Beyond the booking wizard, the customer-facing portal also hosts three standalone client-facing flows that the clinic can trigger from Lupa OS: payment links for collecting money outside an appointment, consent forms for capturing a signed agreement, and shared imaging for letting a client view DICOM studies. Each one is a single link the clinic generates, sends to the client, and tracks. This page covers what the client sees on each link, how the clinic generates and tracks it, and how to handle the common edge cases. For the orientation overview see How online booking works. For deposits taken inside the booking wizard, see the confirm-screen section in Booking confirmations and pre-appointment information — that's a different flow from the standalone payment links covered here.

In short: Three short links the clinic shares with the client. Payment link → /pay/:id → client pays one or more invoices via Stripe or Lupa Pay. Consent form → /sign/:linkId → client reads the form and submits a hand-drawn signature; a signed PDF is auto-archived. Shared imaging → /shared/imaging/:shareToken → client is redirected to the DICOM viewer for a specific study.

Don't email card details, scanned consent forms, or imaging files manually. Every one of those is either a compliance risk (PCI for cards, DPA / GDPR for forms and imaging), a security risk (large files in inboxes), or both. The links covered on this page are the right tool — they're auditable, time-bound, and never expose sensitive data to a personal email account.

A payment link is a clinic-generated URL the client opens to pay one or more invoices. It uses the clinic's connected payment processor (Stripe or Lupa Pay) and runs the actual checkout on the processor's hosted page, so card details never touch Lupa.

From the work app, on a client profile or invoice:

The link is base58-encoded and can't be guessed; it's also tied to the client and store, so it can only pay the intended invoices.

Online payments must be enabled. Generating payment links requires the clinic to have either Stripe or Lupa Pay enabled in settings. If the form shows an "online payments disabled" warning, that's the missing step.

The clinic sees the full list of payment links — client, amount, status, processor, creation date, expiry — in the work app's Lupa Pay payment-links view. Completed payments update the invoice and ledger automatically.

The clinic never sees card details. Card data is entered on Stripe's or Lupa Pay's hosted page and is never sent to or stored by Lupa. The work app records the payment outcome and the processor's transaction reference, nothing more.

A consent form is a clinic-defined document the client opens, reads, signs by hand on screen, and submits. The signed PDF is auto-archived against the pet (and appointment, if linked) so the team has a permanent, audit-friendly record before the procedure.

From the work app, on an appointment's Forms tab or the pet's Consent Forms section:

If the client revisits the link after submitting, they see the success screen — never the editable form. Submission is single-use, enforced atomically server-side so two simultaneous submissions can't both succeed.

Authoring forms happens in the work app, not in this portal. What the form contains, which fields are dynamic, and which placeholders are auto-filled ({{petName}}, {{clientFullName}}, etc.) is set up in the work app's consent-forms editor. The portal simply renders whatever the clinic has authored.

Forms can include rich content blocks the client interacts with as they read:

A shared imaging link gives a client read-only access to a DICOM study — X-rays, ultrasound, CT — in a proper viewer where they can pan, zoom, and scroll. The link is generated against a specific imaging order, with an expiry and (optionally) a maximum view count.

From the work app, on the imaging order details page:

The clinic sees the share list for each imaging order with creation date, expiry countdown, and access count vs the configured limit. Any active share can be revoked instantly — the next time the client opens the link, they see the revoked message.

Revoke is immediate. Clicking Revoke in the work app deactivates the link the moment you confirm. There's no grace period. If a client opens the same URL after revocation, they see the revoked message — not the imaging.

For payment links: Send a payment link the same day you raise the invoice. The longer it sits, the lower the conversion. A short follow-up message after a few days nudges the long tail. For consent forms: Generate and send the link as soon as the procedure is booked, not on the morning of the visit. Clients want time to read; rushing consent at the door is bad for both compliance and trust. For imaging shares: Default to a short expiry (24 or 72 hours) and a max view count of 5–10. Most legitimate viewing happens within a day. Long-lived shares with no access limit are a quiet leak waiting to happen. Use SMS for short-lived asks. Payment-link follow-ups and same-week consent forms convert better via SMS than email — but only if your clinic has SMS notifications properly set up. Re-send instead of extending. If a client misses a deadline, generate a fresh link rather than extending the old one. New links are cleaner in the audit trail.

No. Booking deposits are part of the booking wizard's submit step — they're paid before the appointment exists. Payment links are standalone and can target one or more invoices that already exist. Both run on the same payment processors. See Booking confirmations and pre-appointment information for the deposit flow. Yes. The work app's Create Payment Link form lets you select several invoices for the same client, and the link settles all of them when paid. Each invoice is reconciled individually after the payment captures. The portal captures both — a hand-drawn SVG signature and the typed signer name — alongside timestamp, device, and IP metadata. That's the standard set of evidence for a digitally signed consent. Whether that satisfies your jurisdiction's specific consent requirements is a clinic-policy question, not a portal question. They can fill in fields the clinic marked as dynamic (free text, dropdowns, checkboxes). They cannot change the body of the consent — that's set by the clinic in the form's authoring tool. Whether downloads are permitted depends on the DICOM viewer's configuration — not on the share-link settings in Lupa. The link controls whether the client can view, not what they can do once viewing. The clinic sees the access count for the link — how many times it has been opened — but not detailed per-view metadata (IP, timestamp, etc.) in the work app. If the clinic needs to know whether the client actually viewed, the access count is the indicator. Yes — these are independent flows. A typical surgery prep might involve one consent form to sign, one payment link for the deposit, and (after the procedure) an imaging share for the post-op X-rays. Each link is generated separately from its own area of the work app.

Clinics enable deposit rules from Payment settings → Booking deposit rules. Online booking setup now reads these rules and shows them in the booking summary. Open Payment settings, choose Booking deposit rules, set the amount, and save. Note: confirm in Settings → Feature availability whether Booking deposit rules is enabled for all clinics or still scoped to the booking-payments beta.