Roles and Permissions - Who Can Do What

• Business Admin — owns the business. Manages branding and business settings, invites and removes team members, assigns disciplines and modules, sets prices and sees every client and every report.
• Consultant — the practitioner. Owns their own calendar, their own clients, notes, plans and reports, and their own public profile within the business page.
• Assistant — front desk. Handles appointments and client contact details without opening clinical records.

Each consultant manages their own clients, while the business administrator can see all of them. That gives you individual responsibility and managerial oversight at the same time, without two separate client lists to keep in sync.

A client seeing more than one practitioner in the same clinic still has one record and one portal — they do not get a second login because they also saw the physiotherapist.

Hiding a button is presentation, not security. In Vitena every write operation re-checks the caller's role on the server, so a permission cannot be bypassed by editing the page or calling the API directly.

The interface follows the same principle in the other direction: a control you are not allowed to use is hidden rather than shown greyed out. A control you cannot use is not information — it is a support question waiting to happen.

Invitations carry the role and the profession, so a new colleague lands in a workspace already shaped for them instead of a generic one.