👥 Operational Functions by User Role
MentalHealthChange operates across 4 core user roles with Role-Based Access Control (RBAC) and privacy isolation. Below is the operational specification per actor:
Administrator / Clinical Lead
ROLE_ADMIN
Global User Management
api/admin/admin_users.php
Full CRUD operations for clients, specialists, corporate HR reps, and administrative staff. Account status toggling (`is_active`).
SubRole & Permission Matrix
api/admin/subroles.php
Creation of fine-grained subroles (e.g. Clinical Lead) and assignment of qualified permissions (`PERM_ADMIN_CL_MESSAGES_READ`).
Corporate Invitation Generation
api/admin/company-invitation-create.php
Issuance of 32-character bulk registration security tokens for corporate client employees.
Crisis Alert Triage & Resolution
api/alerts/resolve.php
Real-time monitoring of critical risk alerts and logging resolution audit trails (`resolved_by`, `notes`).
Knowledge Base (FAQ) Management
api/admin/faq-manage.php
Creation, editing, and ordering of role-segmented help desk articles.
faqs · faq_categories
Pre-Authorized Email Allowlist
api/admin/preauth_manage.php
Creation, revocation and expiry of single-use registration invitations for providers and company admins (role, company, classification, session quota).
preauthorized_emails
Provider Onboarding Review
api/admin/provider_onboarding.php
Verification of credentials, documents and references; approval, rejection or change requests; bio approval and bio-change decisions.
providers · provider_documents · provider_references · provider_bio_change_requests
Company Hub Access Requests
api/admin/company_hub_requests.php
Approval of company administrator requests to access the corporate Hub.
company_admin_requests · company_admins
Employer (Company HR)
ROLE_COMPANY
Workforce Wellbeing Dashboard
api/company/home.php
Consolidated overview of enrolled members, total session consumption, and active benefit budgets.
Aggregated Anonymous GDPR Reports
api/company/reports.php
Impact statistics with privacy protection threshold (≥ 10 active members to prevent individual tracking).
Billing & Corporate Allowances
api/company/billing.php
Statement history for `company_id` and employee quota management (`sessions_per_member`).
Direct Support Channel
api/company/contact.php
Direct dispatch of contract adjustment and quota expansion requests to administration.
Team, Admin Levels & Departments
api/company/team.php · api/company/hub_permissions.php
Management of company admins (
owner, hr_admin, manager, employee), per-permission flags and department-scoped access.company_admins · company_departments
Benefits Configuration
api/company/hub_benefits.php
EAP provider, insurance partner, policy number, therapy/coaching allowances and dependents support.
company_benefits_config
Hub Insights & Resource Library
api/company/hub_insights.php · api/company/hub_resources.php
Aggregated wellbeing insights and download of leadership/DEIB/crisis templates by audience.
hub_resources
Specialist (Provider / Coach)
ROLE_PROVIDER
Agenda & Availability Settings
api/provider/availability-save.php
Definition of weekly working slots (`start_time`, `end_time`, `buffer_time`) and timezone settings.
Session Execution & 5-Metric Rating
api/provider/session-complete.php
Appointment completion with confidential progress notes and 5-dimension outcome rating.
Crisis Safety Care Plans
api/provider/safety-plan-save.php
Formulation of emergency contingency plans featuring coping strategies and medical contacts.
Clinical Assessment Supervision
api/provider/questionnaires.php
Review of PHQ-9, GAD-7, and WHO-5 scores for assigned client rosters.
Fee Invoice Submissions
api/provider/invoice-submit.php
Submission of completed session payout requests for direct bank settlement by administration.
Onboarding Wizard
api/provider/onboarding.php
Guided steps (
welcome → credentials → forms → documents → submitted), document upload, references, bank & VAT data.providers · provider_documents · provider_references
Bio Change Request
api/provider/request_bio_change.php
Approved bios are locked; edits are proposed with a reason and reviewed by administration.
provider_bio_change_requests
Client Notes & Security Exceptions
api/provider/client-notes-save.php · api/provider/security-exception-log.php
Confidential per-client notes and logging of security exceptions (shared with admin via
share-security-exception.php).clients · alerts
Member (Client)
ROLE_CLIENT
Self-Registration via Corporate Token
api/client/register.php
Account creation automatically bound to issuing employer invitation token.
Intake & Interest Focus
api/client/questionnaire-save-intake.php
Registration of initial assessment and wellness priorities (`client_interests`).
Appointment Rescheduling (24h Policy)
api/client/session-request-change.php
Rescheduling or cancellation requests calculating > 24h or < 24h notice.
Mental Health Psychometrics & Triage
api/client/questionnaire-save.php
Completion of PHQ-9/GAD-7 psychometric scales and 3-minute risk screening.
Encrypted Specialist Chat
api/messages.php
Bidirectional private messaging with assigned mental health specialist.
messages
Employer Verification & Topic Selection
api/client/verify_company.php · api/client/submit_triage.php
Company code / domain validation, selection of wellbeing topics by 5 categories (Emotional, Professional, Relationships, Physical, Financial) and triage level.
companies · client_selected_topics · clients
Crisis Self-Assessment
api/client/crisis-assessment-save.php
3-question risk screening;
high_risk raises a critical alert and sets crisis_risk_flag.crisis_assessments · alerts
Hub Access Request & Progress
api/client/request_hub_access.php · api/client/progress.php
Request to become a company admin (approval workflow) and personal progress view of scores and sessions used.
company_admin_requests · questionnaires_results
Schema reference: sqls/Tablas_mhc_db.sql · 32 tables · 33 foreign keys · see Database Architecture Report