Answers before tickets

A Mac (Apple Silicon or Intel) for the signed desktop release, or Windows for the unsigned preview build. The clinician mobile app is a PWA — it installs from the browser on iPhone, iPad and Android with a Practice edition.

Download, install, register, work. Every new install gets a full-featured 30-day evaluation window with no card and no key. When it ends, everything you documented stays fully accessible; installing a licence key is what keeps new patient intake open.

No. Solo practices run entirely on one machine. Multi-device sync on Practice editions uses our relay — there is nothing for you to host, and the relay only ever stores ciphertext.

Export an encrypted .cfbak file at any time — it captures the whole practice and restores from scratch. Practice editions also keep an encrypted relay-side backup. Both stay available in every licence state.

The database is encrypted at rest (SQLCipher, AES-256) with keys held in hardware-backed custody on your machine. Field-level encryption covers sensitive values inside it; raw keys never appear in the interface or in logs.

FHIR bundles, PDF reports, CSV and the .cfbak archive — from the export screens, in every licence state, forever. De-identified export with automatic redaction is built in for sharing beyond the care relationship. More on export & backup.

Fill the CSV templates from your old system's export and import them under Settings → Import data: patients and historical session notes come across, with a preview of problems and duplicates before anything is written. Prior PDFs attach to each chart as documents. The migration guide & templates.

With a Practice edition, enroll the device from the app — enrollment is explicit, and a seat includes three devices. The new device receives the encrypted history through the relay and converges automatically.

Revoke it. Its sync access ends immediately, and the data already on it stays encrypted at rest — losing hardware is not disclosing records.

Everything keeps working — the app is local-first. Changes queue on the device and sync merges them when you're back online; simultaneous edits converge rather than overwrite.

The in-office kiosk — patients completing forms on a practice device — ships in every edition including Solo. The remote portal, where patients message, book and complete PROMs from home, is what the Portal edition adds.

By invitation from the practice. You control who can message and book; patients see only their own record's surface — messages, documents, forms and bookings.

One key covers the practice — every desktop installs the same key, with seats for named practitioners (admin, front-desk and auditor accounts are free). Verification is offline after a one-time activation, so an outage on our side can't lock you out.

Growth-side capabilities pause — sync, new device enrollment, portal publishing. Your existing records stay readable, editable and exportable in every licence state. The full capability matrix is published on the pricing page. See the degradation matrix.

Card and seat management runs through our merchant of record's customer portal — the billing link in the site footer takes you there.