Privacy Policy — medicfw for Advantage (Chrome Extension)

Who this extension is for

medicfw for Advantage is an internal tool for staff of Medi-Weightloss® franchise clinics operated by medicfw. It works only for signed-in medicfw staff and is not intended for patients or the general public.

What the extension does

It connects the Advantage EMR at advantage.mediweightlossclinics.com to the clinics' own medicfw apps. It has four tools, and each one acts only when a staff member uses it:

• Weight intake. On a patient's Weight Measurements page, when the staff member presses Sync, it reads the chart number, the clinic from the page address, and each measurement row (date, weight, BMI, body-fat percentage, fat-free mass, total body water, total body fat, muscle mass, bio-impedance, height) and sends them to https://hrt.medicfw.com/api/intake/body-composition.
• Telehealth Meet links. On an appointment whose Method is Virtual, it asks medicfw to create a Google Meet and writes the join link into the appointment's Meeting Link field. On the schedule day view it flags Virtual appointments still missing a link and sends the day's slot layout (which times are offered and which appointments fill them) to https://hrt.medicfw.com/api/telehealth/*.
• MediScrypt note push. On a patient's visit note pages, it fetches that patient's provider-approved visit note from https://glp.medicfw.com/api/mediscrypt/push/*, inserts it into the note fields when the staff member presses Insert, and marks it pushed. On the Visit Summary page it reads the patient's recent visit vitals and sends them to https://glp.medicfw.com/api/mediscrypt/context as pre-visit context for the provider.
• Store cart. When a staff member presses Put in Advantage cart on medicfw's Orders to place page, it takes that order (store item names and quantities) and, in the staff member's own Advantage tab, reads the clinic's store pages and cart, ticks Add to Cart, sets the quantities and presses Add to Cart. It then reports which items are in the cart back to the same medicfw page. It never removes items and never checks out. No patient data is involved.

Where data goes

Only to medicfw's own applications at hrt.medicfw.com and glp.medicfw.com, over HTTPS. Google Meet links are created through medicfw's own Google Workspace, under medicfw's Business Associate Agreement with Google.

No data is sent to any third party. The extension contains no analytics, ad networks, error trackers or telemetry of any kind, runs only the code packaged with it, and has no backend of its own.

Where data is stored

• On the staff member's device: their personal medicfw API keys and settings, in Chrome's extension storage, plus the progress of a note insert in progress. Patient data is not kept on the device: it is read from the page, sent to medicfw, and discarded.
• At medicfw: in medicfw's Google Cloud database, encrypted at rest and in transit, inside medicfw's HIPAA program, and available only to signed-in medicfw staff with access to that clinic.

API keys

The weight intake, telehealth and MediScrypt tools authenticate with a personal API key tied to the individual staff member, so every action is attributed to them in medicfw's audit log. The key is created for the signed-in staff member on a medicfw settings page and handed to the extension there. Keys can be revoked at any time on those pages; a revoked key stops working at once on every device. The store cart tool needs no key: it acts only on a request from the medicfw page the staff member is using.

Permissions the extension uses, and why

• storage: to keep each staff member's API keys and note-insert progress.
• tabs and scripting: to find or open the staff member's own Advantage tab and, only when they press Put in Advantage cart, read the store pages and tick Add to Cart / set quantities there.
• Host permission for advantage.mediweightlossclinics.com: to read the weight, appointment, schedule, visit note, visit summary and store pages, and to write back the Meeting Link, the approved note text and the cart quantities the staff member asks for.
• Host permissions for hrt.medicfw.com and glp.medicfw.com: to send the data above to medicfw, receive API keys from medicfw's settings pages, and receive cart orders from the Orders to place page.

PHI & HIPAA

medicfw runs the receiving applications on Google Cloud under a Business Associate Agreement and keeps HIPAA access controls, audit logging and encryption in place. Each request is authenticated as the individual staff member and audit-logged with their identity and the time.

Data sale

medicfw does not sell, share or use any data handled by this extension for any purpose other than the four tools above.

Contact

Questions about this extension or its data handling: privacy@medicfw.com.