Two-step verification: setting it up, and what happens if you lose your phone

Two-step verification means signing in needs your password and a six-digit code from an app on your phone. Your clinic holds your patients' medical records. A password on its own can leave those records exposed; with two-step verification they would need your phone as well.

What you need

Use an authenticator app on your phone. Keep your recovery codes somewhere separate from that phone.

Setting it up (about two minutes)

1. Select your name at the bottom of the menu, then My account. You can name the device if you like, then press Set up two-step verification.
2. Open your authenticator app, add a new account and scan the code on the screen. The app shows a six-digit code that changes every 30 seconds. Type in the current one. If a setup code is wrong, the same QR code and setup key remain available, so you do not need to add another authenticator entry.
3. Save your ten recovery codes. Download them and keep them somewhere that is not your phone, like a password manager or printed in the office. You will not see them again, and setup does not finish until you have said you have saved them.

If you are an owner setting up a new clinic and the setup card is shown, use the Protect your account card during setup. Set it up now does the same thing without leaving setup, and Do this later hides it.

Signing in from now on

Use your password as normal, then enter the six-digit code from your app. If the page tells you to use an entry ending with particular characters, match that ending in your authenticator app. Older entries may not have an ending shown. An email sign-in link still asks for your authenticator code afterwards. If the sign-in link has expired, you can request a fresh one from the code page.

If you lose your phone

Sign in with your password, choose Use a recovery code and type in one of your ten codes. Using a recovery code removes your verified authenticator factors and invalidates every remaining recovery code. Set up two-step verification again and save a new set. The system also attempts to sign you out of other sessions.

Running low? My account shows how many codes you have left, and Make new recovery codes gives you a fresh set. The old ones stop working straight away.

If you have lost your phone and your recovery codes

Email hello@aestheticlinic.io if you cannot sign in. We will check it is you, then reset it so you can set it up again.

Getting a new phone

Easiest while you still have the old one. Go to My account, under Turn off two-step verification enter a code from the old phone and press Turn off, then set it up again on the new one.

Your team

Each team member can set it up for their own account from My account.

Your patients

Nothing changes for them.

"My code is not working"

Check your phone's clock is set automatically and use the authenticator entry named on the page. The codes depend on the time. If the message says your code could not be checked just now, try again in a minute; that is different from a code being rejected.