Email and alerts

ARA sends you email in two situations: because something happened to your account, and because you asked to hear about activity in an organization. The second kind is entirely opt-in — a new account receives no alerts and no reports until you switch them on.

Activity alerts are set per organization. Each one has its own toggles under Account → Email alerts for this organization, and they apply to whichever organization you currently have selected. Switch organizations in the top bar to set another one. So you can take a daily report and new-referral alerts from a busy practice while staying entirely quiet on another, using one login and one address.

Only two things are account-wide: your email address itself, and the security notices described below.

Verifying your email address

Your address is confirmed with a 6-digit code before it is ever attached to an account.

When you sign up. After filling in your details you're asked for the code we email you. Nothing is saved until you enter it, so an address you can't receive mail at can't become an account.
When you change it. The code goes to the new address. Your account keeps its current address until the code comes back, so an abandoned change simply expires.

Codes last 15 minutes, are good for one use, and lock after five wrong attempts. Request a fresh one if yours expires.

Changing your address also asks for your current password. That address is where a password reset would eventually go, so a borrowed browser session shouldn't be enough to move it.

Once a change goes through, both the old and the new address are told about it. If a message like that arrives and it wasn't you, change your password and scramble your token immediately.

Activity reports

Pick Daily, Weekly or Monthly for the selected organization. Reports go out at 6pm server time:

Cadence	Sent	Covers
Daily	Every day	That day
Weekly	Fridays	The last 7 days
Monthly	The last day of the month	That calendar month

A report covers one organization and follows that organization's own cadence, so two practices on a daily report arrive as two emails. Each one shows the referrals that came in, how many were scheduled or not, your conversion rate, what's currently waiting on you, and your five busiest sources for the period — and can be forwarded to that practice's staff without exposing anything about your other organizations.

One caveat on the outcome counts: a referral records what its outcome is, not when it was set. "Scheduled" and "Did not schedule" therefore mean referrals with that outcome that were last touched during the period. The current pipeline totals underneath — needs attention, awaiting a response, pending an outcome — are exact.

If your server was down at 6pm, the report is sent when it comes back up. You never get the same day's report for the same organization twice.

Alerts

New referral — one email per submission, naming the source it came from and linking to the dashboard.
Follow-ups due — one email per organization each time the popback sweep moves referrals back to the top of your queue, whether or not anyone has the dashboard open. See Popbacks.
Billing — a declined payment or a cancelled subscription for this organization. On by default, because a suspended organization is not something to discover by logging in.
Password and email changes — security notices, described above. Account-wide, on by default, and the one toggle that isn't per organization: a password change has no organization to belong to.

Alerts go to every member of an organization who has that alert switched on for that organization, so two people in the same practice can make different choices, and one person can make different choices in each of their practices.

Patient data is never in an email

Referral alerts and reports carry counts, source names, organization names and links. They never carry a patient's answers, a name, or a note from a referral. We don't control your inbox or the hops your mail takes to reach it, so nothing identifying goes into one — open the dashboard to see a submission.

Turning it all off

Setting reports to Off and clearing the checkboxes stops everything for that organization. Repeat it for each organization you belong to, since the settings are separate. Security notices are switched off on their own, in the account column. Your operator can also disable any category server-wide, in which case that kind of email is never sent regardless of your settings.