Example Weight Loss Clinic

Eligibility Screening

How the patient questionnaire works

The eligibility screening questionnaire is the primary intake tool for new patients. It collects personal details, BMI data, medical history, current medications, contraindication screening, treatment goals, and GDPR consent across seven structured steps. Patients access it by clicking Free Assessment in the navigation bar or from the homepage CTA.

Step	Section	What is collected
1	Personal Details	First name, last name, date of birth, gender, email, phone number
2	Height & Weight	Height (cm) and weight (kg) — BMI is calculated automatically with eligibility indicator
3	Medical History	Multi-select of relevant conditions (diabetes, hypertension, PCOS, etc.)
4	Current Medications	Whether the patient takes prescription medications and a free-text list if yes
5	Contraindications	Thyroid cancer history, pancreatitis, kidney/liver disease, pregnancy, known allergies
6	Treatment Goals	Target weight loss range, previous treatment attempts, motivation statement
7	Consent & Submit	GDPR data processing consent, accuracy declaration, age confirmation (18+)

Eligibility Logic

A patient is flagged as potentially eligible when their BMI is 27 or above and they answer "No" to all contraindication questions. The result is shown on the confirmation screen and the submission appears in your Questionnaires tab for clinical review.

Preview Mode for Demonstrations

When demonstrating the form to patients or colleagues, you can press Continue on each step without filling in any fields. Only the final Submit Assessment button requires the three consent checkboxes to be ticked.

Admin Portal

Clinical management hub for approved staff

The Admin Portal is accessible at /admin and is available to all approved clinic staff. It provides full clinical management tools. In the Enhanced Multi User Package, staff do not have access to HR management, audits, or governance — those functions are reserved for the Director Portal.

Dashboard

Overview of key metrics: total patients, pending reviews, outstanding invoices, revenue trend chart, and CQC domain scores.

Patients

View all registered patients with search and filter. See each patient's name, email, registration date, and portal status.

Questionnaires

Review all submitted eligibility assessments. View full details, BMI, medical history, and download PDF summaries. Update status to approved or pending.

Appointments

Manage all booked consultations. Every appointment includes a Microsoft Teams meeting link — click 'Join Teams Meeting' to join directly.

Messages

Send and receive secure messages with registered patients. You can initiate a message to any patient without waiting for them to contact you first.

Payments

View all Stripe payment records including amount, status, date, and patient. Payments are processed securely through Stripe Checkout.

Invoices

Create and send itemised invoices to patients. Add line items with descriptions, quantities, and prices. Track sent, paid, and overdue invoices.

Feedback (CQC)

View all patient feedback submissions mapped to the five CQC domains: Safe, Effective, Caring, Responsive, and Well-led.

Complaints

Log and track formal complaints with category, description, and resolution status. Maintains a full audit trail for CQC compliance.

My CPD Log

Record your Continuing Professional Development activities including date, provider, hours, and reflection notes. Maintains a running total of CPD hours.

Pricing Plans

Create, activate, deactivate, and delete pricing plans. Plans marked as active appear on the public Pricing page.

Documents

Upload and manage clinical documents, consent forms, and resources. Documents can be made available to patients via the Patient Portal.

Analytics

View website traffic, page views, and visitor trends. Understand which pages patients visit most.

Website Enquiries

All contact form submissions from the public website appear here. Includes the enquirer's name, email, subject, and message.

Settings

Update clinic details, notification preferences, and account settings.

Microsoft Teams Meeting Links

Every appointment booked in the Admin Portal automatically includes a Join Teams Meeting button. The same link appears in the patient's portal so both parties can join the video consultation directly. No manual link sharing is required.

Access Control

The Admin Portal is only accessible to users with the admin role. In the Enhanced package, staff access the Admin Portal for clinical work; the Director Portal is separate and requires the director role.

Director Portal

Full oversight — HR, governance, and operations (Enhanced only)

The Director Portal is available in the Enhanced Multi User Package and is accessible at /director. It provides full clinic oversight including all clinical management functions plus HR management, audits and governance, and general clinic information. It is protected by the director role and includes AES-256-GCM encryption on all sensitive data.

Clinical Operations

Overview — clinic-wide KPIs, patient count, revenue, and upcoming appointments at a glance.

Patients — full patient directory with search, filter, and status management.

Appointments — all clinic appointments across all clinicians with Teams meeting links.

Human Resources

HR Management — staff directory, employment details, DBS checks, contract type, sickness log, appraisals, training matrix, and meeting minutes. All sensitive fields are AES-256 encrypted.

Register Clinician — create a new staff account with name, email, job title, regulatory body (NMC/HCPC/GMC/GPhC), registration PIN, portal role, and contract type. Automatically creates a linked HR record.

Expiry Dashboard — RAG-rated overview of all upcoming expirations across DBS certificates, mandatory training, qualifications, insurance policies, and clinical waste contracts. Sorted by urgency.

Staff Document Vault — upload and manage staff documents (contracts, DBS certificates, appraisal forms, right-to-work checks) per staff member, stored encrypted in S3.

Governance & Compliance

Audit Register — log all clinical and governance audits with title, category, lead, due date, and RAG status (Red / Amber / Green) on completion. Send due-date reminders with one click.

Incident Reporting — record clinical incidents, near-misses, and adverse events with severity grading, date, description, and immediate actions taken.

Risk Register — maintain a live risk register. Incidents can be escalated directly to the risk register. Each entry has a likelihood/consequence matrix and assigned owner.

CQC Notifications — record all CQC statutory notifications with type, date, description, and submission confirmation. Maintain a full audit trail for inspection readiness.

General Information

Insurance — record professional indemnity and public liability insurance details, policy numbers, provider, and renewal dates.

Clinical Waste — log clinical waste contract details, contractor name, collection schedule, and contract renewal date.

Clinic Logs — general operational logs, maintenance records, equipment checks, and any other clinic-level documentation.

GDPR & Encryption

All HR data, governance records, and sensitive clinical information in the Director Portal is encrypted using AES-256-GCM field-level encryption before storage. Every data access is logged in a tamper-evident audit trail. A 30-minute inactivity lock is enforced. All data is transmitted over HTTPS (TLS 1.3).

Staff Portal

Individual clinician workspace (Enhanced only)

The Staff Portal is available in the Enhanced Multi User Package and is accessible at /staff. It gives individual clinicians access to their own clinical workspace and personal HR record. Staff do not have access to other staff members' records, HR management, audits, or governance — those are Director Portal functions.

Clinical Functions

My Appointments — view upcoming and past appointments. Each card shows patient name, appointment type, date, time, and a Join Teams Meeting button.
My Patients — view the patients assigned to this clinician.
Messages — secure messaging with patients.
Documents — access shared clinical documents.

My HR Record

Mandatory Training — view training completion status, expiry dates, and renewal reminders for all mandatory modules.
CPD Log — record and view CPD activities with date, provider, topic, hours, and reflection notes. Running total displayed.
Appraisals — view appraisal history and upcoming appraisal dates.
DBS Status — view DBS certificate type, check date, expiry, and renewal countdown. Link to the DBS Update Service.
Qualifications — upload and manage qualification documents (degree certificates, NMC/HCPC registration, prescribing qualification). Stored encrypted in S3.

Data Isolation

Staff members can only view and edit their own records. All sensitive HR data (DBS numbers, salary information, medical history) is encrypted with AES-256-GCM before storage. A 30-minute inactivity lock is enforced on all portal sessions.

Patient Portal

What your patients experience

The Patient Portal is a secure, private area for registered and approved patients. Patients access it at /portal by signing in with their Manus account. New registrations are sent to you for approval before portal access is granted.

Payments & Invoicing

Stripe integration and invoice management

The platform uses Stripe for all payment processing. Patients are directed to a Stripe Checkout page when purchasing a programme. No card details are stored on the platform — Stripe handles all payment security and compliance. You can view all payment records in the Admin Portal under the Payments tab.

Minimum Transaction Value

Stripe requires a minimum transaction value of £0.50. Pricing plans priced below this threshold will fail at checkout. Ensure all plans are priced at £0.50 or above.

CQC & Compliance

Feedback, complaints, audits, and regulatory requirements

The platform includes built-in tools to support your CQC registration and ongoing compliance obligations. The Standard package covers patient-facing CQC tools (feedback and complaints). The Enhanced package adds the full governance suite in the Director Portal.

CQC Domain	Standard	Enhanced
Safe	Contraindication screening, complaint log	Incident reporting, risk register, CQC notifications, DBS tracking
Effective	Eligibility assessment, progress tracking	Audit register, mandatory training matrix, CPD logs
Caring	Patient feedback (5-domain), messaging	Appraisals, staff wellbeing records
Responsive	Appointment booking, patient portal	Audit due-date reminders, expiry dashboard
Well-led	CQC feedback dashboard	Full governance suite, meeting minutes, risk register

GDPR & Data Security

How patient and staff data is protected

The platform is built with GDPR compliance as a core principle, not an afterthought. The following measures are in place across all portals and data stores.

AES-256-GCM Encryption

All sensitive HR data, governance records, and clinical information is encrypted at the field level using AES-256-GCM before storage in the database. This applies to DBS numbers, salary data, medical history, and all HR documents.

Encrypted File Storage

All uploaded documents (qualification certificates, staff contracts, DBS certificates) are stored in encrypted S3 object storage. Files are only accessible via time-limited presigned URLs and are never publicly enumerable.

Data Access Audit Log

Every access to sensitive data is recorded in a tamper-evident audit log with timestamp, user ID, action type, and resource identifier. This log is available for inspection evidence.

Session Security

All portal sessions enforce a 30-minute inactivity lock. Sessions are signed with JWT and stored in HTTP-only cookies. All traffic is transmitted over HTTPS (TLS 1.3).

Data Minimisation

Only the minimum necessary data is collected and stored. Patient records store only name and email as core identifiers. Clinical data from questionnaires is stored separately and linked by reference.

GDPR Consent

The eligibility screening questionnaire requires explicit GDPR consent before submission. Consent is recorded with a timestamp and stored with the questionnaire record. Patients can request data erasure via the clinic.

Your Responsibilities as Data Controller

As the clinic operator, you are the data controller under UK GDPR. You are responsible for maintaining a Record of Processing Activities (ROPA), responding to Subject Access Requests within 30 days, and notifying the ICO of data breaches within 72 hours. The platform provides the technical safeguards; your clinic's policies and procedures must complement them.

Troubleshooting

Common issues and how to resolve them

Open Admin Portal

Want a Website & Digital Platform Like This?

User Guide

Getting Started