HMR Reports
Practice insights
Enquiries
Import patients from CSV
One-off migration from a previous system. Paste CSV rows below — a header
line with name, phone, email, address, notes (any order) is recognised; without one, columns are
assumed in that order. Rows matching an existing patient (same name + phone) are skipped, never duplicated.
Add an enquiry (phone / walk-in)
Home Visits
Online booking availability
Publish weekly visiting hours and the website's contact form will offer patients real slots to book (you confirm each one from Enquiries). Leave disabled to keep arranging times by phone.
Patients
Recall campaign
Each patient is recalled at most once — sending stamps their record, and already-invited patients aren't listed. Emails use the re-review invitation (editable under Security → Email templates).
GP Practices
Add practice
Invoices
🏦 Reconcile a bank statement
Paste deposit rows from your bank CSV — a header line with
date, amount, reference (any order) is recognised; without one, columns are assumed in that order.
We match each deposit to an open invoice by amount (preferring a reference that names the invoice) and offer
one-click mark-paid.
📄 Statements of account
Every open (sent, unpaid) invoice grouped by client — send one statement per client instead of chasing each invoice. Needs an email on the client's invoice.
New invoice
Powers the aging strip and (if switched on under Security → Automation) weekly overdue reminder emails.
A Stripe payment link, PayPal.me, or bank portal URL — shown on the printed invoice and included in overdue reminder emails.
Untick for GST-free supplies or if you're not registered for GST.
Expenses
Add an expense
Profit & loss
Messages
/api/contact?sms=inbound&key=… (see STAFF_SETUP.md). Threads are matched to enquiries by phone
number automatically.GP Referral Requests
New referral request
Team
Activity Log
Security
Two-factor authentication
1. In your authenticator app (Google Authenticator, Microsoft Authenticator, Authy…), add an account using this setup key:
On this device? Tap here to open your authenticator app directly.
2. Enter the 6-digit code the app shows, to confirm it's working:
To turn two-factor authentication off, enter a current code from your authenticator app:
Sessions & sign-in history
Your most recent sign-ins. If anything looks unfamiliar — or you've lost a device that was signed in — sign out everywhere and sign back in (consider changing your password too).
Google review link
Paste your Google "leave a review" link and every patient marked Completed is automatically emailed a thank-you with the link (once each). Leave blank to turn this off. Find yours: Google Business Profile → "Ask for reviews".
This link is offered to patients who leave positive private feedback, so they can choose to review you on Google. The rating itself is never republished on our own homepage: s 133 of the Health Practitioner Regulation National Law prohibits testimonials in advertising a regulated health service, and a star rating we publish about our own care is a testimonial. Reviews left on Google stay on Google.
Runs with the daily reminder job (needs email set up). Each invited patient also gets a follow-up task on the dashboard so nothing slips.
Program fee rates
Your actual fee for each service — used to show earned / pending / at-risk dollars in Practice insights and the claims export. Check the current program rates before relying on them.
Passkeys
Sign in with your fingerprint, face, or device PIN instead of a password — phishing-resistant and faster on the road. Add one passkey per device you use (phone, laptop, tablet).
Claude
Connect Claude so it can draft findings into your reports. It reads only de-identified cases, saves drafts with a checklist for you to verify, and can't finalise or send anything.
- In Claude, open Settings → Connectors and choose Add custom connector.
- Name it Medsight and paste this address:
- Press Connect. Sign in here if asked, then choose Allow.
- In a report, press Copy request for Claude and paste it into a Claude chat.
Google Drive
Save a PDF of each finalised report into your practice's Google Drive, in a Medsight reports folder sorted by month. The portal can only see the files it creates there, nothing else in your Drive.
Notifications on this device
Get a native notification the moment a new enquiry or text message arrives — even with the portal closed. Works per device (turn it on separately on your phone and laptop).
Weekly automation
Three jobs run together every Sunday night (needs email + the cron secret set up — see STAFF_SETUP.md). Each is off until you switch it on.
A mailbox alone isn't a disaster-recovery plan. When the OFFSITE_*
environment variables are set (see STAFF_SETUP.md), the weekly snapshot is also uploaded to your bucket.
The monthly note goes only to practices in your address book that have an email and at least one referral on record — a gentle, data-backed nudge to keep referring.
Email deliverability
Review invites, prep emails, and digests only help if they reach the inbox. These DNS records tell mailbox providers your emails are genuinely from you — set them once with your domain host, then send yourself a test.
Add these at your domain registrar (values from your email sender — e.g. Resend → Domains). After they verify, send a test to mail-tester.com to score your setup.
Booking poster (QR code)
Print an A4 poster for a pharmacy or clinic waiting room. The QR code opens your “Request a Review” form. Tag each poster so you can see which one brings people in (the tag rides along as a link parameter your analytics can read).
Accountant pack link
A read-only magic link bundling your P&L, GST, invoices, and expenses — so you never email spreadsheets at tax time. Share it with your accountant; revoke it any time.
Trash (deleted enquiries, tasks & invoices — kept 30 days)
Deleted the wrong thing? Restore it here. Anything left in the trash for 30 days is purged automatically.
Practice requests
GP practices ask for a visit, a lunch & learn, a call, or help with the HMR recall kit from the For GPs page — requests land here (and in your email). Mark them arranged, then done.
Blog posts
Write medication-safety articles for the public blog. Drafts stay private;
publishing lists the post at /blog and in your RSS feed. Markdown-lite: ## heading,
**bold**, - list.
Patient access log
Who viewed or changed a patient's records — a Privacy-Act-ready trail you can export if a patient ever asks.
Training / demo mode
Seed a few obviously-fake patients (all named “Demo …”) so a new locum can practise without touching real records. Clear them again in one click.
Retention policy
Automatically purge old records you don't need to keep forever. Blank or 0 means “keep indefinitely”. The weekly cron applies these.
What’s new
Recent additions to your portal — so nothing you’re paying for goes unused.
Newsletter subscribers
People who signed up for medication-safety tips on the website and confirmed by email (double opt-in). Export the confirmed list to send a newsletter from your email tool — every email you send must include the unsubscribe link from the signup confirmation.
Email templates
Reword the patient-facing emails without a deploy. Each template overrides
the subject line and the opening paragraph; the rest of the email (checklists, links, unsubscribe) stays as built.
Placeholders: {name} = patient's name, {when} = visit date/time. Leave blank to use the
built-in wording.
Medicine shortage watchlist
Medicines currently in shortage (check the TGA medicine shortage reports). One per line — any patient medicine list containing a watched name gets a shortage flag in the clinical prompts, so you can suggest alternatives in the report before the pharmacy runs dry.
Security policy (admin)
Admins signing in with only a password are still let in (so the practice can never lock itself out) but are sent straight here to enrol, every sign-in, until 2FA is on.
Integrations (admin)
API keys give read-only access to enquiries, invoices,
expenses, and referrals at /api/enquiries?export=… (send the key as
Authorization: Bearer …). The key is shown once — store it in the connected tool.
Outbound webhook — new enquiries, paid invoices, and
accepted referrals are POSTed as JSON to this https URL as they happen. The optional secret signs each payload
(X-RMM-Signature, HMAC-SHA256 hex) so the receiver can verify it's really us.
System status (admin)
What's live right now — each optional integration is set up via environment variables or the portal (see STAFF_SETUP.md).
Rate limiting (admin)
What the public endpoints (contact form, magic links, booking slots…) are throttling. Each row is one bucket — an endpoint + IP — with how many requests landed in its current window. A busy unfamiliar IP here usually just means a bot found the contact form; the limits are doing their job.
Restore from backup (admin)
Upload a practice-backup JSON (from Full backup) to restore reports, enquiries, referrals, and practices that are missing. You'll see a preview of exactly what would be added before anything is written. Existing records are never overwritten, and staff accounts are not restored (re-register with the invite code).
Data retention (admin)
Enquiries hold personal contact details, so completed ones shouldn't be kept forever. Purge completed enquiries older than a chosen window — this cannot be undone and is recorded in the activity log.