Notifications and inbox updates

Who this page is for: practice staff choosing how Refera should get their attention, and anyone checking why an alert or account email did not arrive.

Refera tracks referral admin only. It does not triage patients.

Recommended setup

1. On each reception computer or phone, open Settings > Notifications, turn on New referrals on this device, then send a test.
2. Keep the active workspace owners and admins current. Refera automatically queues a status receipt for them when a Microsoft 365 inbox connects, needs a setup or access action, has a delayed or restored check, is cancelled or fully disconnects.
3. Choose any optional helpful emails you want. Categories that are not available to the signed-in account are not presented as working controls.

Device alerts and ordinary emails never contain patient, referral or document details. Open Refera to see and work the referral itself.

Live inbox updates

The connected Inbox shows one transport status above the queue:

• Inbox updates on means the last portal check succeeded and automatic checks continue.
• Checking for arrivals means a read is in flight.
• Offline means this device has no network connection. Refera retries after reconnect.
• Updates interrupted means the last check failed. The existing queue is left unchanged and Refera retries automatically.

The line beside it is the time of the last successful check, not the last attempt. The refresh button performs the same authenticated read immediately. A 304 Not Modified response is a successful check and does not rebuild the queue.

This status describes the portal’s authenticated queue read. It does not claim that the practice’s email, fax-to-email or enabled HealthLink source is healthy. Connection status is shown separately under Settings > Connections.

While the page is visible, Refera checks every 15 seconds. A hidden tab checks every 60 seconds. The API returns the same strict (receivedAt, id) arrival order on every read and the browser refuses a response that does not affirm that contract. No refresh uses stated urgency, category, diagnosis, source or any computed clinical fact.

The small new arrivals counter means “new referral records seen by this browser since this console opened”. It is not an alert count and it carries no severity. Marking it seen clears only that personal counter. It does not change a referral or its place in the queue.

Check which inbox is connected

Open Settings > Connections. The Microsoft 365 card names the exact inbox and shows one of these plain-language states:

• Connected means the chosen inbox has passed the connection checks and Refera is checking it for new mail.
• Inbox check delayed means the latest poll is late. The card shows the last successful check, the inbox boundary verified at activation and the automatic retry. New email may take longer to appear until the state returns to Connected.
• Administrator approval needed means an administrator authorised to grant Entra application consent and manage Exchange Online application RBAC still needs to open the Microsoft approval link. No approval email is sent automatically.
• Checking the connection means the Microsoft step is complete and Refera is finishing the inbox checks. You can leave the page; it updates when you return.
• Disconnected means no Microsoft inbox is active.

When an inbox is connected, the card offers Open Inbox, Choose alerts and Connection help. Existing messages are not imported. To use a different inbox, open the quieter Change or disconnect inbox action on the same card.

Refera also queues an operational email for workspace owners and admins when that exact inbox becomes connected, needs a setup or access action, is cancelled or is fully disconnected. If an active Microsoft inbox has no completed check within the same 10-minute window used by Connections, Refera attempts one Referral inbox check delayed email for that interruption. Automatic retries continue. At first detection, Refera freezes the owner and admin recipient set and records one recovery watch for each person using a one-way hash rather than their email address. A recovery receipt remains blocked unless the provider accepts the warning for everyone in that original set. If a fresh same-connection check completes within 24 hours, Refera attempts one recovery receipt for each warned person who is still an active owner or admin. A removed member and an admin added after the warning do not receive that recovery receipt. Provider acceptance is not proof of mailbox delivery. The exact-inbox health check continues until the connection is removed, and a later interruption is a new episode only after a newer successful check.

These messages name the connected inbox and distinguish connection ready from live capture on. They cannot be switched off and contain no patient, referral or source-document information. They do not claim that an individual email arrived or was missed.

The status shown in Connections is the source of truth. An email, a Microsoft consent screen or the existence of an app registration does not by itself prove that referral capture is active. The last-checked timestamp is written only after an inbox poll completes and Refera re-verifies that the poll still belongs to the current inbox connection. It does not repeat the separate control-inbox denial proof or prove that a Microsoft administrator has made no later permission change; Connections therefore labels the boundary as the scope verified at activation.

Turn device alerts on

1. Open Settings > Notifications in the licensed portal.
2. Under New referrals on this device, choose Turn on alerts.
3. Accept the browser or operating-system permission prompt.
4. Use Send a test to check this device.

Permission is requested only from that button. Refera does not repeatedly prompt after a denial. Each browser profile or installed web app is a separate device subscription.

On desktop, current Chrome, Edge, Firefox and Safari releases expose Web Push in a secure context. Installing Refera as a desktop web app is optional, but an installed app can make the console easier to find and lets the operating system manage its notifications alongside other apps. Browser and operating-system settings remain authoritative.

Emails Refera sends

The Notifications page shows only the controls available to the signed-in practice and account:

• New-arrival alerts on this device use Web Push. The page verifies browser permission, a local subscription and the server record before it says they are on.
• Free allowance milestone emails appear only when Refera confirms that delivery is available. The administrative practice contact can then opt out of count-only milestone messages as the practice approaches and reaches its free-referral cap. If provider identity, DKIM, aligned MAIL FROM or monitored delivery proof is absent, the control is unavailable and no notice lease or send is attempted.
• Help me finish setup is a separate, optional per-account category. It is off unless the person explicitly selects it at signup or turns it on in authenticated Settings. Refera records the consent wording version, source and server timestamp, sends at most three administrative messages while setup remains incomplete. Each consenting active member is handled independently, later steps are scheduled from the previous confirmed delivery, and the sequence stops when the workspace goes live. Every message has an HTTPS one-click unsubscribe link. Opening that link does not change the preference; the confirmation action does, so an email security scanner cannot unsubscribe the account. Amazon SES suppresses recipients after either a bounce or complaint. These messages contain no patient or referral information.
• Worklist alerts, the weekly practice summary and product news email appear only when their delivery path is available. Unavailable controls are hidden and nothing is scheduled.
• Referral inbox receipts are required account emails for active workspace owners and admins. Refera queues one when Microsoft setup connects, needs a setup or access action, is cancelled before access, is fully disconnected, or an active inbox check becomes delayed. A single recovery receipt is attempted for each warned recipient who remains authorised only after the provider accepted every warning and a fresh same-connection check completes within the bounded recovery window. Provider acceptance is not mailbox-delivery proof. These are operational receipts rather than optional setup guidance and contain only practice, inbox, timestamps and connection status information.

The example workspace sends no external email and registers no push endpoint.

iPhone and iPad

Apple supports Web Push for Home Screen web apps on iOS and iPadOS 16.4 and later. A normal Safari tab cannot opt in. Apple’s documented sequence is:

1. Open the licensed Refera portal in Safari.
2. Open Share and choose Add to Home Screen.
3. Open Refera from the new Home Screen icon.
4. Sign in, then open Settings > Notifications and choose Turn on alerts.

See WebKit’s Web Push for Web Apps on iOS and iPadOS for Apple’s platform requirement.

What appears on a lock screen

Refera constructs the notification copy inside the service worker from a bounded numeric count. The fixed production shape is:

New referral received 2 new referrals are waiting in Refera.

It never contains a patient or referrer name, practice name, diagnosis, reason, source document, quoted timeframe, stated urgency, attachment, referral identifier or clinical detail. Tapping it opens the Inbox. It does not open a referral record.

Delivery and privacy

The browser subscription endpoint and encryption keys are stored in the practice’s tenant partition in DynamoDB in AWS Sydney. Notification delivery then uses the push service chosen by the browser, such as Apple Push Notification service, Google Firebase Cloud Messaging or Mozilla Push. Those global services receive delivery metadata and an encrypted generic count-only payload. They do not receive referral content or patient data from Refera.

The exact provider scope is listed in Sub-processors.

Turn notifications off

Choose Turn off on this device in Notification settings. The browser invalidates its local subscription first, which stops delivery to that endpoint immediately. Refera then removes the server record. If that cleanup cannot reach the server, the device remains off and Refera records a pending cleanup locally to retry on the next authenticated load; provider 404 and 410 responses are a second cleanup path.

Signing out removes every push subscription bound to that signed-in account, then removes the local browser subscription and burns the session. Expired Apple, Google, Mozilla or Microsoft endpoints are removed automatically after a 404 or 410 delivery response. An endpoint that never completes a handoff is cut off after 15 seconds; after five bounded retries it is removed so one dead browser endpoint cannot hold the practice’s notification batch open indefinitely.

If the browser push key rotates, Refera removes the old endpoint and renews the device under the permission already granted. On every reload, the Settings page verifies that the local subscription still exists on the server before it says notifications are on.

Limits and native apps

One account may register up to 10 devices and one practice up to 100. Subscription changes and test messages are rate-limited. Browser push endpoints are accepted only for the known Apple, Google, Mozilla and Microsoft browser push hosts, so the send path cannot be used as an arbitrary outbound request service.

The iOS and Android store shells are unpublished. Native APNs/FCM delivery remains disabled until a production token endpoint, platform credentials and native sign-in path are proven. The installed web app described above is the current mobile notification path.

If an alert or email does not arrive

1. Open Settings > Notifications and read the status beside that exact channel.
2. For device alerts, choose Send a test. Each browser profile and installed web app is a separate device.
3. Check the browser and operating-system notification settings. If permission is blocked, Refera cannot override it.
4. For optional email, check that the control is on for the signed-in account and look in junk mail. Help me finish setup emails and allowance reminders contain no patient or referral details.
5. If the page says the channel is unavailable or the test fails, contact Refera from Help in the portal. Do not include patient, referral or clinical information in the support message.