User profile and security

Overview

The Profile page allows every laboratory team member to manage their personal account identity, authentication security, connected devices, Kashef Bot notifications, and connected AI tools. The page is accessible directly from the user menu in both the Lab Panel and Branch Panel.

General profile

The General Profile tab contains your core personal and contact information:

• Profile photo: Upload a clear work-appropriate avatar (JPEG, PNG, or WebP up to 2 MB). You can crop the image into a circle using the built-in image editor.
• Name and email: Your official display name and primary login email address.
• Phone number & Date of birth: Optional contact and identity details.
• Bio & staff notes: Optional professional bio or specialization notes.

Security and password

The Security & Password tab lets you update your password:

• To update your password or login email, you must enter your Current password for verification.
• Passwords must be at least 8 characters long and contain a mix of uppercase, lowercase, numbers, and symbols.

AI tools (MCP) (Kashef Cloud)

Open the AI tools (MCP) tab of your profile and select Copy next to the MCP server address. In your AI tool, add a custom remote MCP server (often called a connector) using Streamable HTTP and OAuth, paste the address, and connect. Sign in to Kashef, check the application name and return address, then select Allow access only if you trust the application. The tab also shows setup examples for Claude, ChatGPT and Claude Code.

Kashef MCP is available to every staff role, as long as your laboratory's subscription plan includes Kashef MCP. If the plan doesn't include it, Kashef shows an upgrade page instead of the access request. Laboratory owners and managers with subscription access can open the plans from there; other staff should ask them to upgrade. If the plan changes later, connected tools stop working until it is upgraded again.

If Kashef says the connection request has expired, it was already used or replaced, for example after opening it in another tab. Return to your AI tool and connect again.

If the AI tool connects directly from a web browser and Kashef refuses the connection, contact support with the AI tool's web address so its browser connection can be enabled. Never send your password or access tokens to support.

Each request uses your current branch access, permissions, and laboratory subscription. Connecting a tool does not grant additional features or permissions. Ask the tool to list your available branches before working with laboratory data.

The current tools support feature discovery, queries over supported laboratory datasets and reports, adding notes to editable orders, and starting or stopping your order updates. Ask your AI tool to follow an order to receive its updates, or stop following it; your notification preferences still control delivery. This changes only your own follow preference.

For editable orders in the selected branch, you can inspect priority, ordering doctor and SLA, then update those fields with a current revision. To end an order, ask for a deletion/cancellation preview and review all its effects before requesting the offered action. Cancellation creates any required refund request and records sample custody; it does not pay the refund. See Managing orders.

Ask the AI tool to list readable record datasets for your selected branch. Depending on your access, it can browse or search test catalogs, packages, sample and tube types, laboratory units, doctors, insurance providers, inventory items, suppliers, warehouses, stock levels, supply requests, receipts, warehouse transfers, instruments, quality controls and results, and sample saving locations. It can fetch a record by ID and continue through additional pages. These record tools provide the listed fields for reading; they do not edit those records or expose connection credentials.

To correct a patient's contact, demographic or reusable medical-history details, ask the AI tool to read the current profile first, then specify the fields to change. Your patient editing permission is required. Changes are audited, and demographic corrections enter the patient's revision history. Record medical history supplied by the patient or staff; do not ask the tool to infer diagnoses. A condition selection replaces the full existing list, so review what should remain selected. An empty selection clears conditions, and the history note can be cleared separately. Patient profiles are shared within the laboratory. If someone updates the profile before saving, read it again and review the correction. Earlier order history snapshots and captured released-report identities retain their original details. Duplicate-resolution tools require their own merge permission and reviewed confirmation; see Patients. Portal-account administration remains in Kashef.

You can also ask the AI tool to inspect a sample's workflow and perform an available next step, including collection, transit, receiving, processing, results or rejection. Confirm collection with the actual collection time, and provide volume only when it was measured. The tool can record a saving location, store an eligible sample, set EOL, record disposal after EOL, or correct its status with a reason. Inspect the workflow again if the sample changes. The same permission, transfer, result and custody checks apply. These actions do not enter, approve or release clinical results. See Samples.

For supply requests, the tool can draft low-stock reorders for an active warehouse, inspect a request and its items, then submit, approve, mark ordered, reject or cancel it using your current permissions. Review draft quantities and expected costs before approval. If the request changes, inspect it again before proceeding. Marking ordered records an order you already placed; it does not contact the supplier. See Supply requests.

With Activity Log access, you can ask the tool to search operations by record, actor, event or date, follow the events in an operation, and inspect changes and recorded technical details. It can continue through additional pages or data sections. Credentials are redacted, and log entries cannot be changed or deleted. See Activity logs.

Ask for the report catalog to run any available built-in operational, inventory or finance report with its filters, summaries and totals. Finance reports include chart values. Reports default to the selected branch; request company scope explicitly when needed. Large reports can be read in sections. See Report Center.

For operational incidents, you can report an issue, read the incidents visible to your account and reply to their conversations. Incident managers can add internal notes and update status with a reason. Internal messages are never converted into public replies if access is refused. See Incident reporting.

Other changes still need to be made in Kashef. If an operation is refused, check your permissions and subscription with your laboratory manager.

To disconnect an application, open AI tools (MCP), find it under Connected AI tools and select Revoke access. Its access and refresh tokens are revoked; it must request authorization again. Revocation does not erase data the external application already received.

Two-factor authentication (2FA)

Two-factor authentication adds an extra layer of security using an authenticator app (such as Google Authenticator, Microsoft Authenticator, or 1Password):

• Setup: Click Set up 2FA to generate a secret key and QR code. Scan the code with your authenticator app and enter the 6-digit code to activate protection.
• Recovery codes: Once enabled, keep your recovery codes stored safely. They allow account recovery if your mobile device is unavailable.
• Disabling: Disabling 2FA requires confirmation with your current password.

Connected devices and active sessions

The Devices & Sessions tab gives you full visibility into all machines and browsers accessing your account:

• Active authenticated sessions: Lists every browser currently signed in with device name, IP address, and last activity timestamp. You can click Sign out on any remote session to revoke its access immediately.
• Sign out all other sessions: Revokes all active sessions except the current browser in a single click.
• Saved login shortcuts: Lists devices where your account is saved on the login screen for quick profile switching. Removing a shortcut hides your account from that login screen without logging out active sessions.

Notifications & Kashef Bot

Every staff member has a Notifications & Kashef Bot tab:

• Notification preferences: enable or disable each event, then choose Local notification for the bell menu and Kashef Bot notification for every connected Bot channel. Press Save changes. Options include system operations, new orders, payments, results awaiting release, followed-order updates, escalations, and critical lab alerts.
• Kashef Bot on Telegram or Slack: press Connect Telegram or Connect Slack to receive the events enabled for Bot delivery on your phone. Use Send test message to check the connection and Disconnect to stop it.

See Notifications, follow-ups, and Kashef Bot for details.

Danger zone (Account deactivation)

If you are leaving the laboratory or no longer require system access, you can deactivate your account:

• Deactivation performs a soft deletion and immediately terminates all active sessions.
• In compliance with medical laboratory accreditation and audit standards, test orders, released results, and financial transactions created by your account remain preserved in the audit log for historical traceability.