Account and sign up

To get started, visit the sign-up page and enter:

• First name and last name
• Email address: this becomes your login and is used for all correspondence
• Password: minimum 10 characters, with at least one letter and one number. Common passwords are not accepted, and neither is a single common word with digits or symbols added to it, such as a season or a place name followed by the year. A phrase of several words is fine

You can optionally add your registration number during sign-up, or fill it in later on your profile page.

When you sign up, Sessional automatically creates your locum profile, assigns a Basic subscription, and generates a unique referral code you can share with colleagues.

Once your email is verified, set-up is two short steps: How you work (your employment type and who pays you) and Invoice details (your address, bank details and, for a limited company, the company details, which an invoice cannot be sent without). Everything else lives on your profile→ and can be filled in when you need it: your photo, phone and biography on the Personal tab, your registration number and specialty on the Professional tab, and publishing your public profile on the Visibility tab. Your public profile stays private until you choose to publish it there.

After signing up, you will receive a verification email containing a confirmation link. Click the link to verify your email address and activate your account.

• The verification link expires after 24 hours
• You cannot access your dashboard until your email is verified
• If you do not receive the email, check your spam or junk folder
• You can request a new verification email from the verification page. Each new email cancels the links in the earlier ones, so always use the most recent email
• The link asks for the password you chose at sign-up before it confirms the address

Sessional supports two ways to sign in:

• Password sign-in: enter your email and password on the login page
• Magic link sign-in: enter your email and receive a one-time login link by email. Click the link to be signed in without needing your password. Magic links expire after 15 minutes.
• After several wrong passwords: the sign-in page warns you when you are close, then password sign-in for that address is paused for up to 15 minutes. You are not locked out: a sign-in link by email and a password reset both still work, and signing in with a link lifts the pause.

If you have forgotten your password, use the "Forgot your password?" link on the sign-in page. A password reset link will be sent to your email and expires after 1 hour.

You can change your email address from the Account tab on your profile page. Enter your current password to request the change:

1. Your current address receives a security notice with a link to cancel the request
2. A confirmation link, valid for 60 minutes, is sent to the new address
3. Your account continues to use your old email until the new one is verified
4. Once you click the verification link in the new email, the change takes effect immediately
5. You are signed out everywhere, including this device. Sign in again with the new email address

To change your password, go to the Account tab on your profile page and enter your current and new passwords. The new password needs at least 10 characters, including a letter and a number, and must not be a common password or a common word with digits or symbols added. After changing your password, all other active login sessions are revoked for security. You will remain signed in on the current device only.

You can delete your account at any time from the Account tab of your profile. You are asked for your current password to confirm; if you sign in with a magic link and have no password, set one with Reset password first. Deletion is scheduled 30 days ahead rather than happening at once.

To cancel a scheduled deletion, open the Account tab of your profile: while a deletion is pending, the first panel there says so, with the date and the Cancel deletion request button. Cancelling is confirmed on screen. Signing in on its own does not cancel it. Before the 30 days are up, export your data: deletion removes your invoices, shifts and expenses, and keeping your business records is your responsibility.

After the window closes, your account and personal data are erased and your uploaded documents are removed from storage. This is permanent and cannot be undone.

Erasure also deletes your invoices, shifts and expenses. HMRC record-keeping is your duty, not ours, so export your data→ before you confirm. What is kept, and for how long, is set out in the privacy notice→.

Sessional takes several measures to protect your account:

• Password hashing: your password is stored as a one-way cryptographic hash. Sessional cannot read your password.
• HTTP-only cookies: your login session is secured with HTTP-only cookies that cannot be accessed by client-side scripts
• Session expiry: a session lasts 4 hours, or 30 days if you tick Keep me signed in for 30 days when you sign in. The clock does not reset as you use the site. When it runs out while a dashboard page is open, a panel says you have been signed out and nothing on the page is lost: sign in again in a new tab and the page you were on carries on, or sign in there and return to the same page
• Session revocation: a routine password change signs out other devices but keeps this session, API keys and calendar feed active. Confirming an email change or resetting a forgotten password revokes all existing sessions, API keys and the calendar feed link. Reconnect your calendar and generate new API keys on Pro afterwards