Your personal settings live at Settings → Account → Profile — who you are, how the app looks, your password, two-factor, and your active sessions. This page is about you; agency-wide settings live under Agency Management.
Update your profile
Open Settings → Account → Profile.
Under Personal details, edit your information and set your Profile picture. Click Save changes.
Under Preferences, set your Language and Interface theme. Click Save preferences.
Change your password
On the Profile page, find Change password.
Enter your Current password, then the New password and Verify password.
Click Update password.
Forgot it entirely? Sign out, then use the password-reset option on the sign-in page — a reset link goes to your email.
Turn on two-factor authentication
On the Profile page, find Multi-factor authentication.
Turn on the Authenticator app switch and save. The row reads Enabled once it is on, and the page confirms the preference was updated.
There is no in-app pairing step (no QR code or setup key on this page). If your agency requires a second factor at sign-in, your administrator sets that up on the sign-in side and gives you the enrollment instructions — ask them before your next sign-in if you're unsure whether it applies to you.
Note: The Profile page also shows Security key backup (marked Preview only) and a separate Passkeys card (marked Coming soon). The authenticator app is the supported second factor today.
Manage your sessions
Every device signed in as you is listed under Manage sessions:
The current device is marked This device.
Click Revoke on any session you do not recognize — it signs that device out immediately.
Revoke all other sessions signs out everything except the device you are on.
Deactivate an account
Your own: the Danger zone at the bottom of the Profile page holds Delete account, gated behind a dialog where you type your email to confirm.
Someone else's: staff accounts are deactivated by an administrator from the staff roster, which keeps their history — see Add and manage staff. Prefer deactivation over deletion for anyone who worked real patients.
If something goes wrong
The reset email never arrived. Check spam, and confirm the address on your profile is your real work email. An administrator can verify the address on your staff record.
You lost your authenticator device. Contact your administrator to reset two-factor on your account, then re-enroll from the Profile page.
A session you revoked seems active. Revocation takes effect on that device's next request — give it a moment, then check the list again.