Rules that never bend
Every refusal in this list is deliberate. Read this before deciding something is broken — most "bugs" reported in the first month are one of these.
Each one is here because the alternative causes a worse problem later, and in most cases the worse problem is one somebody has actually had.
An issued invoice never changes
Once issued, an invoice has a number, the person may hold a copy, and its GST has been counted for a period that may already be reported to the ATO.
So it stands. A correction is a credit note against it: a second document carrying the negative, referencing the first, leaving both on the record.
Why not just edit it? Because an invoice that can be edited is an invoice nobody can rely on. A year later, "we credited this and refunded that" is explicable; a total that has quietly changed since the copy the patient holds is not, and the person who has to explain it is you.
What to do instead: credit note if the invoice was right and something changed; void with a reason if it should never have existed.
Drafts are different. A draft has no number, is not in the books, and can be edited freely. That is the stage for changing your mind.
Nothing clinical is ever deleted
Notes, letters and client records are archived, never destroyed. Archiving hides a record from the active list and keeps every word.
Why: a clinical record is a legal document. Its value in a complaint, an insurance dispute or a court is precisely that it cannot be tidied up after the fact.
The one exception is narrow and guarded: a client record created by mistake, with nothing attached — no appointments, invoices, notes or files — can be deleted by an owner, or by somebody an owner has explicitly trusted with it.
A signed note cannot be rewritten
Signing is a professional attestation. After it, the text is fixed.
Corrections are amendments: dated additions that sit with the note, leaving the original standing.
The same applies to a finalised letter — the copy the GP holds must stay the copy you hold, so a correction is a new letter that supersedes the old one.
Two people cannot hold one practitioner at one time
Double booking is refused by the server, not merely hidden on screen.
This includes stretching an appointment over the next one. The block springs back rather than shuffling everybody along, because one drag silently moving three other people's appointments — with the first anyone knows being a patient arriving to find their time changed — is worse than being told no.
Closed time refuses bookings
Each practitioner's open hours are set in Manage → Diary. Anything they do not cover is closed, and closed time refuses a booking.
There is deliberately no separate list of "blocked" times: open windows are the whole truth, so there is one place to look when somebody asks why a time will not take a booking. A lunch break is two windows with an hour between them.
The override — Book outside open hours — is held by practitioners, owners and managers by default, and not by reception. A practice can turn the refusal off entirely and keep the picture.
Clinical records cannot be granted to non-clinical logins
Front desk, accounts and marketing logins can never be given clinical permissions. This is locked in the software. No setting turns it on.
Why a lock rather than a default: clinical records are limited to the people providing care, and a rule with an exception for whoever asks nicely is not a rule. It also stops a practice configuring itself into a problem it would only discover during an audit.
Owner access cannot be reduced
Unticking a permission against the owner row does nothing.
Why: untick Change permissions for owner and the only role that can put it back has just lost the screen that does so — in a product with no support desk to ring. There must also always be at least one active owner; the last one cannot be removed.
Hiding a button is not security
Every permission is checked by the server on every request. What you see on screen is a courtesy.
This matters in both directions. A missing button means the action would be refused anyway, so there is no point looking for another route to it. And a button you can see is one the server agrees you may use.
Money is counted in whole cents
There are no fractions of a cent anywhere. Every amount is an integer.
Why: floating-point arithmetic on money produces totals that are out by a cent, unpredictably, and a practice cannot reconcile a bank account against a number that is nearly right.
Every query is filtered by practice
Nothing in the software can see another clinic's data. This is what makes it safe to issue an API key at all.
Secrets are write-only
You can set an API key, a mail password or a phone credential. You cannot read one back — the screen will tell you whether one is set, never what it is.
The activity log records the name of a credential that changed, never its value.
If you have lost a secret, it is gone. Issue a new one. That is the intended outcome, not a gap.
An AI receptionist is not trusted to remember a rule
If your practice runs Clini, what she is allowed to book is filtered out of the list she can see, rather than described to her as an instruction.
Why: a rule a model is asked to remember is a rule it will eventually break, and the day it breaks is the day it books a new patient into a slot reserved for reviews.