A mother and her adult daughter share one email address at the front desk, and only one of them is your patient. If portal access were granted by matching emails, the wrong person could end up reading someone's appointments. So it never is: a staff member approves every link.
Two ways to approve
On the patient's page, the Patient calendar access panel has a single email field and two buttons.
- Connect existing user: if that email already has a Goji sign-in, the patient is linked straight away. If it does not, you are told no sign-in exists yet and nothing is created.
- Create invite preview: makes a one-time link to /me/invite/ plus a long random token. Only a hash of the token is stored, and the link expires after 14 days.
When the patient opens the link
A visitor who is not signed in is sent to log in if that email already has an account, or to sign up if not, and then returned to the link. Accepting only works from a sign-in whose email matches the invited one; anyone else is told which address the invite was sent to. A used, expired or unknown link just says the invite is no longer valid and to ask the practice for a fresh one.
Afterwards
Once linked, the panel shows the connected name and email, whether the email is verified, and a Disconnect button that removes access. A patient record has one connected sign-in at a time, so connecting or accepting a new one replaces the old. Linking and unlinking are written to the access log. What the patient then sees is in Patient calendar.