Roles and permissions

AveeCare uses four roles to control what each login can see and do: RootUser, User, Caregiver, and Patient. Which role a new login gets depends entirely on which entry card you click on the Accounts page. Afterwards, the only change available is adding or removing office or caregiver access from Manage access, so one person can be both.

Quick answer

Open Accounts to see the role of every login in the Role column. To add a new login, pick the entry card that matches the role you want: Create User makes a User (office staff admin), Link Caregiver attaches a Caregiver login to a caregiver record, and Link Patient attaches a Patient login to a patient record. The RootUser is the company founder, created when the agency first signs up, and there is no UI to promote anyone else into it.

Open Accounts

The four roles, end to end

• RootUser. The first account created when an agency signs up. Full administrative access plus a handful of owner-only fields like SMS provider credentials and the company name. Cannot be deleted. There is no row action to assign someone else the RootUser role.
• User. The office-staff administrative role. Can add and delete other Users, add and modify patients, add and modify caregivers, run scheduling, run billing, and view almost every page in the dashboard. This is what Create User on the Accounts page produces.
• Caregiver. The caregiver-side surface. Sees only their own assigned visits, their own pay rates (if the company allows it), their own profile, and the caregiver app shell. Cannot see other caregivers, billing settings, or company financials. This is what Link Caregiver on the Accounts page produces, by attaching a Cognito login to an existing Caregiver record.
• Patient. The patient portal. Sees their own visits, their own care plan, and basic profile fields. Cannot see other patients, caregivers, or any company-wide data. This is what Link Patient on the Accounts page produces, by attaching a Cognito login to an existing Patient record.

1. See the role for every account on the Accounts page

Open Accounts

1. 1

   Click Accounts in the left sidebar.

   The page loads with the three entry cards at the top, an Account List in the middle, and Audit Logs at the bottom. The Role column sits between Name and Linked To.
   
2. 2

   Read the colored pill in the Role column for each row.

   Each role has its own pill color so the column is scannable at a glance: RootUser is orange and renders as Root User in the pill, User is blue, Caregiver is yellow, and Patient is green. The Linked To column shows the caregiver or patient record this login is attached to for Caregiver and Patient rows, and a dash for User and RootUser rows.

2. Pick the entry card that matches the role you want

1. 1

   Look at the three entry cards at the top of the Accounts page.

   The three cards map one-to-one to the three roles you can assign from the UI. There is no role dropdown on any of the forms, so the card you click is the role you create.
   
2. 2

   Click Create User for an office staffer who needs administrative access.

   Create User makes a User role login. The form opens a red warning panel that lists exactly what the new account can do: add and delete users, add or modify patients, add or modify caregivers, and more.
   
3. 3

   Click Link Caregiver to give an existing caregiver record a login.

   Pick a Caregiver record from the company, then attach a Cognito login to it. The new login lands with the Caregiver role and can only see surfaces tied to that caregiver record.
4. 4

   Click Link Patient to give an existing patient (or family member) a login.

   Pick a Patient record from the company, then attach a Cognito login. The new login lands with the Patient role and only sees the patient portal for that patient.

3. Know what each role can see and do

1. 1

   RootUser is the founder. Full access, cannot be deleted.

   RootUser is created automatically when a new agency signs up for AveeCare. It has every permission a User has, plus owner-only fields like the company name, SMS provider credentials, and billing exemption flags. There is no in-product action to delete the RootUser or promote another account into it.
2. 2

   User can run the whole agency, with a few exceptions.

   User is the office-staff admin role: add and delete other Users, manage patients and caregivers, schedule visits, run billing, configure EVV, manage the Settings page. Owner-only fields like the company name and SMS auth token are read-only for User even though the rest of the company configuration is editable.
3. 3

   Caregiver sees only their own visits and profile.

   A Caregiver login can clock in and out of their own assigned visits, view their schedule, file incident reports tied to their visits, see their own pay rates if the company allows it, and update their own profile. They cannot list other caregivers, see other patients, or open company-wide pages like Billing or Reports.
4. 4

   Patient sees only the patient portal for their own record.

   A Patient login can see their own upcoming and past visits, their own care plan and care notes, and their own profile fields. They cannot see other patients, caregivers, or any company-wide setting.

4. Give one person both office and caregiver access

1. 1

   Use Manage access on the row. Do not delete the login.

   Each User and Caregiver row on the Account List has a Manage access button (a person icon with a gear). It adds or removes the office side or the caregiver side of the same login, so the person keeps their email, password, and history. Deleting a login and re-creating it is never needed for this.
2. 2

   A caregiver login gets office access with one click, and is signed out.

   On a Caregiver row, click Add office access and sign them out. They become a User and keep their caregiver profile. They are signed out because their sign-in decides what the app lets them do, and sign back in with the same email and password.
3. 3

   An office login gets a caregiver profile without signing out.

   On a User or RootUser row, pick the caregiver profile and click Add caregiver access. Create the caregiver profile on the Caregivers page first if it does not exist yet. See Office and caregiver access on one login for the full walkthrough, the limits, and how to undo it.

Common pitfalls

• Looking for a Role dropdown on Create User. There is no role picker. Create User always produces a User. To make a Caregiver or Patient login, click the matching Link card instead.
• Trying to promote an office staffer to RootUser. RootUser is fixed at signup and cannot be reassigned from the UI. If your founding RootUser needs to leave the company, contact AveeCare support before you delete or disable the account.
• Using Create User for a caregiver who only needs to clock in. Create User grants administrative access to the whole agency. For a caregiver, always use Link Caregiver so the login only sees their own visits.
• Assuming office scoping comes from the role. Role controls what the login can do across the company. Limiting a User to one office is a per-account assignment on the Caregiver or User record, not a separate role.
• Deleting a login to change what it can do. Deleting removes the login for good and sends the person a new temporary password when you re-create it. To add or remove office or caregiver access, use Manage access on the row instead.
• Forgetting that Delete User unlinks the caregiver record. Deleting a Caregiver login from the Account List unlinks the login from the Caregiver record. The caregiver record itself stays intact, so their visit history, pay rates, and certifications are not lost.

Related

• Accounts table
• Invite a user
• Link an existing caregiver account
• Link a patient account