Signing in on a new browser: how Vaidence email verification works

Why a new browser is verified

Clinical accounts can reach patient information, so a stolen or guessed password must not be enough on its own to get in from somewhere new. Verifying a browser the first time it is used ties sign-in to something the real account holder controls — their email inbox — without asking them to install or look after anything extra.

Once a browser is verified it is remembered, so the extra step is not repeated every day. The protection applies where it matters most: a sign-in from a browser or device that has never been used with the account before.

What happens the first time

• Enter your email address and password, or choose Sign in with Google.
• If this browser has not been verified for your account, Vaidence sends a six-digit code to the email address on your account and shows where it was sent, partly hidden.
• Enter the code on the sign-in screen. When it is accepted you go straight into Vaidence, and the browser is remembered.

What happens next time

On a browser you have already verified, you sign in with your email and password — or with Google — and go straight in, without a code. Signing in from a different browser, a different computer, or after clearing that browser’s cookies counts as a new browser, and a code is sent again.

What counts as a new browser

Vaidence remembers a verified browser with a secure cookie that only that browser holds and that page scripts cannot read. Anything that does not carry that cookie for your account is treated as new and is asked for a code:

• a different browser on the same computer, such as Chrome after you verified in Edge;
• a different computer, phone or tablet;
• a private or incognito window, which discards its cookies when it closes;
• a browser profile other than the one you verified;
• the same browser after its cookies or site data have been cleared.

Remembered browsers belong to an account

A remembered browser is tied to your account, not to the computer. If a colleague signs in to their own account on a computer you have verified, they are asked for their own code, and you do not inherit theirs. A remembered browser also never replaces your password: a wrong password is refused even on a browser you verified yesterday.

How codes are protected

• A code expires five minutes after it is sent.
• After five incorrect attempts the code stops working and you need a new one.
• You can ask for a new code after sixty seconds; asking for a new code cancels the previous one.
• Each code works once.
• Codes are never stored in readable form and are never written to logs.

No authenticator app, no backup codes

Vaidence no longer uses authenticator apps or printed backup codes for sign-in. If you set up an authenticator for Vaidence in the past, you can remove the Vaidence entry from the app; it is not needed any more.

If the code does not arrive

• Wait a minute, then check your spam, junk and promotions folders.
• Make sure you are looking at the inbox for the email address shown on the screen.
• After sixty seconds, use Resend code. Only the newest code works.
• If you no longer have access to that inbox, contact your clinic administrator or write to contact@vaidence.com. For your safety, we cannot change the email address on an account over chat or by phone alone.

Never share a code

A verification code is the key to your account on a new browser. Vaidence staff will never ask you for it by phone, email or message. If someone asks you for a code, do not give it, and change your password. If you receive a code you did not request, someone may know your password: change it straight away.

Removing remembered browsers

Signing out of every device ends your sessions and forgets remembered browsers, so the next sign-in on each of them needs a code again. Changing your password has the same effect. Use this if a device is lost, sold or shared with someone else.

Good practice for clinics

• Give every person their own account; never share a login between staff.
• Use work email addresses that the clinic can manage.
• Avoid signing in on public or shared computers. If you have to, sign out when you finish.
• Remove access promptly when someone leaves the clinic.

For clinic administrators

• Review who has access regularly and remove accounts for people who have left the clinic.
• Ask staff to report any verification code they did not request; it usually means a password has been exposed.
• Protect the work email accounts used for Vaidence, because access to the inbox is part of signing in on a new browser.
• When a device is lost or replaced, ask the person to sign out of every device and change their password.

Patient accounts

Patients sign in with their email and password, or with Google, and are not asked for a browser verification code. Doctor, clinic staff and administrator accounts, which can reach other people’s records, carry the additional check.