Each time you sign in to CoolFocus on a browser or device, you start a session. A session is what keeps you signed in as you move between screens, so you aren't asked for your password on every click.
This article explains how sessions work, how to see and end them, and what administrators can do when someone leaves the organization.
For everyone
You're signed out after 30 minutes of inactivity
If you don't use CoolFocus for 30 minutes, your session ends and you're returned to the sign-in page the next time you click something. This protects client, donor, and medical information on a computer left unattended, for example at a front desk or in a shared office.
As long as you keep working, you stay signed in. The 30 minutes restarts every time you use CoolFocus.
Writing a long note? If you'll be typing in one place for a long time without saving, for example a detailed visit note, save partway through. Then an inactivity sign-out can't cost you your work.
On a shared or public computer, always sign out when you're done. Don't rely on the 30-minute timeout, and remember that closing the browser tab does not sign you out.
One account per browser
Only one CoolFocus login can be signed in per browser at a time. To use a different login, sign out first.
This is different from belonging to more than one organization. If one login has access to several organizations, you don't need to sign out. Use Switch organization in the account menu instead.
Signing out
Select your profile picture or initials in the account menu, then choose Sign out. This ends your session on this browser only. You stay signed in on your other devices.
See where you're signed in, and sign out other devices
You can see every device and browser where your account is currently signed in:
Open the account menu and choose Manage account.
Open the Security tab and scroll to Active devices.
Each entry shows the device type, browser, approximate location, and when it was last active. The device you're using now is marked This device.
To end a session somewhere else, open the menu on that device and choose Sign out of device. The next time someone uses CoolFocus on that device, they'll have to sign in again.
See a device you don't recognize? Sign it out, then change your password right away. When you change your password, keep Sign out of all other devices checked. That ends every session except the one you're using.
"Confirm it's you" before a sensitive action
Some actions ask you to confirm your identity again even though you're already signed in. Examples include approving some clinical and financial records and changing your password or security settings.
When this happens, enter your password or a verification code. Then CoolFocus finishes the action you started. This protects you if you leave your computer unlocked and someone else sits down at it.
You were signed out unexpectedly
This is usually one of these:
You were inactive for 30 minutes. Sign in again.
You signed in with a different login in the same browser, which replaced your earlier session.
You, or someone using your account, chose Sign out of all other devices or reset the password.
Your browser is set to clear cookies when it closes, or you're using a private window.
For administrators
Removing someone's access
When a staff member leaves, deactivate or remove them under Settings → Security → Users. They lose access to your organization's data within a few minutes, including on any device where they're still signed in. Every request they make after that is refused.
Their login itself isn't deleted. If they also belong to another CoolFocus organization, they keep their access there.
Reviewing sign-in activity
The Security Log records successful sign-ins, failed sign-ins, sign-outs, and blocked IP addresses for your organization. User Logs shows each person's activity over time.
Signing a staff member out of their devices
Administrators can't end another person's sessions from inside CoolFocus. Instead:
To cut off their access completely, deactivate the user. This takes effect within a few minutes, as described above.
If their account may have been compromised, ask them to change their password with Sign out of all other devices checked. You can also contact [email protected] and we will end their sessions for you.
Can we change the 30-minute timeout?
No. The inactivity timeout is the same for every organization on CoolFocus. Thirty minutes is in line with common guidance for systems that hold health and financial information. If your written security policy requires a different timeout, contact [email protected] so we understand the requirement.