DeepBite setup guide: your first week

This guide takes a clinic from nothing to its first signed note. It is written for the clinic owner (usually the principal dentist) and for whoever helps with the computers. Staff who only use DeepBite day to day can skip to Part F.

DeepBite follows one rule everywhere: one look, one click. Routine work is a single click because the clinic's usual protocol is filled in and shown as one line before it is recorded. "Customise" opens only when something was different today. Every screen fits without scrolling the page.

Part A. Prepare before you start

Collect these first. Nothing here is typed twice: each item goes in once and is reused on receipts, MCs, letters and the note.

Clinic

• Registered name and trading name, address and phone for each branch.
• SSM business registration number (BRN).
• Income tax number (TIN) from LHDN.
• MSIC code: 86203 (dental practice activities).
• Personal Data Protection registration certificate number. Private dental clinics must register with the Personal Data Protection Commissioner as data users. If you have not registered yet, do so at pdp.gov.my before you store real patients.
• A privacy contact: the person patients write to about their data (name, email, phone). A clinic with more than 10,000 patients must appoint and register a Data Protection Officer.
• Service tax: only if the clinic's total healthcare revenue passed RM1.5 million in 12 months and you have registered with Customs. Then you also need the SST registration number.
• e-Invoice: decide with your accountant. From 1 September 2026 a business with annual revenue below RM3 million is exempt, unless a related company or shareholding company is at or above that. Most single clinics are exempt.

People

• Each staff member's full name, email address, role and home branch.
• Each dental surgeon's MDC registration number. DeepBite will not issue a medical certificate for a dentist without one (Dental Act 2018 s.46: only a dental surgeon may sign a dental MC).

What each role may do starts open and you narrow it in Admin, Roles:

Prescribing still needs a dentist with an MDC number, and signing a note needs a dentist who treats patients, whatever the role table says.

Prices

• Your fee list (consultation, scaling, fillings by surface count, extractions, root canal by canal, crowns, dentures, whitening, products).
• The local anaesthetic cartridges you stock: 1.7, 1.8 or 2.2 mL. The note records cartridges times this volume.
• Medicines you dispense and their prices. A child's paracetamol suspension (120 mg/5 ml and 250 mg/5 ml) is priced and labelled by the ml; set its price per ml in Admin, Catalogue, Other fees.

Patients from your old system (optional)

A spreadsheet saved as CSV with a header row. Column names are matched loosely; these are recognised:

Identity type, citizenship, address and guardian can also be imported; "Download the template" on the import step shows the column names. A patient under 18 also needs a guardian's name, or the row is not imported. Anything else can be completed the first time the patient visits.

Equipment

• Nothing to run on the hosted service. On your own server: one computer to run DeepBite for the clinic (Part C), or a cloud server in Malaysia.
• Each chair-side computer or tablet: Windows or macOS with Chrome or Edge, an iPad with Safari (iPadOS 17 or later), or an Android tablet with Chrome.
• An A4 printer. A label printer is optional for dispensing labels.

Part B. Try the demo (15 minutes)

The demo runs entirely in the browser with a sample clinic of made-up patients; nothing leaves the computer. On the hosted service you need not install anything: open https://demo.deepbite.org (or the Demo section of https://deepbite.org), where a guided tour walks you through one visit in eight steps; the rest of this part applies there too, with two clinic days. Everything works there, and nothing is saved: close the tab and it is gone, so do not type in a real patient.

1. Install Node.js 22 (nodejs.org) and run npm install -g pnpm@10 once.
2. In the DeepBite folder run pnpm install, then pnpm dev:web.
3. Open http://localhost:5173.

There is no login in the demo. Switch who is acting from the user card at the bottom of the left sidebar: Dr Qi and Dr Lim (dentists), Aina and Farah (DSA), Siti (front desk), Dr Tan (owner) and Dr Wong (locum). The demo PIN is 0000 for every user and 1234 for Dr Qi. The demo shows two clinic days, yesterday and today.

Walk one visit: on Today, open Nurul Huda. Press the one highlighted button on each of the six tabs: Complaint (with the medical history), Exam, Diagnosis, Plan, Treat, Sign (advice, the prescription, the MC and review and recall are on Treat, under "After treatment"). On Treat, a treatment recorded from the chart, or "Done", records the clinic's protocol exactly as the summary line shows; "Edit" or "Customise" is only for what was different. On Sign, enter the PIN. Then try Front desk on the left sidebar with Siti, and Documents from the patient.

Part C. Install DeepBite for the clinic

DeepBite runs as one service that holds the database, the app and the documents. Choose one of three places for it.

Option 0, the hosted service. There is nothing to install and nothing in this part to do. You open your clinic yourself with the form on https://deepbite.org, or DeepBite's operator opens it for you and sends you a link by WhatsApp. Your clinic then has its own address, for example https://klinikqi.deepbite.org, which every computer and tablet of the clinic uses; staff bookmark it. The database and the documents are backed up every night to two providers, encrypted before they leave the server, once the operator has set the backup stores; the processor agreement says where they are kept. Go to Part D.

Options 1 and 2: you choose where the patient data sits. A data centre in Malaysia for option 1 (for example AWS Asia Pacific (Malaysia), or a local provider) keeps it in the country, with the backups there too; anywhere else is a transfer under PDPA s.129, which needs a basis your lawyer confirms.

The full commands, with the reason for each, are in the server guide, the file infra/README.md in the DeepBite folder. In outline:

1. Install Docker: Docker Desktop on Windows, or Docker Engine with the Compose plugin on Ubuntu. The machine needs 4 GB of memory and 20 GB of disk.

2. Copy .env.production.example to .env.production and fill it in. On Windows, infra\new-settings.ps1 does this for you, and the Windows install guide in the DeepBite folder walks through every click. Generate each secret with the command written beside it: the two database passwords, SESSION_SECRET and DATA_ENCRYPTION_KEY. Keep a copy of .env.production somewhere safe with the backups; without the encryption key a restored system cannot read the stored e-Invoice secret.

3. Set the address. For option 1, point a domain name at the server, set DEEPBITE_DOMAIN to it and leave DEEPBITE_TLS empty; the certificate is automatic. For option 2, give the clinic computer a fixed address on the router, set DEEPBITE_DOMAIN to that address and DEEPBITE_TLS=tls internal.

4. The install runs in its small shape by default: one service runs the app, the printing and the scheduled work, without Redis; documents and messages that were waiting when it restarts are picked up again from the database at once. Leave API_WORKERS and REDIS_URL empty. A large clinic group on a big server can add the standard shape later (the server guide, Deployment shapes). Leave SIGNUP_MODE=first_only. The first sign-up then needs a one-time setup link that only you can see, in the server's log, so nobody else can claim a fresh server; after that nobody can create another clinic there.

5. Check and start, from the DeepBite folder:

   docker compose -f infra/docker-compose.prod.yml --env-file .env.production config --quiet
   docker compose -f infra/docker-compose.prod.yml --env-file .env.production up -d --build
   docker compose -f infra/docker-compose.prod.yml --env-file .env.production ps -a
   

   The first build takes a few minutes. When it is ready, migrate shows exited (0), postgres, api and backup show healthy, and caddy shows running. On Windows, run these in PowerShell; Git Bash rewrites some arguments.

6. Open https://<your address>/. You should see the DeepBite sign-in page, and https://<your address>/health answers ok. Then get the setup link for Part D:

   docker compose -f infra/docker-compose.prod.yml --env-file .env.production logs api | grep "setup code"
   

   In PowerShell, put Select-String "setup code" in place of grep "setup code".

7. Backups run every night at 2 am and are kept for 30 days in infra/backups. They are encrypted with the key the settings script made in infra/backup-key/backup.key (since 6 Nov 2026 new-settings.ps1 creates it and sets BACKUP_ENCRYPT_KEY_FILE; only -NoBackupKey leaves backups plain, with a warning each night). Keep a copy of the key file offline with .env.production, never beside the backups: without it no backup can be read, and with it anyone can. Then let them leave the machine by themselves: fill in the BACKUP_S3_* lines with a storage bucket in Malaysia (and a second one at another Malaysian provider), and every night's backup is copied there, with the database's change log every five minutes (the server guide, Off-site backups). Without a bucket, copy that folder off the machine every day yourself (Part I).

8. Messaging (optional, can wait until after the pilot). To send receipts, invoices and documents by email, and messages by SMS or the WhatsApp Business Cloud API, fill in the messaging lines of .env.production (they are listed, empty, in .env.production.example): EMAIL_PROVIDER=resend with RESEND_API_KEY, EMAIL_FROM_DOMAIN and EMAIL_WEBHOOK_SECRET; the SMS_* lines for an SMS gateway; the WHATSAPP_* lines for WhatsApp Cloud. Then run the up -d command of step 5 again. Left empty, email reads "Not set up on this server", SMS is off and WhatsApp opens as a click-to-chat link on the device, which needs no setup. The server guide describes where each one goes.

For option 2, every computer and tablet must trust the clinic's own certificate once, or tablets cannot install the app or work offline. The server guide has the steps for Windows, iPad and Android.

On an option 2 install the links DeepBite sends to patients (the questionnaire QR, the 7-day document links, the confirm, rating and unsubscribe pages) carry the clinic computer's address: they open only on the clinic Wi-Fi, and a patient's phone that has not installed the clinic's certificate shows a warning. For links patients open at home, use a public name (option 1).

Part D. Sign up the clinic and run the setup wizard

If you signed up yourself on deepbite.org (the hosted service, the usual way):

1. The page where you filled the form shows your clinic's name, is ready at and your address (for example klinik-ceria.deepbite.org), and says the link to set your password was emailed to you. Open that email (from DeepBite, "Your DeepBite clinic: set your password"); if it is not in your inbox in a few minutes, look in spam or press Send it again on the page. The link works once, for seven days; a clinic nobody claims by then is removed and its address is free again.
2. The link opens your clinic's sign-in page with Set a new password: enter a password of at least 12 characters twice, then press Set password. Sign in with your email and that password. From now on everyone signs in at your clinic's address with their email or their username; the page names your clinic, so a wrong address is easy to spot.
3. You agreed to the terms, the privacy notice and the processor agreement on the form, so there is no Before you start card. Continue with step 2 of "On your own server" below (the PIN), then the wizard. During the free beta every clinic opens on Essential: your whole record, without photos, X-ray images or scans, with up to 5 users and one branch. Full, which adds them (from 25 GB, with up to 30 users and five branches), is coming soon; the app says so wherever an upload would start. While DeepBite is launching, every plan is free; when prices start you will hear 30 days ahead, and a banner on Today tells you the dates.

On the hosted service, when the operator opened your clinic for you:

1. Open the link your operator sent you by WhatsApp (it is good for seven days; ask for a new one if it has run out). It opens your clinic's sign-in page at your clinic's address with Set a new password: enter a password of at least 12 characters twice, then press Set password.
2. Sign in with your email and that password. From now on everyone signs in at your clinic's address with their email or their username; the page names your clinic, so a wrong address is easy to spot.
3. Before you start opens once, for you alone: it says that your clinic is the data controller of its patients' records and that DeepBite processes them on your behalf under the processor agreement, which says where they are kept. Read the terms (linked when your operator has published them), tick the agreement and Continue; the date and the version are kept with your clinic. Staff never see this card.
4. Continue with step 2 below (the PIN), then the wizard. A forgotten owner password is a new link from your operator, who checks that it is you first. Your plan decides what you may keep and how many branches you may have. Essential (RM 150 a month) keeps your whole record but takes no photos, X-ray images or scans, with up to 5 users and one branch; you still log each film in words. Full (RM 150 plus RM 2 for each GB) adds them, with up to 30 users and five branches; a Full clinic starts with 25 GB, and a one-dentist clinic uses about 10 GB a year. Ask your operator to change the plan when you grow. Admin, Clinic shows your plan and what you have used.

On your own server (options 1 and 2):

1. Open the setup link from Part C, step 6. Enter the clinic name, your name, your email and a password of at least 12 characters, tick "I agree to the terms and the privacy notice", then Create clinic. You become the owner.
2. Whenever you sign in with your password, you choose whether this computer is Shared (the reception or a surgery computer; it locks sooner) or Personal (your own laptop or tablet). Before anything else DeepBite asks you to Set your PIN: four digits, twice, then Set PIN. Every new account starts with the PIN 0000, which signs nothing, so everyone you invite meets the same step at their first sign-in, and after an owner's "Reset PIN" at their next one ("Sign out" is the only way past it). A PIN anyone would try first (0000, 1234, one digit four times, or a run such as 6789 or 4321) is refused. Admin, Users shows "PIN 0000" beside anyone who has not yet set their own. The PIN signs notes, approves discounts and refunds and unlocks the screen. It is not your password; choose one you do not use elsewhere. Change the PIN later in Settings, Your PIN, and the password in Settings, Password.
3. If you treat patients yourself (a solo principal), open Admin, Users, edit your own name, turn on Treats patients and enter your MDC registration number. Without it you cannot sign notes, prescribe or issue MCs. You then appear in Admin, Roster (and the wizard's Roster step) as a dentist to roster, and Today books you like any dentist.
4. The wizard has six steps. Each has one main button; "Skip for now" is there when a step can wait, "Finish later" leaves the wizard, and "Continue" beside "Setup: n of m done" on the Dashboard brings you back.

There is no theme step: the clinic starts on the Zendenta palette; Admin, Clinic, Appearance sets the clinic's default (Zendenta, Ivory, Harbour, Twilight, Sunrise, Meadow or Graphite; Light, Dark or System), and each person can change their own in Settings.

Part E. Review before the first patient

Open Admin on the left sidebar (the owner, or anyone the owner gives the administration permissions in Admin, Roles). It opens on three lists, Clinic and staff, Treatment and Governance; Alerts, Questionnaire, Diagnosis rules, Glossary, Symbols, Advice and e-Invoice are one step further in, under Advanced. Every change is saved as a new version; nothing is deleted, and old notes keep the wording they were signed with.

Admin, Clinic

• Clinic and e-Invoice: the clinic's name, TIN, BRN, MSIC code, phone and address.
• Privacy: the registration certificate number and privacy contact. These print on the privacy notice patients receive.
• Service tax: switch on only if registered (Part A). DeepBite then charges 6 percent to non-citizens, including permanent residents and MyKAS holders, on every line except the consultation fee, and never charges citizens. While it is off, no invoice ever shows tax.
• e-Invoice, in the same section: Consolidated monthly (the default: one monthly e-Invoice for the payments of patients who did not ask for their own), Per receipt, or Off (exempt). Nothing is sent until the MyInvois connection in Admin, e-Invoice is complete.
• Notes, Headings: the Malaysian shorthand (C/O, I/O, Dx), which is the default, or Full; also when an unsigned note counts as overdue. Abbreviations inside the note always print short; hovering one shows it in full, and the printed note lists them at the foot.
• What each procedure brings is set under Admin, Packages, and the materials offered (cartridge sizes among them) under Admin, Materials and brands.
• Security: minutes before a shared computer locks (default 10) and a personal device (default 30), the break-glass window, what locums can see and "Authenticator for everyone".
• Advanced: the schedule columns (rostered dentists or chairs).
• Treatment: "We dispense medicines" turns on dispensing labels and the prescription book.
• Clinic rules: whether a completed comprehensive examination counts as the consultation (on by default, so a visit is never charged twice), appointment length, recall by risk (3, 6 and 12 months by default), how long estimate prices hold, the full periodontal chart and whether verbal consent needs a witness.

Admin, Catalogue (with Other fees)

The medical history on file is due for review once a calendar year; there is nothing to set for it.

Catalogue lists every price in one place: the procedures, and under "Other fees" the consultation, medicines, products and other charges. It is the quickest way to enter your fee list: change a price in its row, or "Add fee item" for a medicine, product, lab fee or other charge the seed does not have (it can then be added to a bill). New procedures are added in Catalogue, where they get a protocol. A new price applies to items planned from now on; planned items keep their agreed price and issued bills keep theirs. In Catalogue, for each procedure check whether it is shown and its protocol: the values that apply every time (for example, composite: caries removed, etch and bond, flowable liner, matrix, occlusion checked). The summary line updates as you edit, and it is exactly what "Done" will record. Leave a field as "No safe default" when it differs every time; it will then be asked on the day.

Admin, Roles

What each role may do, in plain words, per role: a switch per permission and "Reset", which fills in the defaults for Save to keep. The owner always keeps everything, so the clinic can never lock itself out.

Admin, Questionnaire, Alerts, Diagnosis rules, Sentences

Questionnaire is the medical history the front desk, the DSA and the patient's phone ask, in English and Malay; you can reword, reorder, hide or add questions, but a question an alert depends on (penicillin allergy, pregnancy, blood thinners) keeps its place so the alert still fires. "Adults only" (on for smoking, alcohol, betel quid and pregnancy) leaves a question out of the patient's phone for a child under 12. Alerts shows each medical alert in words ("When allergic to penicillin: yes"), its severity, text and the medicines it blocks, with the source of the seed wording; you can edit them, switch one off, or add a simple one on a question you added. Diagnosis rules lists the suggestions the chart produces, each with an on or off switch. Sentences is the wording of each note line, with the recorded values shown as chips; the wording can change but the chips must stay. Each has "Reset", which fills the original back in for Save to keep (in Diagnosis rules it switches every rule back on), and each change applies to new records only.

Admin, Advice, Formulary, Consent, Glossary, Symbols, Diagnoses

Advice sets print in English or Malay. Formulary holds the medicines, doses and the order of the quick prescription list. Consent holds the risk text for each procedure in English and Malay, printed on the consent page and shown on the signature sheet; have it reviewed before the pilot. The glossary controls how abbreviations appear in notes; symbols are the chart palette; diagnoses carry ICD-10 codes (WHO 2019 edition, which Malaysia uses; never ICD-10-CM). Formulary and Consent have "Reset", and the glossary can restore an abbreviation you removed.

Admin, Users and Roster

Change a role under Edit (never your own, and the clinic always keeps one active owner), add MDC numbers, turn on "Treats patients" for an owner who treats, set a locum's first and last day (in the invite sheet when the role is Locum, or later under Edit; outside those dates the account cannot sign in), reset a PIN or a lost authenticator phone, give someone a new password link ("Reset password": the link is shown once with "Copy link"; it works once, for 24 hours), and resend an invite link. "Authenticator for everyone", in Admin, Clinic, Security, makes every account use a 6-digit code from an authenticator app at password sign-in (recommended when the server is on the internet; never asked at the PIN unlock). Roster sets who works where per branch and day, one row per dentist (widen the hours for a long day); Today's columns follow it.

Admin, e-Invoice, Audit, Incidents

e-Invoice, under Admin, Advanced while e-Invoice is not Off, is where the clinic connects its own MyInvois account: the card "Set up MyInvois yourself" walks the owner through the steps on the MyTax and MyInvois portals (Register ERP, named "DeepBite", the longest secret expiry), then the clinic's details for MyInvois, the client id, the secret (never shown again) with its expiry date, and "Test connection". The page says which MyInvois the server talks to (IRBM's sandbox or the live one), what is still missing, and warns 30 days before the secret expires. An exempt clinic switches e-Invoice off in Admin, Clinic instead. Audit shows who read or changed which record, with break-glass rows and late amendments highlighted, a CSV export and "Verify chain" (the log is hash-chained, so any tampering shows). Incidents lists the incidents recorded at the chair for review, and holds the data breach register.

Each dentist's own defaults

Dentists work differently, so each dentist can keep their own defaults on top of the clinic's: Settings, My defaults (note headings, recall, their own procedure packages with note text, medicines, MC and review, the prescription quick list and the protocol values they saved). The quickest way is by doing: when a dentist changes something in Customise for a procedure they always do that way, they tick Save as my default for that procedure, and their next Done uses it. The tooth, surfaces, shade and free text are never saved as a habit. A DSA charting or treating with a dentist gets that dentist's defaults, and the note prints in that dentist's note style.

Part F. Devices and the first clinic day

Install the app on each device (it then opens full screen, starts faster and keeps working if the internet drops):

• Windows or Mac, Chrome or Edge: open the clinic address, then the install icon in the address bar.
• iPad, Safari: Share, then Add to Home Screen.
• Android, Chrome: menu, then Install app.

Sign in with your email and password and choose Shared or Personal for the device. The first time, DeepBite asks you to set your PIN (four digits, twice) before anything else; an easy guess such as 1234, 1111 or 6789 is refused. Change it later in Settings, Your PIN, and your password in Settings, Password (your other devices are then signed out; the one you are on stays signed in). A shared computer locks after its idle time and stays locked even if someone reloads the page; enter your PIN to continue, or "Switch user" for someone who has signed in on this device before (they use their own PIN). Five wrong PINs sign the person out. Anyone can turn on an authenticator app in Settings for extra protection at password sign-in.

Front desk

1. Booking: on Today, tap a free time in a dentist's column; the patient is the only thing to enter (search, or "Add patient" for someone new), and the sheet then shows "New patient", or "Last visit" with the date. The "Block time" link at the foot of the same sheet blocks a rest, a morning or afternoon off, an off day, a meeting or other time (with a note, for one dentist or, with "Whole branch", every dentist); a block shows hatched, and booking onto it asks "Book anyway". Today also shows two hours either side of the opening hours (Admin, Clinic, Hours, "Show before and after"), marked "Before opening" and "After closing"; these can still be booked, and the sheet then reads "Outside opening hours". Drag a card to move it (or tap it, then Move, on a tablet). "Walk-in" picks the rostered dentist free soonest and warns if the visit runs into a booking. Tapping a card opens its sheet: the status button opens the menu Scheduled, Confirmed, Arrived, In chair (Arrived is the check-in, on the appointment's own day), No-show and Absconded, and the foot holds Cancel appointment, Send, Move, Check in, Check out and Discharge. Opening a visit does not move the patient to In chair. One status changes by itself: a booking still Scheduled or Confirmed when its slot has ended becomes a No-show, greyed in place on the grid ("Check in" in the card's sheet still checks a late patient in); Today checks every minute while it shows today or an earlier day. Booking or moving into a slot that has already ended asks first ("Book anyway", "Move anyway"). To undo a no-show whose slot has ended, choose Scheduled: it opens Move, so the booking gets a new time; left at its old time it would be marked again at the next check. A patient who arrived and left without being seen is marked Absconded from the card's status menu. A booking can also hold a slot for a temporary patient (a name and a phone taken over the phone), registered with "Register" when they arrive. A cancelled or no-show booking leaves its time free to book; "Cancelled and no-show" in the Lists menu on Today lists them, and opening one undoes a no-show (on its day) or a cancel (before its day has passed) made by mistake. Signing the note does not move the card: once the desk (or the dentist, from the card's sheet) presses Discharge, the card reads Done and turns green; on a past day a patient who came reads Attended. Each status has its own colour, mark and coloured bar. Today opens at the current time and moves to the new day by itself after midnight.
2. New patient: Patients, Add patient. Record the identity document type and number (MyKad, MyPR, MyKAS, passport or birth certificate). Citizenship follows from it and decides service tax. Add the address. For a patient under 18, add the parent or guardian.
3. Medical history and privacy notice: "Send questionnaire" on an Arrived card shows a QR code and a WhatsApp link; the patient fills the medical history on their own phone in Malay or English and reads the privacy notice, and the dentist confirms the answers. For a patient under 18 the WhatsApp goes to the parent or guardian's phone and asks them to fill in the child's medical history ("please fill in Nur's medical history"); a child under 12 is not asked about smoking, alcohol, betel quid or pregnancy. Or give the printed notice and tick "Privacy notice given".
4. Mark the patient Arrived from the card's sheet when they arrive (this is the check-in). The dentist and DSA see the patient appear; a tap on an Arrived or In chair card opens the visit. The front desk can open it too, to the Complaint tab: on the left the visit type (Consultation, Emergency, Review, Continuing, Check-up; More for the rest), the complaint chips and a Remarks line; on the right the medical history, with tabs for Conditions, Medications, Allergies, Habits, Dental history and Vitals (a history already on record reads as plain lines). One Save records it.
5. After treatment: Front desk on the left sidebar shows a card for each visit with what is still open; press Take payment on its Payment row, or open the Bills tab and tap the pending bill. Procedure lines come from what was recorded and their wording is locked at the desk; a lower price is entered as a price override with a reason and counts as a discount. A bill never adds a consultation by itself: it appears as its own line when the dentist taps "Consultation" on Treat, when a completed examination counts as the consultation, or when the desk adds it. Each line's Amount is its own price (less any discount on that line); under the lines, the invoice discount and the service tax are one row each, and the lines that carry the tax are marked SST, so the lines and the rows add up to the total on the screen and the receipt. Use "Add item" for products, apply a discount with a reason (the limits apply to all the bill's discounts together; above your limit it waits until someone else whose limit covers it, and who holds the approval permission, approves it on any device with their own PIN), then press Take payment (it issues the bill first; "Issue bill" in the menu issues it without payment), then Receipt. For a panel patient (panels need Advanced features on, in Admin, Clinic, Advanced) enter the guarantee letter number and the panel's share; the payment asks the patient for the rest only, and "Take panel share" stays on the bill until the panel's payment is recorded. A medicine dispensed without a set quantity (a dose by weight for a child) shows a quantity field on its line; enter how many were handed over, and Issue waits until every one is in. Refunds and voids are in the payment's "..." menu; anyone holding the refund approval (the front desk too, by default) approves a refund with their PIN, and a refund never makes a paid bill owe money (an RM 300 crown with RM 100 paid and RM 50 refunded still owes RM 200). After the owner voids a bill, "New draft bill" makes a new draft for the visit. "Send by WhatsApp" ("Send to guardian" for a child under 18) on the patient's Documents sends a link the patient can open for 7 days.
6. Through the day: "Unsigned" appears on Today when notes wait for a signature. Beside it, when they have items, are Reminders (reviews and recalls due, with a WhatsApp link), Lab cases (with Advanced features on) and Cancelled and no-show, together in a "Lists" menu when more than one has items.
7. Check out and credit: "Check out" in a patient's card sheet, or Take payment on the Front desk, takes card, DuitNow QR, cash or a split in one sheet, prints, sends or emails the receipt, and books the next visit. Money taken before anything is billed is a deposit: the patient's credit, shown on the bill as "RM x unused" with "Use credit" in one tap. Instalments agreed on the Treat tab show on the bill. DeepBite keeps no stock counts and sells no prepaid plans except orthodontic packages (Admin, Ortho packages), which bill part by part at each ortho visit; Admin, Packages only sets what a procedure brings to the note.
8. End of day: press Cash-up at the top of the Front desk page (it always opens on today). Enter the counted cash, check the amount to bank (the rest stays in the drawer for tomorrow), then press "Close day"; the button says when the drawer is short or over. Credit used on a bill is not money in. A payment or refund recorded after the day was closed is listed under "After the close", and "Reopen and close" folds it in.

DSA

Chart findings on Exam, Chart with the palette (Select and Eraser tools first; each symbol has a letter key shown on its tile, V for Select and E for Eraser; with a surface symbol in hand and a tooth selected, M D O I B L mark surfaces, Shift and the letter always choose the symbol, and Backspace undoes; the arrow at the left of a row fills the rest of the row with the chosen symbol). The same sub-tab carries the extra-oral line, oral hygiene (Good, Fair, Poor) and the six BPE boxes (click the first box and type the six codes, for example 223322). Record the medical history the patient gives and, when asked, the six-point periodontal chart on Perio (type the depth and the cursor moves on; B marks bleeding). Radiographs, photos, scans and documents go in Images and files. What you record counts at once in the suggested diagnoses and the note; the dentist's signature verifies everything at the end, so nothing waits for a separate check.

Dentist

• One click per tab. The highlighted button is always bottom right.
• Exam: four sub-tabs, always shown. Chart (extra-oral, soft tissue, OH and BPE in the strip above the chart; a tap with the Select tool opens the tooth's details and history), Perio, Ortho, and Images and files (Photos with the four facial and five intra-oral slots, Radiographs with the film type, justification, image and remarks, and Documents). Perio is the six-point chart with a suggested 2017 stage and grade you confirm; Ortho is the classification, skeletal, dental, soft tissue and habits.
• Diagnosis: the rules suggest; you confirm, change or reject ("Confirm n and next" takes them all and skips conflicts). General diagnoses come first, then teeth in chart order. The periodontal card offers a suggestion from OH, BPE and the teeth lost to perio when there is no full chart. Nothing is inferred from the plan.
• Plan: the same chart as Exam with a treatment palette; tap a treatment, then the tooth or surface, and it is planned with its price in the visit selected (the chips above the chart: Visit 1, Visit 2, "Add visit"). Under the chart the plan reads in one column per visit with its total, the same treatment grouped on one line ("Filling: 11 (MD), 14 (B)"), with a pencil to change prices. "New plan" is in the "..." at the top; with two plans or more the plan picker and "Patient chose this plan" appear in the same row. "Options", "Decline or defer" and "Remove" are in the "..." of a line, and the handle at its left moves it to another visit.
• Plan: "Patient signs" opens the signature pad with the plan above it; the signature records written consent for the chosen plan (the guardian's for a patient under 18) and accepts the estimate, so Treat does not ask again for those items.
• Consent: a written-consent procedure is signed through the plan: "Sign the plan" on Treat opens the Plan tab's signature pad with the risk texts in English or Malay, and the patient (or, under 18, the guardian) signs on the screen.
• Treat: the same chart and palette as Plan (a patient in active orthodontic treatment opens on the Ortho view, with Chart beside it); tap a treatment, then the tooth or surface, and the planned item is done with your protocol (or an unplanned one is recorded and done). "Undo" appears for ten seconds after. A treatment not on the signed plan shows one banner: sign the plan on Plan, or "Verbal consent" (extractions and other written-consent procedures need the signed plan). "Done today" lists each procedure with its protocol sentence; its "Edit" opens Customise for what was different today; tick "Save as my default" when it is how you always do it.
• After treatment (on Treat; there is no separate Advice tab): Prescription, Medical certificate, Post-op advice, and Review and recall. Prescriptions come from the formulary (tap a line to adjust it); the caries and perio risk sets the recall. An allergy or medical alert blocks or warns before you prescribe; children need a weight. If the clinic dispenses, print the labels.
• Sign: check the note (the pencil at its top right lets you rewrite a section in your own words; empty the box to go back to the generated text), then "Sign note" and your PIN; the signature also verifies everything the DSA and the front desk recorded. The note is locked and fingerprinted. To correct it on the same clinic day choose "Amend note" (your own notes; a reason is optional); after that day the note takes only additional notes ("Add a note"), from you or another dentist. "Unsigned" on Today lists the notes still waiting for you. If you are finishing a colleague's visit, "Take over this visit" on Sign first.

Owner

Approve discounts above other people's limits and refunds, each with your PIN (on the front desk's device too), see Reports and Insights on the left sidebar (takings, revenue by dentist, procedure mix, outstanding balances, new patients, recalls due; Insights adds the unfinished treatment, retention and the visit and sales numbers), review incidents and late amendments, and read the audit log when needed. A locum who needs a patient outside their own list uses "Emergency access" on the left sidebar with a reason; it is time-limited and appears in Audit.

Desk features added since this guide was first written (29 and 30 Oct 2026)

• Instalments: on the Treat tab the dentist sets an instalment plan with the patient; it prints in the note and carries to the next visit's bill.
• Messages: confirm an appointment, send care advice after treatment, a review invite (good ratings go on to Google), documents and a treatment reminder, by WhatsApp, SMS or email, from editable templates (Admin, Messages). Patients answer on public pages: confirm, rate, stop offers.
• Referrals: "Refer" on the Plan tab writes a referral letter from a template (Admin, Referral templates); the desk sends it.
• Documents: one documents page per patient, opened from the patient or from the bill on the Front desk; every document except the MC and the note can be deleted (kept for the retention period), and an MC is voided with a reason. Documents to send show on the bill until sent or handed over.
• Medical risk: a patient with a condition from the medical catalogue shows an amber or red sign beside the name, on Today's card too, with a recommendations sheet.
• Insights and offers: the Insights page lists unfinished treatment (planned, and charted but not planned) and the visit, sales, case-closing and retention numbers; Admin, Campaigns sends offers to patients who opted in; the stamp card (Admin, Clinic, Loyalty) is off by default.

Part G. Legal and compliance checklist

DeepBite helps with each duty, but some steps happen outside the app. Each line comes from DeepBite's research notes on the Malaysian rules.

Part H. Clinical choices only you can make

The seed follows current Malaysian and international guidance, with its sources recorded in DeepBite's clinical research notes. These points have more than one defensible answer; decide them once and edit the seed through Admin.

1. Endocarditis prophylaxis for a patient allergic to penicillin: the National Antimicrobial Guideline 2024 (cephalexin, azithromycin or doxycycline; seeded) or clindamycin 600 mg from the 2017 Malaysian IE guideline.
2. Metronidazole in pregnancy and breastfeeding: caution (seeded) or block.
3. Split "blood thinners" into warfarin with INR, DOAC and antiplatelet questions.
4. The code used before a biopsy confirms malignancy (C06.9 seeded) on documents that go to panels and insurers.
5. Periodontitis grading: BSP (seeded) or AAP and EFP modifiers for smoking and HbA1c.
6. Lead apron in pregnancy: MDC 2010 guidance requires it; newer international guidance does not.
7. Quick prescription list: mefenamic acid, ibuprofen frequency, analgesic course length, chlorhexidine strength.
8. Asymptomatic impacted third molars: add a "monitor" option (the MOH guideline advises against routine removal).
9. Default recall intervals by risk (3, 6 and 12 months seeded; Admin, Clinic, Clinic rules).
10. Periodontal staging and grading as suggested on the Perio tab: stage from interdental attachment loss or bone loss in thirds (a pocket of 6 mm or more, or a grade 2 or 3 furcation, raises stage II to III; lost teeth raise it to III or IV), grade from bone loss percent over age (under 0.5 A, 0.5 to 1.0 B, over 1.0 C; B when no bone loss is recorded), localised under 30 percent of teeth. You always confirm or change it.
11. Consent for under-18s: one guardian-signed page for the plan items accepted together (seeded), with each procedure that needs specific written consent on its own signed line.

Choices DeepBite has already made for you; review each and say if it should change:

12. Caries into dentine suggests reversible pulpitis directly (no cold test needed); the "caries into dentine" diagnosis stays available for a manual pick and is no longer suggested. No reversible pulpitis is suggested on a tooth with RCT needed, TTP or a sinus tract.
13. Missing due to caries is a red dash and missing for other reasons a blue dash. Extraction needed is a red slash for caries and a blue slash otherwise.
14. Sunday is closed by default in the opening hours (Monday to Saturday 09:00 to 18:00); change it in Admin, Clinic, "Hours".
15. Periodontal staging from screening when there is no full chart (2017 AAP and EFP classification): BPE 0 with no bleeding is health; BPE 1 or 2 is plaque-induced gingivitis (localised when one or two sextants score above 0, else generalised); BPE 3 suggests periodontitis stage I or II (II when two or more sextants score 3), BPE 4 stage III; teeth lost to perio raise the stage (four or fewer at least III, five or more IV); localised under 30 percent of sextants scoring 3 or 4; grade B by default, C for 10 or more cigarettes a day or diabetes with HbA1c 7 or above, never A from screening. You confirm it on the Diagnosis tab.
16. Ortho canine and molar: a bare Class II or III chosen without a quarter is recorded as "full II" or "full III".
17. A tooth charted on Treat without a planned item is not linked to a diagnosis, so an extraction done that way carries forward with the default missing reason.

Part I. Keeping it running

On the hosted service DeepBite's operator looks after the server, the backups and the updates: the two lists below and Updates are for your own server, and the rest is for everyone.

Every day

• Copy the backup folder's new files off the machine (they end in .enc once encryption is on; Part C, step 7): an external drive, a NAS, or cloud storage in Malaysia. The backup folder holds the database and every generated document and uploaded file. The documents are written as a full archive in the early hours of Sunday and as the changes since then on the other nights, so a restore needs that Sunday's archive as well as last night's: copy the whole folder, not only last night's files. Keep the key file (infra/backup-key/backup.key) elsewhere, never beside the backups: without it no backup can be read.

Every month

• Keep one backup from the month for the long term. Dental records must be kept at least seven years after the last visit.
• Restore last night's backup to a spare machine and open one patient, one signed note and one document. A backup you have never restored is only a hope. The server guide has the restore steps.

When someone joins: Admin, Users, "Invite user", then "Copy invite link" or "Send by WhatsApp" in the "..." on their row. They choose their own password and PIN. For a locum, set the first and last day under Edit once they have joined.

When someone leaves: Admin, Users, set them to Disabled the same day. Their signed notes stay theirs; they can no longer sign in.

Forgotten PIN: "Forgot PIN" on the lock screen signs the person out; they sign in with their password and set a new PIN. Or the owner uses "Reset PIN" in Admin, Users; the person chooses a new PIN at their next sign-in.

Forgotten password: the owner uses "Reset password" in the person's row of Admin, Users and sends them the link shown (on the hosted service the owner's own forgotten password is a new setup link from the operator) (copy it into WhatsApp or a message: it is shown only once, works once and stops working after 24 hours; a newer link replaces it). The person opens it, enters a new password twice (12 characters or more) and signs in with it; every device they were signed in on is signed out.

Lost authenticator phone: the owner uses "Reset authenticator" in Admin, Users; the person sets it up again at their next sign-in. If the owner's own phone is lost (and no second owner can reset it), whoever runs the server clears it with docker compose -f infra/docker-compose.prod.yml --env-file .env.production exec api node --import tsx src/cli/reset-totp.ts <owner email>; the owner then signs in with the password and sets the authenticator up again.

Updates: take a backup first (the server guide, Backups, "Take one now"), then run the update command in the server guide (Update). The new database migrations run by themselves before the new version starts, and each device picks up the new app the next time it opens.

Part J. Troubleshooting

Where to get help

• In the app: Feedback, at the foot of the left sidebar's Management group, sends DeepBite a suggestion, a bug or a question, and shows each ticket's status and our reply on the same page (anyone at the clinic, a locum too, even while the clinic is read-only).
• On the hosted service: message DeepBite on WhatsApp, or ask your operator.
• On your own server: the server guide (infra/README.md in the DeepBite folder) has every server command.