or their branches) | Own only |
| Create bookings | Yes | Yes | Yes | No |
| Move appointment stages | Yes | Yes | Yes | Own only |
| Record payments | Yes | Yes | Yes | No |
| Read the clinical record | If also a doctor, or with clinical read on | If also a doctor, or with clinical read on | No | Yes |
| Write diagnosis, prescriptions, lab and scan orders, medical alerts | If also a doctor | If also a doctor | No | Yes |
| Print or send the finished prescription | Yes | Yes | Yes | Yes |
| See patients | All | All | All (or their branches) | Only patients they've seen |
| Doctors, services, knowledge base | Edit | Edit | View only | No |
| Clinic settings and the Team page | Yes | Yes | No | No |
| Clinic Agent, Finance, WhatsApp Ads | Yes | Yes | No | No |
| Salaries and payroll | Yes | No (unless given) | No | No |
| Invite and remove team members | Yes | Yes (not managers) | No | No |
| Add or remove managers, transfer ownership | Yes | No | No | No |
| Enable lab or radiology modules | Yes | No | No | No |
| Request subscription cancellation | Yes | No | No | No |
This is the default; your clinic's switches change it.
Branch restrictions
When you invite a team member, or add a doctor, you can choose specific branches. They then only see appointments and patients for those branches, and in Finance only those branches' money. Owners and managers always see every branch.
Solo-doctor clinics
If your plan allows one doctor, the doctor role isn't offered on the Team page. The owner can write chart notes directly.