Security
Sign people out after inactivity or a maximum session length, and choose when Smileline support can see your practice.
Settings → Security holds two kinds of control: the session rules that sign your team out, and Smileline support access. Owners and managers open it.
Session rules
Both rules are off until you switch them on, and both apply to your team's own sessions on the web, in Smileline Desk and in the mobile app.
| Rule | What it does |
|---|---|
| Sign out after inactivity | Signs a person out after the minutes you choose (15 to 720) without their activity |
| Maximum session length | Asks a person to sign in again after the hours you choose (1 to 720) since they signed in |
Switch a rule on, set its value and click Save. Rule sign-outs appear in the activity log among the sign-in events. A new or tighter rule applies at once to screens already open: their live updates reconnect under it, without anyone reloading.
What counts as activity
Activity means typing, clicking, tapping, opening a page, or being on a call. Screens that refresh by themselves — Today and the diary keeping up to date — don't count, so a screen left open on the front desk still signs out. Smileline checks activity once a minute, so a person is signed out within the last minute before the time you set, never later.
The web app warns two minutes before: You'll be signed out in 2 min. Click Stay signed in to carry on. Before a maximum session length ends, the warning tells the person to save their work.
Being signed out signs that browser or phone out of every practice the person belongs to, because a session is theirs, not the practice's. The sign-in screen says why they were signed out.
The inactivity rule guards against screens left unattended. It relies on the app's own record of activity, so it isn't a defence against someone set on staying signed in.
What isn't covered
- Connected apps and API keys, such as Zapier: they don't sign in.
- Smileline support visits, which end after an hour whatever the rules say.
- Your patients' own pages.
For stronger sign-in, ask each person to turn on two-factor authentication in Settings → Account (see Sign in).
Smileline support access
Smileline support can see your practice only when you allow it, and only for as long as you choose.
Under Smileline support access, choose Look only or Look and change settings.
Choose how long: 1 hour, 1 day or 7 days.
Say why support needs to see the practice, then click Allow access.
Click End access now to end it at any time. While access is live, the button reads Replace access: it replaces the earlier access (to switch mode or length, say) and ends any visit made under it.
| Mode | What support can do |
|---|---|
| Look only | See what the team member they choose can see. Nothing changes |
| Look and change settings | Also change your practice settings, templates, automations, boards, sites and rooms, rotas, stock items and clinical catalogue |
Owners and managers can allow Look only. Look and change settings needs an owner or manager signed in themselves: a connected app or API key can never allow it.
What support can never do
In either mode, support can't:
- change patients, appointments, money, clinical records, your team, your security settings or your connections;
- sign, issue or perform anything clinical;
- send messages or emails, or take payments;
- export, merge or erase data;
- open your team's account settings or any other practice.
Support's changes to automations and templates take effect at once. Every message, task, note or stage move an automation produces from content support last changed is recorded in your activity log as coming from it, and so is every review request or campaign message sent from a template support changed. Under Changed by Smileline support, the page lists those automations and reminders, each with Pause, and those templates — including a WhatsApp version still waiting for Meta's approval — each with Pause too. A paused template isn't sent by any automation, reminder or review request until you click Resume; a message one of them had already queued is held too, and shows as not delivered so you can retry it after resuming. Campaigns aren't paused: a campaign is sent by someone at the practice. Saving your own version of one takes support's mark off it; a WhatsApp version support wrote keeps its mark until Meta approves it and it goes out, even when someone at the practice resubmits it.
Seeing what support did
While a visit is under way the page shows Smileline support is viewing as Jane Doe since 13:05, and lists past visits below. A visit that ran out by itself (its hour, or your access, ended) shows as ended straight away, and is recorded in the activity log within five minutes. Every page support opens is recorded in your activity log before it's shown, then again with its outcome, and every change carries Smileline support (as …) as its author. See every visit and change in the activity log opens the log's Support access filter.
Smileline operations
Occasionally Smileline operations must open a stored inbound message — a lead form submission or a provider's message that couldn't be delivered — to fix it. That needs a written reason and a fresh two-factor check, and it's recorded in your activity log, with the reason, before the message is shown. It doesn't need your support access, because fixing stuck data mustn't wait.