Skip to content
Docs
Dashboard

Guides

Embed the patient widget

Patients use NezerCare only through a chat widget on your own website: their check-ins, their care, and a chat with your team.

Install the snippet

Copy the snippet from the dashboard under Integrations → Patient widget into the <head> of every page, above your analytics tags. It looks like this:

HTML
<script
  src="https://<your NezerCare app>/widget.js"
  async
  data-organization="<organization ID>"
  data-environment="<environment ID>"
></script>

Anonymous visitors can ask questions as soon as it's installed; nothing they type is stored. Signing in patients, email links and everything a signed-in patient does need your organization's signed BAA.

Where it appears

On the same dashboard page, set:

  • Allowed websites: the exact origins that may show the widget, such as https://clinic.example.com. Up to 10, HTTPS only (http://localhost and http://127.0.0.1 work in sandbox). Browsers refuse to show it anywhere else.
  • Widget page: the page where patients land from check-in and care-update emails. Until it's set, check-in emails aren't sent.

Sign patients in

When a patient is logged in on your site, your backend signs a short-lived JWT so the widget knows who they are without a second login. Create the signing secret under Integrations → Patient widget; it's shown once. Only HS256 is accepted.

ClaimValue
subThe patient's ID in your system: the same externalPatientId you enrolled them with (1–200 characters).
audThe environment ID.
iatIssued at, in seconds since the epoch.
expExpiry, at most 10 minutes after iat.
jtiA unique ID. Each token works once.

Hand the token to the widget on the page:

JavaScript
window.NezerWidget.identify(identityToken);

To call it before the script has loaded, queue it:

JavaScript
window.NezerWidget = window.NezerWidget || { q: [] };
window.NezerWidget.q.push(["identify", identityToken]);

Sign a fresh token every time

Tokens last at most ten minutes and work once. Don't log them, send them to analytics or put them in URLs. The widget never enrolls anyone: a token for a patient you haven't enrolled is refused. In sandbox a refusal says why; in production every refusal looks the same.

JavaScript API

CallWhat it does
NezerWidget.identify(token)Signs in the patient the token names.
NezerWidget.open()Opens the widget's panel.
NezerWidget.close()Closes it.
NezerWidget.greeting(false)Keeps the greeting pop-up from appearing on this page, and takes it down if it's showing. greeting(true) allows it again.

Every call can be queued before the script loads, like identify:

JavaScript
window.NezerWidget = window.NezerWidget || { q: [] };
window.NezerWidget.q.push(["greeting", false]); // e.g. on a checkout page

Greeting pop-up

When your team turns it on (Integrations → Patient widget → Greeting pop-up), a short message pops up above the chat button a few seconds after the page loads: the assistant's avatar, the message, who it's from, up to two quick replies and a close button, with a red 1 on the chat button. There's nothing to install.

  • It shows at most once per browser session, never while the widget is open, and never again once the visitor opens the chat or closes it. On screens narrower than 400 pixels only the red 1 shows.
  • A quick reply opens the widget and sends the reply as the visitor's first message, through the same path as a typed one. Your page only tells the widget which reply was picked.
  • {first_name} in your greeting is filled in only for a patient you signed in with identify; for everyone else it disappears (“Hi 👋”). The name stays inside the widget's own elements and is never logged.
  • It stores only that it was shown, in your site's sessionStorage (nezer-greeting:<organization>:<environment>). Nothing a visitor types is stored.
  • It never takes focus and is announced to screen readers once, politely. It always says the assistant is an AI.

Check-in and care-update emails link to your widget page with a one-time code in the URL fragment: #nezer_launch=<code>, plus &nezer_case=<id> for a care update. Fragments never reach your server, so the code stays out of your logs. The widget opens the check-in or case and removes the code from the address bar once it's been used. A code works once.

What your page can see

The widget runs in a frame served by NezerCare, so scripts on your page (analytics, tag managers, session replay) can't read what patients type, their answers or their messages. Your page can still see:

  • The page address, which holds the one-time code until the widget has used it (usually under a second). Keep the snippet above your analytics tags, and don't capture URL fragments.
  • Identity tokens your backend signs.
  • That the widget is open, but not what's in it.

The widget's 911 line always shows and can't be hidden or restyled.