Roadmap
This is the actual build plan, kept in the open. Everything under “Available now” is in the product today and in use. Everything below it is ordered by what we believe practices need next, with no delivery dates — a roadmap with quarters on it is a promise, and we would rather you trust the order than doubt the calendar.
Available now
Not a preview list. Everything here is shipped and in use by practices.
Website builder
Click-to-edit pages, themes, media library, SEO and a blog, on your own domain.
Online booking
Services, packages, memberships, gift certificates, waitlists and class reservations.
Client portal
Clients see their visits, documents, balances, packages and progress without calling you.
Intake forms & waivers
Built forms, signed waivers with the exact text frozen at signing, and form packets.
Calendar & bookings
Availability rules, time blocks, practitioners, locations and rescheduling.
Check-in station & lobby display
Arrivals, walk-ins, readiness checks and an ambient waiting-room screen.
Client records & clinical notes
Session notes that cannot be rewritten once signed, goals, documents and journey history.
Safety centre
Risk flags, incident reports and emergency protocol steps.
Invoicing & payments
Invoices, card and desk payments, coupons, gift certificates and account credit.
Double-entry bookkeeping
A real general ledger: balance sheet, P&L, cash flow, trial balance, journal and month close.
Bank reconciliation
Tick statement lines against the books; it will not let you close with a difference showing.
Automatic posting
Invoices and expenses post to the ledger, previewed before anything is written.
Insurance claim records
Policies, claims, service lines and remittances — the record layer, not yet the filing.
Email marketing
Campaigns, journeys, segments, deliverability monitoring, consent and compliance — complete.
CRM
Contacts, organisations, pipelines, deals, quotes, sequences and reporting.
Reviews & referrals
Review requests, a referral programme with payouts, and a partner portal.
Analytics & intelligence
Growth analytics, plain-English questions over your own data, and an AI practice coach.
Tenant isolation
Every record is scoped to your practice at the database level, not merely in the interface.
Tamper-evident audit trail
A hash-chained log of who accessed what, which detects an edited or deleted event.
Privacy requests
Server-side data export and erasure with a receipt that cannot be edited afterwards.
Accessibility
Skip links, visible focus, described images, and status never signalled by colour alone.
Building now
Both of these close a gap in something that already ships, which is why they come before anything new.
Memberships can be sold today but not automatically charged, which means chasing an expired card every month. This closes a gap in a feature that already exists, and collections post straight to the ledger.
Choosing and paying for an Attuniva plan from inside the product, with the plan granted by the payment rather than switched on by hand.
Next up
Ordered by how much daily difficulty each one removes, not by how interesting it is to build.
Google, Outlook and Apple calendars: outside commitments block your online availability, and Attuniva bookings appear on the calendar you already look at. The single largest day-to-day friction left.
Two-way messages between practitioner and client inside the portal, with the notification deliberately carrying no health information.
SMS through the same consent, suppression and frequency rules email already passes through, with quiet hours in the recipient’s own timezone and STOP honoured immediately.
Planned
Real commitments without dates attached. If one of these is what decides whether Attuniva works for you, tell your practice administrator — what people are actually waiting on changes this order.
Importers for Mindbody, Vagaro, Square and Calendly, with a dry run and duplicate detection before anything is written — and imported consent marked as declared rather than confirmed.
Assembling claims from documented visits, matching remittances, and posting payments and contractual write-offs to the ledger.
Products, stock levels, front-desk checkout, and cost of goods posted to the ledger.
Clock in and out, PTO that blocks availability, and payroll posting to the ledger. Deliberately later: most practices of this size use a dedicated payroll provider, and a half-built payroll engine is a tax problem rather than a feature.
1099 and W-2 preparation from the ledger and payroll. Follows payroll, because it depends on it.
Video sessions bound to a booking, with a waiting room and consent-gated recording.
Standard measures administered on a schedule, with per-client trends and practice-level aggregates — and no trend drawn from a single data point.
Licence, insurance and continuing-education records, with escalating expiry alerts.
A content calendar that publishes to Instagram, Facebook and TikTok in your brand voice.
Hours and services kept in step, and reviews from Google and Yelp gathered in one place.
An employer buys sessions and their people redeem against an allocation, with employer reporting that never exposes individual clinical detail.
A workspace under your own brand and domain, with roll-up reporting across locations.
Subscribable events, signed deliveries with retries, and documentation for building against your own data.
iOS and Android for practitioners and clients, with push notifications that deliberately never contain health information. The web app is already usable on a phone, which is why this is not first.
Straight answers
A roadmap that only lists arrivals is a wish list. These are the things we were asked for and either refused or cannot yet honestly deliver.
Eligibility checks and claim submission need a credentialed connection to a clearinghouse. We have built the records and the accounting, and deliberately not a “submit” button that validates a claim and then does nothing — because you would believe it was filed and find out at the filing deadline.
The storage region belongs to the hosting platform, so we have not built a region selector. A dropdown that changes nothing while implying a residency obligation is handled is worse than the gap itself.
We do not measure availability, so there is no honest number to print. We hold no SOC 2 or ISO certification and no platform-level BAA, because nobody outside has examined us yet. The trust centre says the same thing in more detail.
Login methods and second factors are handled by the hosting platform’s authentication settings. Re-implementing them over a session we do not issue would be theatre.