Your clinic has its own front door.
One link per branch. Bookmark it, and it opens on today. If you run several, you see them all; if you work at one, you see that one.
Every workspace is behind a staff sign-in.A workspace URL is an address, never a credential. Opening a branch you are not assigned to sends you back to the sign-in page, and every query inside runs under the database's row-level security for that one clinic.