DH EMR Clinic guides

Admin guide

For the person who runs DH EMR Clinic for an organization: approving staff, setting roles, sharing the join link, keeping forms, lists and the formulary right, and taking backups. A staff member's day is in the user guide; the cloud project and the first admin are in Setting up DH EMR Clinic for your organization.

Clinic has one kind of admin: a staff account with the Admin flag. Devices have no admin role.

1. The admin account

Every staff account has a station role (Reception, Triage, Provider, Lab or Pharmacy) and an Admin flag. The Account card under Settings shows yours: Name, Role, and Admin "Yes" or "No". The flag is given with Make admin (section 2); the very first admin is made with one SQL line in the setup guide.

An admin gets the Staff tab, every other tab whatever the role, the whole visit form ("Administrators always see and edit every section.") and the settings editors on any device. Only an admin account can approve, revoke, make admins or write settings to the cloud; the server refuses a non-admin, not just the screen.

What a non-admin sees under Settings

The editors are visible but turned off, so anyone can see what exists and knows who to ask. Renaming the device, syncing, backup, restore and import work for any account.

Where	What it says
Hover text of every disabled control	"Only an administrator account can change this. Ask your clinic's admin."
The Clinic lists card	"Editing is turned off: only an administrator account can change clinic lists, the formulary or lab tests. Ask your clinic's admin."
The Form templates card	"The editor opens read-only: only an administrator account can change form templates. Ask your clinic's admin."
The template editor and the range editor	A "Read only" banner with the same reason.

2. The Staff screen: accounts

The Staff tab is shown to admin accounts only, with two cards: Invite a device (section 3) and Staff accounts, where "A new account can see nothing until it is approved here."

Each row has the name (or "Unnamed account"; "(you)" on yours), a chip "Pending", "Active" or "Revoked", a role chip, and an "Admin" chip on admins; oldest first. Changes are confirmed in a message above the cards; a server refusal appears there in the server's own words, and the list reloads.

Approving a new account

1. The staff member creates an account from a device's sign-in screen and lands on "Waiting for approval".

   Your Staff screen says "1 account is waiting for your approval." (or "3 accounts are waiting for your approval.").

2. Set their station role (next heading).

3. Tap Approve on their row.

   "Grace N. is approved and can sign in now."

4. They tap Check again on their device and land on their role's workspace.

Setting the station role

Pick a role from the list on the row; it saves at once: "Grace N. is now Triage." The role decides the tabs, the landing screen and the visit form slice:

Triage and Provider land on their station queue: today's visits at that column, longest-waiting first, under the station name and "date · N waiting · M at previous station". Each visit has Open and a Next button ("Next: Lab" for the provider); Open the Board is one tap away. Lab and pharmacy have no Board tab.

An admin gets every tab plus Staff, landing on the Board (after Lab or Pharmacy for those roles). The form slice is changed in the Roles grid (section 5); the user guide walks through each role's day. A role change reaches the device at its next account check; reopening the app does that at once.

A role not on the list, for example "nurse" from an older version, is shown as stored and treated as Triage; any other unknown value is treated as Provider. Pick a real role and it goes away.

Revoking and restoring

1. Tap Revoke on an active row.

   "Revoke access for Grace N.? They are locked out the next time their device talks to the server. Nothing they recorded is deleted, and you can restore them here later."

2. Confirm.

   "Grace N. is revoked. It takes effect when their device next connects." The row gets a "Revoked" chip and a Restore button.

3. To let them back in later, tap Restore.

   "Grace N. is restored and can sign in again." Check again on their device lets them in.

From then on the server refuses every request from the account; their device's next check lands on "This account has been turned off", which ends: "No records have been lost. Anything this account already saved is safe with your organization." The card's footer: "Revoking never deletes anything: visits an account recorded stay in the organization."

Making and removing admins

1. Tap Make admin on the row.

   "Make Grace N. an administrator? Admins approve and revoke accounts, and edit the organization's lists, formulary and form templates."

2. Confirm.

   "Grace N. is now an administrator." and an "Admin" chip.

3. To take the flag away, tap Remove admin; there is no confirm.

   "Grace N. is no longer an administrator." They keep role and account, and lose the Staff tab and the extra tabs at their next account check.

The last-admin rule

The server raises the same sentence if a request gets through anyway (two admins acting at once); it shows in the red banner at the top of the screen, as do two other refusals:

Banner	Meaning
"The server did not apply the change. Your account may not have permission to change this account."	The server quietly declined, most often because your own admin flag was removed on another device meanwhile.
"You are signed out. Sign in and try again."	Exactly that.

3. Inviting devices: the join link and QR code

The Invite a device card at the top of the Staff screen is how every device joins: staff open the link or scan the code, the app sets itself up and shows sign-in, they create an account, you approve it. Nobody types a project address or key.

Control	What it does
Organization name	"Shown on a device when it joins. It travels in the link, so set it before you share." Typing rebuilds the link and the code; the link keeps the first 80 characters.
Join link	A read-only box that selects all when tapped: the app's address plus everything the device needs after a #join= mark.
Copy link	"Link copied. Paste it into a message to your staff." If the browser refuses the clipboard: "Could not copy automatically. Select the link above and copy it by hand."
The QR code	Drawn under the buttons. If a very long organization name makes the link too long: "The link is too long for a QR code. Share the link itself instead."

On the staff member's device

1. They open the link, or scan the code and open the address the camera offers.

   DH EMR Clinic connects itself to your project, names the device after the device and the date, for example "iPad joined 2026-10-06", and shows the Sign in screen.

2. A new staff member taps New here? Create an account, fills in Your name, Email and Password, and taps Create account. Someone with an account just signs in.

3. They appear on your Staff list as Pending; set the role and approve (section 2).

The device can be renamed later (section 4); the organization's sites, clinicians and forms arrive on its first sync after approval. The user guide covers the sign-in screens.

If the link is opened on	What happens
A device already on the same project	Nothing.
A device connected to a different project	A confirm: "This device is already connected to oldproject.supabase.co. Switch it to Kabale Community Clinic (newproject.supabase.co)? The device registers itself in the new project and signs in there. Visits already synced to the old project stay there; anything not yet backed up uploads to the new one."
A damaged link	"That join link is damaged or incomplete. Ask your admin to send it again."
A link from a newer app than the device has	"That join link was made by a newer version of DH EMR Clinic. Update this app, then open the link again."

4. Devices

A device registers itself in the project's device list the first time it works there. The This device card shows its Name, the first eight characters of its Device ID, and its Mode ("Cloud sync" on every Clinic device). The role column below is used by DH EMR Field only; leave it alone.

Everything else about the fleet is done in the project dashboard's SQL Editor, on purpose, so a stolen device cannot do it either. The queries come from SETUP.md (section 11).

List every device

Recognize every row; match it to a device by name and the first eight characters of its id.

SELECT id, name, role, created_at, last_sync_at,
       CASE WHEN revoked_at IS NULL THEN 'active' ELSE 'REVOKED' END AS status
FROM devices ORDER BY last_sync_at DESC NULLS LAST;

Renaming is safe

1. Tap Rename this device on the This device card.

2. Type the name in Device name and tap Save name.

   "This device is now called "Reception iPad"." A blank name is refused: "A device name cannot be blank."

Revoking a lost or stolen device

1. In the SQL Editor, revoke the device. Records it already uploaded are kept; from this moment the project refuses records from it.

   UPDATE devices SET revoked_at = now() WHERE id = '<device id>';

2. On the Staff screen, Revoke the account that was signed in on it, because the account is what reads the organization's records.

3. Treat the loss as a disclosure: revoking does nothing to the records already on the device, and they are not encrypted at rest.

Replacing a device

The cloud holds everything that synced, so a new device fills itself once it joins by the link and signs in. A backup protects whatever had not uploaded yet. The Moving to a new device card under Settings lists the same steps.

1. On the old device, open the Cloud sync card under Settings. Waiting to sync must read "Nothing pending"; if not, tap Sync now with a working connection.

2. If the device cannot reach the server, tap Download backup instead.

3. Join the new device by the link and sign in; restore any backup there with Restore from a backup.

4. Check the record count matches before wiping the old device.

A device with both DH EMR Clinic and DH EMR Field installed keeps separate records. Nothing crosses between them.

5. Form templates and the Roles grid

The Form templates card under Settings lists each form with "On" or "Off" and has one button, Open the template editor. A new organization has one form, "General Visit", already on.

The editor is a panel headed Form templates. Every change saves as you make it, the header reading "Saving…" then "Saved", and "A change here reaches everyone on the next sync." Tap Close when you are done; there is nothing to discard.

Forms

On each form	What it does
The name box	Rename in place.
On	Offers the form for new visits; with more than one on, the visit form shows a selector. "Every visit keeps the name of the form it was filed under."
Sections	Opens the form's sections (next heading).
Duplicate	Copies the form as its name plus "(copy)": the safe way to experiment.
Delete	Confirms: "Visits already filed under it keep their answers and their template name. The form just stops being offered for new visits."

1. To add a form, type a name in New form name and tap Add form.

Sections

Tap Sections on a form; the card is headed "Sections of" and the form's name. The lists the built-in sections offer, like medications and lab tests, are edited on the Settings screen, not here.

On each section row	What it does
↑ ↓	Reorder.
The title box	Rename. A renamed built-in section gets Reset name.
Chip	"Built in", or the number of questions on your own section.
Roles	Opens the Roles grid (below).
Hide / Show	Takes the section off the form for everyone, or puts it back. Visit and Patient show a disabled Always shown instead, because every visit needs them.
Questions, Delete, Starts collapsed on the visit form	Your own sections only. Deleting confirms: "Answers already saved on existing records are kept, but will no longer appear on the form."
Add a section	Adds your own section at the end of the form.

Questions

Under Questions, each question has arrows, a label box, a type list (Short text, Long text, Single choice, Multiple choice, Number, Scale (0-N), Yes / No, Date), a Required checkbox and Remove. Choice questions get Choices ("Choices, one per line"); scale questions get Scale with Lowest and Highest.

1. Type the label in New question, pick a type, and tap Add question.

Every question shows its permanent field id, so removing one never touches saved answers.

The Roles grid: who sees which section

1. Tap Roles on a section row. It becomes Done with roles and a grid opens under the row, with the rows Reception, Triage, Provider, Lab and Pharmacy and the columns View and Edit.

   Its note ends "These are the built-in defaults." until you change something.

2. Tick the boxes. "Edit includes View; a role with neither does not see the section. Administrators always see and edit every section."

   Every tick saves at once. The row gains a "Roles changed" chip and a Reset to default button, which removes your change.

3. Tap Done with roles.

The shipped defaults ("Edit" fills it in, "View" is read-only, blank is not shown):

Patient and Vitals are reception's and triage's work, done before the provider opens the visit, so the provider only views them. If your providers take their own vitals, tick Edit for Provider on Vitals.

How the form behaves for a role

Situation	What the role gets
A view-only section	Starts collapsed to a summary of what was recorded, as label: value lines such as "Temperature 37.0 °C", with a "View only" chip; tapping the header opens the full read-only form. Empty: "Nothing recorded yet." The form's subtitle names the slice, for example "Triage sections" (user guide).
A hidden section	Simply not there.
A new visit (New visit or + New patient)	Visit and Patient are editable for every role, whatever the grid says, and view-only sections are left out: a short intake form.
Saving	Writes only the sections the role could edit; the rest is kept from the stored visit, so a pharmacy save never blanks the vitals triage entered on another device.
Lab results	When the board has a Lab station, every role other than Lab (and admins) orders tests with the Ordered checkbox and reads results, "Awaiting result" until the lab enters one; the result controls, Lab comments and urinalysis are read-only for them. Without a Lab station, whoever can edit Labs enters results.
Where it applies	Everywhere the form opens: the queue, the Board, the Lab and Pharmacy screens, New visit, and Edit or + New visit on a chart under Visits. The chart itself shows every section, read-only, to every role.

6. Clinic lists and patient flow stations

The Clinic lists card under Settings fills the pick lists on the visit form. "One entry per line, and commas belong inside an entry - "Grace N., clinical officer" is one clinician." Blank lines are dropped and duplicates removed. Six boxes, each with its own save button:

Box	Save button	Fills
Clinic or site names	Save sites	The site on each visit
Clinicians	Save clinicians	The clinician on each visit
Complaints	Save complaints	The buttons under the Chief concern box
Procedures	Save procedures	The Procedures section
Referral destinations	Save referral destinations	The Referral section
Patient flow stations (clinic mode board)	Save stations	The columns of the Board

After a save: "Saved 3 sites. Reopen the visit form to see them."

Patient flow stations

The stations are the columns of the Board, in order; the shipped list is Check-in, Triage, Provider, Lab, Pharmacy, Done. The box's own help text is the rule that matters:

The last line is the done column, which the Board keeps collapsed. Rename "Provider" to "Doctor" at noon and every visit under Provider drops off the columns until someone moves it. To rename mid-day:

1. Add the new name as its own line and tap Save stations.

   "Saved 6 stations. The board picks them up on its next refresh."

2. Move the visits to the new column on the Board.

3. Remove the old name after the day is done.

What else depends on station names	Rule
The "your station" tag on the Board	Reception's is always the first station, whatever it is called; triage, provider, lab and pharmacy find a station spelled like their role (capitals do not matter). Rename "Triage" to "Nursing" and triage staff lose the tag, nothing else.
The Triage and Provider queues	Each lists the column spelled like the role. Without one the queue says "No Provider station on the board" (or Triage) and points at the Board.
The Lab column	Where other roles park a patient who is at the lab; while it exists only the Lab role and admins enter results. The Lab tab lists visits by ordered tests, not by column, so if your flow never sends a patient to the lab and back, remove the station: the Lab tab works the same, and whoever can edit Labs enters results.

7. Formulary

The Formulary card under Settings is a table with the columns Medication, Dose, Unit, Category and Controlled, Remove on each row, and the buttons Add medication and Save formulary. Clinic ships with 38 entries, from "Amoxicillin 500mg" to "Normal Saline 500ml".

It refuses to save empty ("The formulary cannot be saved empty.") and confirms with, for example, "Saved 38 medications. Reopen the visit form to see them."

Column	Effect on the visit form
Dose	Fills the dose box when the drug is picked.
Unit	Decides whether the app can work out a quantity for the pharmacy: it counts "tabs", "caps" and "sachet". Any other unit, for example "ml" or "cream", records no quantity, and on the Pharmacy screen that line reads "no quantity worked out, count by hand" instead of prefilling the Qty box.

8. Lab tests and reference ranges

The Lab tests card is a table with the columns Test, Type, Unit, On by default and Ranges, Remove on each row, and the buttons Add lab test and Save lab tests. A type is "Positive / negative" (POS and NEG on the form) or "Number" (a box with the unit as its hint).

"Saving replaces the whole panel for your organization." The list cannot be saved empty. A visit with a test ticked Ordered and no result yet appears on the Lab tab, longest-waiting first, and leaves it when the result is entered. Removing a test keeps results already saved.

On by default

The On by default checkbox is the one control for whether a test is offered on the visit form. Unticked, the test stays in your panel with its saved results, but is hidden on the form.

1. Untick On by default on the row, or tick it to put a test back.

2. Tap Save lab tests. The change reaches every device on the next sync.

Three built-in tests ship unticked: "Hepatitis C (Anti-HCV)", "COVID-19 Rapid" and "TB (AFB Smear)".

Reference ranges: new results only

1. On a Number test, tap Ranges. On a row not saved yet it is off: "Save lab tests first, then set the reference ranges for this test."

   The editor opens, headed Reference ranges.

2. Edit the rows: a Label (for example "Normal"), From (at least), Up to (below), and a Color of None, Green (normal), Amber (caution), Red (critical) or Gray (neutral). An empty bound is open. Add range, the arrows and Remove manage rows.

3. Read the box "Check these before saving (saving is still allowed):" if it appears: a range with no label, one that can never match, two that overlap, a gap, or a bound that is not a number.

4. Use Try a value at the bottom.

   For example "Would record 182 mg/dL with interpretation Elevated".

5. Tap Save ranges. Cancel asks "Discard the range changes?" if you edited anything.

The matching rule: "Ranges are checked top to bottom and the first match wins. A value equal to "from" is inside the range; a value equal to "up to" is not - it belongs to the next range up."

Default bands	Ranges
Blood Glucose, mg/dL	Low below 70, Normal from 70, Elevated from 140, High from 200
Hemoglobin, g/dL	Severe Anemia below 7, Moderate Anemia from 7, Mild Anemia from 10, Normal from 12

9. Diagnosis quick-picks and prescription presets

Both have cards under Settings and belong to the organization: "a change reaches everyone on the next sync." Diagnosis quick-picks are the buttons under the Diagnosis box; each tap appends to the diagnosis text. Prescription presets are one-tap bundles in Medications; applying one adds its medication lines and treatment notes, and only ever adds.

On each entry	What it does
↑ ↓	Reorder.
Hide / Show	Hide takes the button off the visit form: "Hidden entries stay in the list but do not appear on the visit form." Show reverses it.
Remove	Deletes the entry; saved visits are never touched. The confirm says so: "Diagnoses already saved on visits keep their text - only the quick-pick button goes away." or "Prescriptions already saved on visits are kept, and the formulary is not changed - only the one-tap preset goes away." For a built-in it adds: "This is a built-in preset, so once saved it stays removed for your organization after sync."
Save diagnosis quick-picks / Save prescription presets	Nothing is written until you tap it. Neither list can be saved empty; the quick-picks card refuses with "Hide entries instead if you do not want them on the visit form." and the presets card says the same of presets.

Adding a quick-pick

1. Type it in the box with the hint "Add a diagnosis" and tap Add diagnosis.

2. Tap Save diagnosis quick-picks.

Building a preset

1. Tap Add preset, or Edit on an existing one, and fill in Preset name.

2. Tap + Add medication for each line: a drug from the formulary (or "Other drug (type a name)"), a dose, a frequency and a duration.

   Under each line, what the preset will record, for example "14 tabs" or "Not in the formulary - prescriptions from this line record no dispensing quantity." Check those lines: they are what the pharmacy screen will show.

3. Optionally fill in Treatment notes added with this preset (optional).

4. Tap Add this preset or Apply changes, then Save prescription presets.

Clinic ships with 31 quick-picks, from "Malaria" to "Abscess", and 21 presets, from "H. pylori Triple Therapy" to "MSK Pain".

10. Backup and restore

The cloud is the live copy, but the backup file is still the archive: a project can be paused, deleted or outlive its free tier. The file holds every record on the device plus your form and preset settings, and "never contains your cloud key or device identity."

1. On a device that has synced, tap Download backup on the Backup and restore card at the end of each clinic day.

   "Backup downloaded with 140 records. Keep it somewhere safe."

2. Move the file somewhere safe.

Restore merges; it never wipes

1. Tap Restore from a backup and pick the file.

   "Restore records from "dh-emr-backup-2026-10-06.json"? Records in the file are merged into this device. Where the same record exists in both, the more recently saved version is kept, so this cannot undo newer work."

2. Answer the second question, about settings. Tap Cancel unless you are deliberately restoring configuration.

   "Also restore the settings from this file? That replaces this device's form layout, sites, providers and formulary with the ones in the backup. If you are an administrator account those settings go out to the whole team on the next sync. Choose Cancel to restore records only. That is almost always what you want."

3. Read the result.

   For example "Restored: 12 added, 3 updated, 125 already newer here. 140 records on this device. Settings were left as they are. Restored records will upload on the next sync."

The card's footer is the rule: "Restoring merges: nothing already on this device is lost, and where the same record exists in both the more recently saved version wins." Restored records upload like any other, so a restore on one device reaches every device.

Moving from another cloud project

The Moving from another cloud project card brings records across from a project this device is not connected to, for example after moving to a new Supabase project.

1. Export the records from the old project as JSON.

2. Tap Import records from a file and pick it.

11. Recovery

Locked out, no admin left, forgotten passwords: the Staff screen's footer points to the setup guide (SETUP.md) and the project dashboard. The schema has no self-service admin path on purpose; exactly these situations need the dashboard, and nothing else does.

A staff member forgot their password

There is no password reset in the app: "Forgot your password? Your administrator can set up a fresh account for you - password reset emails are not reliable on most clinic projects."

1. Give them a fresh account: they tap New here? Create an account with a different email address, or you create it in the dashboard (Authentication, Users, Add user, "Create new user", with a temporary password; not "Send invitation", which depends on the same unreliable mailer).

   The account appears on your Staff list as Pending; a dashboard-made one is named after the part of the email before the @ sign.

2. Set the role and tap Approve.

3. Revoke the old account. Nothing it recorded is lost, and it can be restored if the password turns up.

The only admin forgot their password, or no admin is left

1. If a new account is needed, create it in the dashboard as above. A trusted existing account works too.

2. In the SQL Editor, run one line. It must return exactly one row; zero rows means the email did not match or the account does not exist yet.

   UPDATE users_profiles SET is_admin = true, activated_at = now(), revoked_at = NULL
   WHERE id = (SELECT id FROM auth.users WHERE lower(email) = lower('NEW@EXAMPLE.ORG'))
   RETURNING id, is_admin, activated_at;

3. Sign in with that account on a Clinic device.

   It opens on the Board with the Staff tab.

The setup guide uses the same line for the very first admin; its recovery section repeats these steps. A revoked device is different: accounts are restored from the Staff screen, devices only by the SQL line in section 4.

Where the SQL and the setup guide live

The two SQL files that set up and check a project, setup.sql and verify.sql, are on the database setup scripts page of this site, each with a Copy button. The setup guide also has a row-count check to run before and after any change to the project.

12. The demo

The Clinic demo is a fictional clinic day in progress, with simulated colleagues who keep working while you watch. It stays in the browser, never syncs, and refuses every cloud connection, so nothing done there can touch a real organization; it cannot be used to run a clinic.

1. In the panel headed You are simulating, pick Admin (the other seats are Reception, Triage, Provider, Lab and Pharmacy).

   The Staff screen over a fictional roster, and every Settings editor as the real thing, Roles grid included.

2. Build a preset, set a range, add a section, change a Roles grid cell; break things freely.

3. Switch to Triage or Pharmacy in the panel and open a visit to see what your change did.

4. Tap Reset demo in the banner to put the clinic day back.

Act now makes a colleague act at once; Pause activity stops them. Anything that needs a real backend is off: the sync chip, Cloud sync and the Invite a device card, with sign-in and sign-out simulated through the panel. The Field demo is the separate product's, with the same editors and no accounts.

13. Honest limits

Limit	What it means for you
Roles are a workflow layer, not a security wall	Any approved account can read the organization's records; the server cannot enforce field-level permissions (section 5).
The publishable key in the join link is public by design	It unlocks nothing on its own, and a link cannot be expired from the app (section 3).
Revocation waits for the device to reconnect	An offline device keeps its last confirmed account (section 2). After a week without reaching the server, the app shows "Reconnect to confirm your account." but keeps working.
A lost device keeps its data	Revoking the device and its account stops uploads and sign-ins; it does nothing to what is already on the device, and that data is not encrypted at rest (section 4).
Settings follow the account, not the device	Any device where an admin is signed in, including one that joined by link, can change the organization's settings for everyone. Make admins sparingly, and revoke an admin's account, not just their device, when they leave.
Clinic needs the internet	A device keeps working on what it has while the connection is down and syncs when it returns, but nothing new from other devices arrives meanwhile. For days when the backend is down, DH EMR Field is the paper-chart entry app, and there is no way to move Field records into a Clinic organization today.
DH EMR is not a certified EHR and is not HIPAA-compliant	It must not be used where a certified EHR is required. It is intended for global-health use outside the US.

Back to the Clinic guides