How to check a message from Jubilee Health

We send exactly two kinds of message about your account. Here is what each one looks like, who it comes from, and what neither of them will ever ask you for.

The only two messages we send

• An invitation, when somebody creates an account for you. It names the person who invited you, your role and the organisation you are joining. Its link path starts with /login.html?invite=. It is good for seven days, it dies the first time it is used, and a newer invitation to the same address replaces any older one.
• A password reset, and only when somebody asks for one on our sign-in page. Its link path starts with /login.html?reset=. It is good for sixty minutes, and it also dies on first use.
• That is all. We do not email you to "verify your account", we do not warn you that an account will be closed, we do not send invoices, and we never attach a file.

Who they come from

• Both arrive from Jubilee Health <no-reply@demo.notify.jubilee-health.com>.
• An invitation can be replied to - it reaches the person who created your account. A password reset cannot: it is sent by the system and a reply to it reaches nobody. If you need a person about a reset, contact whoever set your account up.
• The button you are asked to click points at https://app.jubilee-health.com and nowhere else - no redirector, no shortened URL, no tracking link. Hover over it and read where it goes before you click. The only other links are to our own https://app.jubilee-health.com/verify-an-invite - this page - our guide to authenticator apps at https://app.jubilee-health.com/authenticator-help, and, in the footer, our public site at https://jubilee-health.com. Nothing else.
• The only image either message loads is our own logo, from https://app.jubilee-health.com. We use no tracking pixels, so nothing in the message reports back when you open it. If your mail client shows a blocked image from anywhere else, the message is not ours.

What you will see when you open an invitation

There are two shapes, and both are normal. Knowing which one you should expect is the point of this section.

• If a practice invited your organisation - its accounting firm, its MSO, its billing company or its IT vendor - the first thing you see is a disclosure: who invited you, what you will and will not be able to see, whether a Business Associate Agreement is involved, the address it was sent to, and when it expires. That page asks you for nothing.
• If we created your account directly, you go straight to choosing how you will sign in. There is no disclosure page for that kind, and its absence is not a sign that anything is wrong.
• Every invitation offers the same three ways in, and the choice is yours: Google, Microsoft, or a password. With Google or Microsoft you set no password and pair no authenticator app with us, because that account's own sign-in protection covers it, and the only place you type anything is Google's or Microsoft's own sign-in window.
• Either way, the address you sign in with must be the address the message names.
• After you choose a password you will pair an authenticator app. Always, for every account with a password. We do not offer a way to skip it, so a "sign in without your authenticator" offer did not come from us.

What Jubilee Health never does

• Never asks for a password by email, and never emails you a form to type one into.
• Never asks for a code from your authenticator app. Not by email, not by phone, not to "confirm your identity". Anyone asking for that code is trying to sign in as you.
• Never asks for a card number or a bank account.
• Never asks you to accept on somebody else's behalf. If an invitation names a different address, choose "Report it" on the page and the practice is told the link reached the wrong person.

If something looks wrong

Do not click anything in the message and do not type anything into it.

• If you already have an account, go to https://app.jubilee-health.com by typing it yourself and sign in there. Anything real will be waiting for you inside.
• If you do not, get in touch with whoever you believe created the account, using a phone number or address you already had - not one printed in the message you are unsure about.
• A reset you did not ask for means somebody typed your address into our sign-in page. You can ignore it. Your password has not changed, and the link is worthless to anyone who cannot open your mailbox.

This page is public, so you can reach it without signing in and check it against anything you receive. Legal · Sign in