Connectors are a PracticeHub 2.0 platform feature. If nobody in your account can see Developers → API Keys, the platform hasn’t been switched on for you yet and role permissions below won’t matter until it is.
During the limited rollout, connectors are read-only — the server exposes no write tools, so a connector can look things up but cannot book, take payments or change records regardless of the role behind it. The write-permission rules below describe how roles will govern writes once write access is switched on; the read-side rules (visibility, own-patients and own-calendar ringfences) apply today.
Who can connect
Connecting an AI app is opt-in per role:- Account owners and super users can always connect one — this is implicit and can’t be switched off.
- Everyone else needs their role to have Connect AI apps (Claude, ChatGPT) turned on, under Settings → Security → Roles.
1
Open the role
Settings → Security → Roles, then the role you want to allow (e.g. “Front Desk”, “Practitioner”).
2
Turn on the toggle
Find Connect AI apps (Claude, ChatGPT) and switch it on. This only grants the ability to start a connection — it doesn’t grant any new read/write powers by itself.
3
Save
The team member can now add PracticeHub as a connector from their own AI app; see Connectors for the steps you’d hand them.
What a connected assistant can and cannot do
A connector acts as the team member who approved it, with their PracticeHub role — never more than that person could do by hand in PracticeHub. There’s no separate “AI permission level”: the same role permissions that govern the app govern the assistant.- Reads follow the role. Appointments and availability need calendar access; invoices, payments and allocations need View all patient financial data; clinical notes need Patient visit notes — the same toggle that shows or hides the notes tab in PracticeHub itself; most reference data and patient records are visible to any connected team member.
- Writes will follow the role (the assistant is read-only during the limited rollout, so none of this applies yet). Patients, files and patient-log notes need Edit patient; booking, moving or cancelling appointments needs calendar access (a read-only-calendar role can look but not touch); recording invoices and payments needs Edit patient financials (the same-day-only variant doesn’t count); allocating payments needs Allocate payments; deleting anything needs the matching delete permission; changing settings-type data (locations, appointment types, referral sources, …) needs Access settings. Clinical notes will need that same Patient visit notes permission to write, not just to read — no separate write-side toggle; a role limited to draft-only notes will only create drafts through a connector too.
- Restricted roles stay restricted. A role limited to own patients only sees and edits patients where that person is the default practitioner — and can’t create a new patient at all through a connector, since a new patient would have no default practitioner. A role limited to own calendar only sees that person’s own diary and can only book or move appointments within it.
- Account owners and super users hold every permission, so nothing above narrows what they can do through a connector.
Seeing and revoking connections
Developers → API Keys → Connected AI apps lists every live connection as an app + team member pair (e.g. “Claude — Dana Scully”), with when it was approved. An account owner can revoke any row from there — including their own. Revoking:- Ends that connection’s access immediately — its refresh token is revoked too, so the AI app can’t silently mint a new access token and keep going.
- Doesn’t touch the team member’s PracticeHub login, or any other connector they may have approved separately (e.g. Claude and ChatGPT are revoked independently).
What’s audit-logged
Every connector-related credential event is written to the account’s security activity log (Reports → User Activity, filter by category “security”):
Beyond that, every individual read or write a connector makes is logged like any other API call, on Developers → API Logs, attributed to the team member it’s acting as (not to “Claude” generically) — the same trail an API key’s calls leave, just with a person’s name on it instead of an integration’s.
Token lifetimes
- Access tokens last one hour. The AI app is expected to refresh silently in the background — a person using it shouldn’t notice.
- Refresh tokens last 30 days idle, and rotate every time they’re used. If a connector goes completely unused for 30 days, its refresh token lapses and the team member has to approve the consent screen again next time.
- Revoking a connection revokes both immediately, regardless of either lifetime above.
Ground rules for a team using assistants
A few practical habits, matched to how the platform actually works:- Grant the permission per role, not to everyone. Only turn on Connect AI apps for roles that should be able to look patient and diary information up through an assistant (and, once changes are switched on, book, edit or move things) — a read-only front-desk role, for instance, may not need it at all.
- Ask assistants to confirm before writing. Nothing in the platform requires this, but a well-behaved assistant should read back a booking, cancellation or payment before doing it. Say so explicitly in the first message of a conversation if yours doesn’t.
- Use the audit trail if something looks off. API Logs shows exactly what a connector did and when, attributed to the person who approved it — check there before assuming an appointment or note was created by mistake.
- Revoke on departure, not just deactivation. Deactivating a leaving team member’s account does cut off their connectors automatically, but revoking explicitly (and checking Connected AI apps is empty for them) is a good habit for a clean handover.
- Treat a lost device like a lost password. Revoke the connection from Connected AI apps immediately — it takes effect on the next call, no waiting for a token to expire.