For Stakeholders

Why it matters

"Logout All Users" is the emergency control clinics reach for when they need to guarantee nobody has access anymore — offboarding, a lost device, or a suspected compromise. A control like that has to be complete, or it isn't trustworthy. Before this fix, it terminated sessions correctly but silently left a side channel open: already-logged-out devices kept receiving push notifications describing clinic activity (new appointments, invoices, tasks, etc.). This fix closes that gap so the control does what its name promises.

Risk assessment

• Data exposed by the gap: notification content only — short activity

summaries (e.g. "New appointment booked," "Invoice #4521 created"). Not patient charts, not credentials, not financial detail beyond what a push notification banner shows.

• Who was exposed: whoever had physical access to a device that had

already been forcibly logged out by an owner — precisely the scenario (lost device, departing employee) where "Logout All Users" is used, which makes closing this gap more important, not less.

• Likelihood/severity: low-severity, narrow-scope information leak; not a

credential or PHI/financial-record exposure. Still worth fixing promptly because it undermines confidence in a security control that's marketed (to ourselves and to customers) as a complete lockout.

Impact of the fix

• Blast radius of the change: one mutation

(logoutOutAllUsers), five lines added, no schema change, no new permission, no UI change. Low implementation risk.

• Behavior change: every staff push token for a company is cleared

whenever an owner uses "Logout All Users." Anyone logging back in afterward simply re-registers their device as normal — no user-facing friction.

• Nothing else changes: individual logout and patient-portal

notifications are unaffected; see the feature breakdown for the exact boundaries.

Status

Unreleased. This documentation set reflects the pre-release sandbox build, not a shipped customer-facing feature.