Roles and access
Staff authentication
- Email + password
- TOTP MFA available; enforcement controlled per deployment (
MFA_ENFORCED) - SSO remains planned — Roadmap
Patient authentication
- Patient ID + PIN (staff-provisioned)
- Terms acceptance required at first login — see Terms & patient consent
- No self sign-up
Staff roles
Full matrix: Role permissions.
Multi-facility access (rolling out)
When enabled for a deployment, each facility’s patients and staff are isolated via RLS scoped by facility membership. Staff granted membership in more than one facility switch facilities before working with that site’s data.
Until multi-facility is confirmed for your site, assume single-facility
operation. See Roadmap.
Provisioning
Admins:- Grant roles listed above
- Configure facility membership when multi-facility is enabled
- Bulk-import staff and patients where enabled
- Assign program enrollments within seat caps
Chess instructor assignment
Staff with appropriate policy (pt and/or admin) can assign Chess Wellness
activities to enrolled patients. Engagement metrics appear on
Admin analytics — not as individual clinical PHI.
What’s next
Role permissions
Full permission matrix.
Facility onboarding
Enrollment and deployment.
Roadmap
Multi-facility rolling out.