DH EMR Clinic guides

Setting up DH EMR Clinic for your organization

For the organization lead, who becomes the first administrator. It goes from nothing to a live clinic: a cloud project your organization owns, your own device, the first administrator, staff devices joined by link or QR code, and accounts approved with a role. Plan an hour, plus a few minutes per staff device; no command line is needed.

1. What you are setting up

DH EMR Clinic is one app that every device opens in its browser at damicohealth.com/clinic/, backed by one cloud project your organization creates and owns. Damico Health hosts nothing and sees nothing: no central server, no account with us, no subscription.

Piece	What it is
The project	A Supabase project, set up from its dashboard; it holds the records, the staff accounts and the settings.
Your own device	Where the address and key are typed by hand, once; every other device gets them in a join link.
The first administrator: you	Sees the Staff tab, approves accounts, sets roles, and alone changes the lists, formulary, lab tests, presets and form templates. Made from the dashboard once; later administrators are made in the app.
The staff devices	Open the join link or scan its QR code; the app sets itself up and shows sign-in. Nobody types an address or key.
The staff accounts	Each person creates their own; it sees nothing until you approve it with a role: Reception, Triage, Provider, Lab or Pharmacy.
The board	Patient flow: today's visits as cards moving across stations, on every device within seconds.

2. What you need

Item	Notes
Internet all day, on every device	The board, the Lab and Pharmacy screens and sign-in depend on it. Section 14 covers outages.
A Supabase account	At supabase.com; the free tier is enough for a small clinic.
One administrator to start: you	An email and a password you will remember. The app has no password reset, so write it down somewhere safe.
A computer with a browser	For the project dashboard; easier on a large screen.
The two SQL files	setup.sql and verify.sql, on the database setup scripts page of this site. Each has a Copy button; nothing to download or install.
Your own device	A tablet, laptop or phone with a modern browser. Most can add the app to the home screen so it opens like an app.
About an hour	Plus a few minutes per staff device.

3. Create the project

1. On supabase.com, choose New project. Any name; pick the region closest to the clinic.
2. Generate a strong database password and store it in a password manager. It is rarely needed again.
3. Wait for the project to finish provisioning.

4. Run the schema

1. In the left sidebar, open SQL Editor, then New query.
2. Open the database setup scripts page, press Copy under setup.sql, paste it into the query and click Run. It is safe to run twice; re-running is the upgrade path.
3. Recommended: do the same with verify.sql next.

   Every row must say PASS. It changes nothing and ends by rolling itself back.

The schema creates the tables, the rules that make every read and write need an approved account, the server-side checks behind the Staff screen, and the live updates that reach every device within seconds.

5. Get the app credentials

Value	Where to find it
Project URL	Project Settings, then Data API; also in the Connect dialog at the top of the dashboard. It looks like https://yourproject.supabase.co.
Publishable key (sb_publishable_...)	Project Settings, then API Keys.

You type these once, on your own device in section 8. Every other device gets them inside the join link in section 9.

6. Turn on sign-in

Clinic uses staff accounts, so the project must allow email sign-in. In the dashboard:

1. Open Authentication, then Sign In / Up, and enable the Email provider.
2. Turn off "Confirm email".

7. Create the first administrator

There is no self-service first administrator, on purpose: anyone with the project address and publishable key can create an account, so creating one must carry no power. The first administrator is made from the dashboard, once.

1. Open Authentication, then Users, then Add user. Choose "Create new user" and set a password; do not use "Send invitation", which depends on the same restricted mailer.
2. In the SQL Editor, run this in a new query with your own email in place of LEAD@EXAMPLE.ORG:

   UPDATE users_profiles
   SET is_admin = true, activated_at = now()
   WHERE id = (SELECT id FROM auth.users WHERE lower(email) = lower('LEAD@EXAMPLE.ORG'))
   RETURNING id, is_admin, activated_at;

   Exactly one returned row. Zero rows means the email did not match or the account does not exist yet; fix the spelling and run it again.

That row is the whole bootstrap: it approves the account and flags it as an administrator at the same time.

8. Set up your own device

Open damicohealth.com/clinic/ on the device you will use. The first time, a short wizard opens straight on the cloud step: a Clinic device always belongs to a project, so there is no choice to use it on its own.

Step one: Connect to your cloud

The step is headed Connect to your cloud. Its note "Open the link your admin sent you" is for every other device; "No link? Your admin can read you the project address and key instead." is you.

1. In Project URL, paste the Project URL from section 5.
2. In Project key, paste the publishable key.
3. Tap Check and continue.

   "Checking…" while the app contacts the project and checks that its tables exist.

The wizard says	What to do
"That does not look like a Supabase project URL. It should look like https://yourproject.supabase.co"	A typo. Paste the URL again from the dashboard.
"Paste the project anon key."	The key box is empty.
"That is a server key (service_role or sb_secret). It bypasses every database security rule and must never go on a field device. Use the Publishable key, or the legacy anon key."	Wrong key. Copy the publishable key from Project Settings, API Keys.
"Connected, but the records table was not found. Run the setup SQL on this Supabase project first."	Section 4 was skipped, or ran on a different project.
"Could not reach the project tables:" followed by a reason	The project refused; most often the key belongs to a different project.
"Could not reach that project. Check the device is online and the URL is right." followed by a detail	No connection, or the URL points nowhere.

Step two: Name this device

1. In Device name, type what the team will recognise, like the suggested "iPad 2 - triage" or "Grace's tablet". It shows in the device list and on the records this device files.
2. Leave What is this device allowed to do? on Enter and view records (most devices), not Also change the form and clinic settings for everyone.

   In Clinic the choice changes nothing; access follows the account, not the device. The same wizard serves DH EMR Field, where it matters.

3. Tap Next.

Step three: Where is this device working?

These lists fill the Site and Provider lists on the visit form and, because an administrator signs in here, go out to the whole organization on the first sync. Enter the real names now; you can change them later under Settings.

1. Fill Clinic or site names, one per line.
2. Fill Clinicians working on this device, one per line. Commas belong inside an entry: "Grace N., clinical officer" is one clinician.
3. Tap Start using the app.

   "Finishing…" while the device registers itself in the project. If the project refuses, "Could not finish setup:" with the reason; nothing was stored, so try again.

Then: Sign in

1. On the screen headed Sign in, enter the Email and Password from section 7.
2. Tap Sign in.

   "Signing in…", then the Board tab, headed Patient flow, with the card "No patients on the board yet".

Your tabs: Board, Provider (your role's queue; section 11), Visits, New visit, Analytics, Staff and Settings; only administrators see Staff. This first administrator sign-in silently sets clinic mode, and the top-bar chip runs the first sync: your lists go out and the chip reads Live.

Check it

1. Open Settings.

   The Account card shows your Name, Role (new accounts start as Provider; change it in section 11) and Admin Yes. The This device card shows Name, Device ID and Mode; there is no device role in Clinic. Below, the Clinic lists, Formulary and Lab tests cards are editable.

9. Invite the staff devices

Open the Staff tab. The first card is Invite a device.

1. Fill Organization name first: "Shown on a device when it joins. It travels in the link, so set it before you share." The link regenerates as you type.
2. Tap Copy link under the Join link box.

   "Link copied. Paste it into a message to your staff.", or "Could not copy automatically. Select the link above and copy it by hand."

3. Or let a device in the room scan the QR code below the link.

   A very long organization name is refused: "The link is too long for a QR code. Share the link itself instead."

The link is the same for every device and does not expire; keep it in a message thread the staff can find. Change the organization name later and you must copy the link again, because the name travels inside it.

On each staff device

1. Open the link in the browser, or point the camera app at the QR code and open the link it offers.

   The app configures the device before any wizard can appear and lands on Sign in; nothing to type, nothing to choose. The device registers itself, named by platform and date, like "iPad joined 2026-10-06".

2. Optional, later: rename it under Settings, on the This device card, with Rename this device. That changes the label only.

A joined device never asks for sites and clinicians; the organization's lists arrive on its first sync, after approval. A link that cannot be used says why, never a silent fallback: a red alert on the wizard, or a sign-in banner starting "That join link could not be used."

The device says	What to do
"That join link is damaged or incomplete. Ask your admin to send it again."	The link was cut short in the message. Copy it again from the Invite card and send the whole thing.
"That join link was made by a newer version of DH EMR Clinic. Update this app, then open the link again."	The device has an old version open. Reload, accept the update if offered, then open the link again.
"Could not join" with the organization name and a reason, or "the project could not be verified."	The project refused the device. Most often the schema in section 4 has not been run.
"Could not reach" with the organization name, then "Check the device is online and open the link again."	No signal. Connect the device and open the link again.

On a device already set up for this project the link does nothing. On one set up for a different project it asks first ("This device is already connected to" the old project, "Switch it to" the new): synced visits stay put, unsynced ones upload to the new project. Cancel unless you want that.

A device that cannot open the link

1. Read it the Project URL and publishable key from section 5, typed into the wizard's Connect to your cloud step as in section 8.
2. Leave What is this device allowed to do? on its first option.
3. On the sites step, type one site and one clinician to satisfy the wizard; the organization's real lists replace them on the first sync.

Which device can change the organization's settings

Any device where an administrator is signed in; one that joined by link is no different from yours, with nothing to set up for it. A non-administrator gets the turned-off editors from section 1. The admin guide explains the gate; its Devices section covers the device list, renaming and revoking.

10. Staff create their accounts

On the Sign in screen, each staff member taps New here? Create an account; the screen becomes Create your account.

1. Fill Your name: the name the team knows them by. It shows on the Staff list and on the records they save.
2. Fill Email and Password.
3. Tap Create account.

   "Creating…", then a screen headed Waiting for approval. It names the account, explains that every new account waits for an administrator, and offers Check again and Sign out. A waiting account sees no records at all.

If the device shows instead	What it means
Cannot confirm your account yet, saying the device could not reach the organization's server	No signal at that moment. Get signal and tap Check again.
The Sign in screen again, with "Your account was created. Sign in with the same email and password once your administrator has approved it."	"Confirm email" from section 6 is still on. Turn it off; the account exists, so approve it as usual and the person signs in afterwards.

11. Approve accounts and set roles

On your device, open the Staff tab and find the Staff accounts card. Empty, it says "No one else is here yet."; once accounts arrive, a note counts them: "1 account is waiting for your approval."

Each row shows the name, a status chip (Pending, Active or Revoked), a role chip and an Admin chip on administrators. Your own row says "(you)"; oldest accounts come first.

1. Set the role first, from the select on the row: Reception, Triage, Provider, Lab or Pharmacy. New accounts start as Provider.

   The card confirms with the name, "is now" and the role: "Grace N. is now Triage."

2. Tap Approve.

   "Approving…", then the name followed by "is approved and can sign in now."

3. Ask the person to tap Check again on their waiting screen; they land on their workspace.

Role first means they land on the right workspace from their first sign-in. To change a role later, they sign out and in again: Settings, the Account card, Sign out, which needs a working connection.

What each role gets

Each role lands on its own workspace, the first tab in its list, and edits only its own sections of the visit form. An administrator can change the defaults per section in the template editor's role grid; the admin guide covers it.

Role	Lands on	Tabs	Edits by default
Reception	The board	Board, Visits, New visit, Settings	Visit and Patient, the short registration form. Views the rest.
Triage	Its station queue	Triage, Board, Visits, Settings	Vitals, History, Chief Concern and Labs. Views Patient.
Provider	Its station queue	Provider, Board, Visits, New visit, Analytics, Settings	Everything except Patient and Vitals, which it views: reception's and triage's work, done before the provider opens the visit.
Lab	The Lab screen	Lab, Visits, Settings	Labs. Views Patient and Chief Concern.
Pharmacy	The Pharmacy screen	Pharmacy, Visits, Settings	Medications. Views Patient and Diagnosis.

An administrator keeps their role's screens, adds Board, New visit, Analytics and Staff, and edits every section. A Triage or Provider administrator lands on the Board, with the queue tab beside it.

The station queue

Triage and Provider land on a screen headed with their station, for example Provider: today's visits waiting at that column, longest-waiting first, under the date, the count waiting and the count at the previous station. Open the Board switches to the full board to pull someone forward.

Each visit offers Open, the role's own view of it, and a "Next:" button naming the following station. With nobody waiting, the screen says "No one is waiting at" the station.

View-only sections and lab results

A view-only section starts collapsed to a summary of what was recorded, as label and value lines such as "Temperature 37.0 °C", with a View only chip; tapping the header opens the full read-only form. An empty one says "Nothing recorded yet."

With a Lab station on the board, every role but Lab orders tests with the Ordered checkbox and reads results ("Awaiting result" until the lab enters one); the result controls, Lab comments and urinalysis are read-only for them. Without a Lab station, whoever edits Labs enters results. Administrators are never locked.

Make a second administrator

Do it before the first clinic day: with one administrator, a forgotten password means the dashboard route in section 15.

1. On a trusted person's row, tap Make admin.

   The app asks, with the name: "Make Grace N. an administrator?"

2. Confirm.

   The card says the name followed by "is now an administrator."

The last administrator cannot remove themselves: on your own row, Revoke and Remove admin are disabled with the note "You are the only administrator. Make someone else an admin first."

When someone leaves

Revoke on an active row asks "Revoke access for" the name: they are locked out the next time their device talks to the server, and nothing they recorded is deleted. Restore on a revoked row turns the account back on.

12. The board comes alive

An active device syncs every 20 seconds while online and listens for changes from the project, so another device's change arrives within seconds. The chip in the top bar shows the state.

Chip	Meaning
Live	"Connected live. Changes from other devices arrive within seconds." Shown only while the device is actually listening and has nothing waiting.
Syncing	"Sending and receiving records..."
Synced	"All records are backed up to your cloud."
Connected	"Cloud connected. Not synced yet this session."
Offline	"Saved on this device. Will sync when you reconnect."
Sync error	"Tap to retry, or check your connection and credentials."

Tapping the chip syncs by hand. Anything still waiting to upload is said plainly: "Not backed up." with how many records and why.

Check it with two devices

1. On a reception device, open the Board tab and tap + New patient.
2. Fill the Visit and Patient sections for a test patient and tap Save.

   A card appears in the first column, Check-in.

3. Watch your own device.

   Within seconds the same card appears, with the patient's name and No. followed by the patient number.

4. On either device, tap Next: Triage on the card.

   It moves on both.

5. On a device still waiting for approval, confirm it shows no records; approve it, tap Check again there, and confirm it now sees the test visit. Two minutes, and the whole access model is exercised.
6. Delete the test visit in the app, not the dashboard: the Visits tab, the patient's chart, Delete on the visit.

   It is marked deleted on every device; rows are never hard-deleted, by design.

13. Before the first clinic day

Done under Settings as an administrator, on any device, once; a change reaches every device on its next sync. For a non-administrator the editors are turned off. The admin guide covers each editor in full.

Card	What to do
Clinic lists	Check the wizard's sites and clinicians; add complaints, procedures and referral destinations. Patient flow stations (clinic mode board) holds the board's columns, one per line, in board order: Check-in, Triage, Provider, Lab, Pharmacy and Done as shipped.
Lab tests	Each test has a type, a unit and Ranges for numeric tests. On by default is the one control for whether a test is on the visit form: untick and Save lab tests to remove it while keeping it in the panel; tick and save to restore it. Three shipped tests are off; the admin guide says how to offer one.
Formulary	The visit form's medications. The card's warning: "saved prescriptions keep pointing at the same entry, so never reuse a row for a different drug - add a new row instead."
Diagnosis quick-picks and Prescription presets	One-tap buttons on the visit form. Hide what you do not use rather than deleting it.
Form templates	The visit form itself. Open the template editor; on each section row, Roles opens a grid of View and Edit checkboxes per role, with the defaults from section 11 ticked. Its rule: "Edit includes View; a role with neither does not see the section. Administrators always see and edit every section."
Backup and restore	Download backup saves one file with every record on the device plus the settings. Take one at the end of each clinic day on at least one device: the cloud is a convenience copy for the devices; the backup file is the organization's own archive.

14. If the internet goes down

Clinic is built for a constant connection, and this guide will not pretend otherwise. What happens depends on how long the outage lasts.

A short outage

A signed-in device keeps working on what it has: the chip reads Offline, and visits saved on it upload when the signal returns. A device that has never signed in cannot start until it is online, because the account must be confirmed once.

What stops is the sharing: boards stop receiving each other's changes, a lab result entered on one device does not reach the provider's, and a visit registered at reception does not reach the triage device until the connection is back.

A long outage

The clinic sees patients on paper, then types the charts into DH EMR Field, the separate offline product, on any device with the Field app: the visits become searchable, counted in Field's analytics and backed up in a file instead of lost in a drawer. The Field admin guide explains that setup.

15. If you get locked out

The schema has no self-service administrator path, on purpose, so these situations need the project dashboard's SQL Editor; nothing else does. The Staff screen's footer points here.

The only administrator forgot their password

1. Create a replacement administrator: Authentication, then Users, then Add user, "Create new user" with a temporary password. Email resets are unreliable without your own mail server.
2. In the SQL Editor, run this with the new email in place of NEW@EXAMPLE.ORG; one row must return:

   UPDATE users_profiles SET is_admin = true, activated_at = now(), revoked_at = NULL
   WHERE id = (SELECT id FROM auth.users WHERE lower(email) = lower('NEW@EXAMPLE.ORG'))
   RETURNING id, is_admin, activated_at;

The organization has no administrator

The only administrator was revoked or deleted. Run the same statement against any existing trusted account, or a fresh one. The revoked_at = NULL part matters: promoting a once-revoked account without clearing the revocation does nothing, silently.

A device was revoked in the dashboard

The app can restore an account from the Staff screen, but never un-revoke a device. That is dashboard only:

UPDATE devices SET revoked_at = NULL WHERE id = '<device id>';

Keep the project awake

A free-tier project pauses after about a week without traffic, and one paused long enough (around 90 days) can stop being restorable in place; a daily clinic never hits this.

For seasonal missions, upgrade to a paid tier or open the dashboard monthly and click Restore if prompted. Keep the device backups from section 13; they are the true archive.

16. Honest limits

Limit	What it means
Roles are a workflow layer, not a security wall	A role sets the workspace and default sections; it hides no records. Any approved account can read everything, and the server cannot enforce field-level permissions. Approve people you trust; revoke the rest.
Settings follow the account, not the device	Any device with an administrator signed in changes the lists, formulary, lab tests, presets and forms for everyone, joined by link or not. Make admins sparingly.
The join link's publishable key is public by design	It unlocks nothing alone; the link only lets someone create an account that waits for approval. Share it with staff, not the public; never confuse it with the secret key (section 5).
Revoking takes effect when the device next connects	An offline device keeps its last confirmed access until it next talks to the server; after a week it shows the reconnect banner.
A lost device keeps its data	Revoking does nothing to records already on it, and they are not encrypted at rest. Treat a lost device as a disclosure.
No password reset in the app	A forgotten password means a fresh account, or for the only administrator, section 15.
Field cannot feed Clinic	Paper-day visits typed into DH EMR Field stay in Field (section 14).
Not a certified EHR, not HIPAA-compliant	Must not be used where a certified EHR is required; intended for global-health use outside the US.

Where to go next

Give the staff the user guide; it covers each role's workspace and the visit form. Keep the admin guide for yourself; it covers the Staff screen and every settings editor.

Back to the Clinic guides