01What licences does FastLogin verify for clinicians?+
MDCN for medical and dental practitioners, NMCN for nurses and midwives, and the relevant licence body for pharmacists, optometrists, and physiotherapists as the role catalogue extends. Verification is two-step: the licence number is OCR'd from the document you upload by Didit, and the document itself is checked for tampering. We do not issue you a clinical role until both sides return a clean signal.
02How long does the KYC step take?+
About ninety seconds end-to-end on a typical mobile connection in Lagos. Document upload runs to Didit; liveness is a single passive frame, not a video; OCR and licence cross-check return within thirty seconds for most documents. If the document scan returns ambiguous you get up to three retries before a terminal decline routes to manual review by Fastclinic compliance. Manual review aims for a one-business-day turnaround; we email you the result and the audit chain records every step from submission to decision. If you're declined, the decline reason is plain-language — wrong document type, expired licence, image illegible — and the next steps are concrete, not a generic try-again message.
03Why do I need both a passkey and a TOTP secret?+
The passkey is what you use every day — fastest, phishing-resistant. The TOTP secret is the portable backup. Passkeys live in a single device's secure enclave; if that device dies, you'd be locked out without a second factor that travels independently. Backup recovery codes are the third line of defence behind that. The policy is enforced by the registration flow, not by you.
04When does AAL2 step-up trigger?+
Clinical scopes — record read, record write, prescription, lab order — require AAL2 within the last sixty minutes by default. The threshold is configurable per organisation. If your session is older than the threshold when you try to open a record, FastLogin re-prompts for a passkey or a TOTP code before Hydra issues the scoped token. You don't sign back in; you confirm.
05Do I have to KYC again at every hospital I work at?+
No. A second hospital invites your existing identity rather than creating a new one. Your KYC artefacts are reused; your audit history is preserved across hospitals; only entitlements (which products, which scopes) differ per tenant. Locum doctors and visiting specialists particularly benefit — your identity is yours, and the entitlements travel with the org.
06What if my MDCN licence expires while I'm employed?+
The licence-board check runs on a schedule. When the system flags an expired or revoked licence, your clinical entitlements are auto-suspended within hours, and the affected hospital's IT admin gets a notification. Suspension is reversible: re-upload the renewed licence and Didit re-validates. The hash-chained audit shows the suspension and reinstatement events with timestamps.
07Can I see when my own record was accessed?+
Yes. The personal audit feed shows every authentication event you initiated and every clinical-access event you performed — patient lookup, record open, prescription write. The hospital's audit feed shows the inverse: who accessed which record. Both are derived from the same chain. NDPA 2023 §25 read-rights apply.
08Why hash-chain the audit and not just sign each row?+
Because the chain catches deletions and reorderings, not just edits to existing rows. Each row's hash includes the previous row's hash; tampering breaks the chain at every subsequent row. Verifiers can replay the chain end-to-end and prove no row has been altered or removed. This is the same property that supports the seven-year retention exposure to regulators.
09How does session revoke work?+
When you click End session, FastLogin marks the Kratos session inactive immediately and revokes the matching Hydra refresh token. Existing access tokens are still valid until their fifteen-minute expiry; the affected products will fail to refresh. In practice the revoke takes effect within minutes. Hospital admins can also force-revoke a specific user across all sessions from the admin console.
10What's the SLA for sign-in availability?+
FastLogin targets four nines on sign-in availability across the Lagos region, measured monthly. Outages and slow-paths trigger an incident response with a customer-facing status update within fifteen minutes of detection. The trust page tracks the historical numbers and links to the most recent post-mortems. The five-minute JWKS cache means that during a brief FastLogin disruption, already-signed-in clinicians keep working against the cached keys until their fifteen-minute access token expires — most short outages never reach the bedside.
11Can I write prescriptions and lab orders through FastLogin scopes?+
FastLogin issues the scoped tokens; the actual prescription or lab-order workflow lives in the product. Doorcta and OneHealth both expose prescription scopes that require an AAL2-fresh session and an MDCN-verified clinical role on your FastLogin profile. When you sign a prescription in Doorcta, FastLogin attests that the session is fresh and the role is verified, and the prescription record carries the FastLogin user ID and the audit timestamp. The actual prescription content is stored in the relevant product's record store, not in FastLogin.
12What if I'm covering an on-call shift and need access at 3am?+
Sign in normally. After-hours sign-ins are flagged for compliance review by the org-admin tooling, but they are not blocked — that would defeat the point of on-call. The flag becomes a high-signal queue item that the hospital's compliance team reviews the next business day to confirm the activity matched a real on-call assignment. The default after-hours window is Africa/Lagos 08:00–18:00; your hospital's admin can configure a different window or disable flagging entirely if your roster doesn't follow that pattern.
13How do you handle supervision relationships for trainees?+
Supervision is currently expressed via entitlements on the trainee's FastLogin identity that scope what they can do without a co-signature. A trainee's prescription scope, for example, may require an attending clinician's AAL2-fresh session within the last five minutes for the prescription to be accepted by the product. The dual-attestation pattern lives in the product's workflow; FastLogin's job is to make the supervisor's identity provable and the supervision event auditable. The OneHealth break-the-glass workflow uses the same primitive for emergency access.