1. Overview

MedCode Pro is a Chrome extension that provides real-time healthcare coding, billing, and compliance intelligence by aggregating free, publicly available U.S. Government data sources. This privacy policy explains what data we collect, how we use it, and your rights.

2. Data We Do NOT Collect

We want to be explicit about what MedCode Pro does not do:

• No patient data — We never collect, store, or transmit any Protected Health Information (PHI), Personally Identifiable Information (PII) of patients, or any clinical data.
• No browsing history — We do not track which websites you visit.
• No web page content — We do not read, scrape, or analyze the content of web pages you view, including EHR screens.
• No clipboard access — We do not read or monitor your clipboard contents.
• No keystroke logging — We do not log your keystrokes outside of the extension's own search interface.
• No analytics or telemetry — We do not use Google Analytics, Mixpanel, Sentry, or any third-party analytics, advertising, or tracking services.
• No data transmission to our servers — We do not operate any data collection servers. The only network requests are to official U.S. Government APIs.

3. Data We Collect and Store Locally

All data is stored locally on your device using Chrome's built-in storage APIs (IndexedDB and chrome.storage). This data never leaves your browser:

Data Type	Purpose	Storage
Search queries	Recent search history for convenience	chrome.storage.local
Cached code data	Faster lookups for previously retrieved codes	IndexedDB (local)
Workspace codes	Your saved coding workspaces and sessions	chrome.storage.local
User preferences	Specialty, locality, theme settings	chrome.storage.local
Usage counters	Daily lookup counts for free tier rate limiting	chrome.storage.local

4. External API Requests

MedCode Pro queries the following free U.S. Government APIs to retrieve publicly available medical coding data. These requests contain only the search terms you enter (medical codes or provider names) — no personal information, cookies, or authentication tokens are transmitted:

• NLM Clinical Tables API (clinicaltables.nlm.nih.gov) — ICD-10-CM, CPT, and HCPCS code lookups
• CMS Physician Fee Schedule API (pfs.data.cms.gov) — Medicare fee schedule data
• RxNorm API (rxnav.nlm.nih.gov) — Drug name lookups and NDC codes
• NPPES NPI Registry (npiregistry.cms.hhs.gov) — Provider NPI lookups

These are publicly funded government services. We do not control their privacy policies. Please refer to their respective websites for their data handling practices.

5. Permissions Explained

MedCode Pro requests only the minimum Chrome permissions necessary for its functionality:

Permission	Why We Need It
storage	Save your preferences, cached data, and workspaces locally on your device
contextMenus	Add right-click option to look up medical codes from selected text
activeTab	Access the current tab only when you explicitly right-click to look up a code
alarms	Schedule periodic background refresh of cached medical code datasets
offscreen	Perform background IndexedDB operations without impacting browsing performance
sidePanel	Display the extension in Chrome's side panel for a larger coding workspace

6. HIPAA Compliance Statement

MedCode Pro is designed to be HIPAA-safe by architecture. Because the extension:

• Never accesses, reads, or processes Protected Health Information
• Cannot read EHR screens, clinical notes, or patient records
• Does not read web page content or DOM elements of any website
• Stores all data exclusively on the user's local device
• Transmits only medical code search terms (e.g., "E11.65" or "99213") to government APIs

It does not meet the definition of a Business Associate under HIPAA. No Business Associate Agreement (BAA) is required or offered. MedCode Pro eliminates HIPAA risk by never interacting with protected data in the first place.

7. Data Retention and Deletion

All locally stored data follows automatic retention policies:

• Cached medical codes expire after 60–90 days and are automatically refreshed
• NPI provider data expires after 30 days
• Usage counters reset daily at midnight local time

You can clear all extension data at any time by:

• Using Chrome's "Clear browsing data" with the extensions option selected
• Right-clicking the extension icon → "Remove from Chrome"
• Going to chrome://extensions and clicking "Remove"

8. Security Measures

MedCode Pro implements multiple layers of security:

• HTTPS only — All API requests use TLS encryption. No HTTP fallback.
• Content Security Policy — Strict CSP prevents loading of external scripts, styles, or resources.
• Origin validation — All internal message passing validates sender origin (sender.id === chrome.runtime.id).
• Input sanitization — All search inputs are length-limited and sanitized before API requests.
• No remote code execution — All JavaScript is bundled at build time. No eval(), no dynamic script loading.
• Auditable code — Full source code is available for security review upon request.

9. Children's Privacy

MedCode Pro is a professional tool designed exclusively for healthcare coding professionals. It is not directed at children under 13 and we do not knowingly collect data from children.

10. Changes to This Policy

We may update this privacy policy as the extension evolves. Significant changes will be communicated through the extension's update notes on the Chrome Web Store. The "Last updated" date at the top will always reflect the most recent revision.