# User Guide This guide covers day-to-day usage for professionals and patients. It reflects the current access model, in which what you can do is decided by your **affiliations** (which clinic you work at and in which role), the **phases** an SU admin has granted you, and whether your account has been **activated**. ## Professional Workflow ### Logging In 1. Go to the SSO login page (`/login`) 2. Enter your email and password 3. Click **Login** 4. You will be redirected to your dashboard If you arrived from another service (SSO handshake), you will be automatically redirected back after login. ### How your access is decided Three independent things combine to decide what you can do in each PDHC service: - **Affiliations** — each affiliation binds you to **one care unit (clinic)** in **one role** (for example *Doctor at Oncology Clinic*). You can hold more than one — e.g. Doctor at one clinic and Researcher at another. Your role determines which phases you are *allowed* to work in. - **Phases** — the service areas you have been granted: *planning* (Plan), *request*, *provider* (Receive), and *analysis*. Phases are granted explicitly by an SU admin; they are not implied by anything else. - **Activation** — your account must be **activated** by an SU admin before any of the above takes effect. At the moment you use a service, the system works out your **session phases** — the phases you have been granted *and* that your current role is allowed to use. For example, an *Other care professional* role does not permit the *analysis* phase, so even if you were granted *analysis*, it would not apply while you act in that role. (The *planning*/Plan phase is special: it involves no patient data and applies whenever it is granted, regardless of role.) !!! warning "Being granted a phase is not enough — your account must be activated" A brand-new professional account starts **unactivated**. Until an SU admin activates it, every phase-gated service treats you as having **no access**, even if phases have already been granted. An SU can only activate your account once your profile is complete: at least one affiliation, at least one granted phase your role can actually use, and — for any *Researcher* affiliation — at least one research project attached. If something is missing, the SU is shown exactly what to fix. ### Dashboard After login, the dashboard shows: - **Your affiliations** — the clinic + role bindings you currently hold. - **Your phases** — which service phases you have access to. - **Your groups** — approved group memberships (with category and admin status). Groups are organisational/category metadata — they list who you work with, not what you can do. ### Requesting Group Membership To join an existing group: 1. From the dashboard or `/request-join`, select the group you want to join 2. Submit the request 3. A group admin or SU admin will review your request 4. You will appear in the group once approved !!! note "Joining a group does not grant phase access" Group membership shows who you are associated with (e.g. "Oncology Planning"). Its category is a free-form label only; it does not by itself give you access to any service phase. If you need access to a new phase, ask an SU admin to grant it. ### Joining by Invite If you received an invite token from a group admin: 1. Go to `/join` 2. Enter the invite token 3. Submit — this creates a pending membership 4. A group admin must approve your membership ### Requesting Group Admin Role To request admin privileges for a group you belong to: 1. Navigate to `/request-join` or use the dashboard 2. Select the group and request the admin role 3. An SU admin will review and decide ### Suggesting a New Group 1. Go to `/suggest-group` 2. Enter the proposed group name 3. Select the group category: `planning`, `request`, `provider`, or `analysis` 4. Submit — an SU admin will review your proposal ### Changing Your Password 1. Go to `/change-password` (also accessible from the dashboard) 2. Enter your current password 3. Enter a new password (minimum 8 characters) 4. Confirm — you remain logged in ### When an Admin Resets Your Password An SU administrator can force you to pick a new password (for example, after you report a forgotten password or a suspected leak). When this happens: 1. The admin communicates a **temporary password** to you out-of-band (by phone or in person) 2. The next time you open *any* PDHC service (dashboard, plan, contract, request, cgm, rosetta, etc.) you will be **automatically redirected** to the SSO change-password page — you cannot use those services until you set a new password 3. Log in with the temporary password if prompted, then set a new one on `sso.pdhc.se/change-password` 4. Once you submit a new password successfully, every service unblocks on your next click — no need to log back in everywhere If you are instead told that **all your sessions have been cleared** (a separate admin action, typically for a security incident), you will simply be logged out everywhere and asked to log in again with your existing password. No automatic redirect to change-password in that case. --- ## Patient Workflow ### Registration 1. Go to `/register-patient` 2. Fill in: - **Email** — your email address - **Password** — minimum 8 characters - **Personnummer** — exactly 12 digits (Swedish personal identity number) - **Organisation** — select from the dropdown 3. Submit — your account is created immediately 4. You can now log in ### Logging In 1. Go to `/login` 2. Enter your email and password 3. Click **Login** 4. You will see your patient dashboard ### Dashboard The patient dashboard shows: - **Registry status** — whether you are enrolled in any registries - **Registries** — list of registries you participate in (e.g., INCA) - **Organisation** — your affiliated organisation ### Viewing Registry Status Your registry enrolment status is shown on the dashboard. This information comes from the IPS (Integrated Patient Summary) system and reflects your current participation in quality registries. --- ## Access Request (New Professionals) If you are a new professional who does not yet have an account: 1. Go to `/request-access` 2. Fill in the form: - **Email** — your professional email - **Password** — choose a strong password (min 8 characters) - **First name** and **Last name** - **Role** — the professional role you are requesting - **Organisation** — select from the dropdown - **Requested phases** — which service phases you need (this is a *request*; an SU admin decides which to grant) - **Chosen leader** — select a group leader or SU admin who can endorse you 3. Submit your request 4. Wait for review: - A leader may **endorse** your request - An SU admin **approves** it, which creates your account and sets up your affiliation(s). Phase grants and activation are separate, explicit SU actions. 5. Once your account exists, an SU admin grants your phases and then **activates** your account. Until it is activated, phase-gated services return no access even after phases are granted. --- ## Common Tasks ### Accessing Downstream Services When you click a link to another PDHC service: 1. If you are already logged into SSO, you are redirected seamlessly 2. If not, you see the SSO login form 3. After login, you are sent back to the original service Your access level in each service depends on your **session phases** (your granted phases narrowed by the role of your active affiliation), your affiliated care unit / caregiver (for scope), and your group memberships (for category). Each service composes its own policy from these inputs; the SSO supplies the facts. ### Viewing Documentation Service documentation is available at `/docs`. This page provides access to downloadable documentation files. ### Landing Page The landing page (`/`) shows all registered services in the PDHC ecosystem, pulled from the service registry.