Trellova EHR Bridge — Extension Privacy Policy

The Trellova EHR Bridge places a clinician’s already-signed clinical note from Trellova into the note field of their existing EHR (TherapyNotes or SimplePractice), so the clinician doesn’t copy-paste. That is its only function.

On a supported EHR note page, the extension:

• Reads the patient identifier shown on the current page — used solely to fetch the matching Trellova-signed note for that patient.
• Locates the note-body field so it can write into it.
• Writes the clinician’s Trellova-signed note into that field.

It stores locally in your browser only: pairing configuration (your Trellova tenant + connection identifiers and API base URL) and a scoped, rotating access token. No patient data is retained by the extension at rest.

The extension communicates only with Trellova’s own backend (over HTTPS) — to retrieve the signed note for the patient on screen and to refresh its access token. It does not send data to any other destination.

• It does not sell your data or share it with third parties.
• It does not use data for advertising, analytics, or any purpose other than the single purpose above.
• It does not track your browsing. Its access is limited to the supported EHR domains; it does nothing on any other site.

The clinical note is Protected Health Information. Trellova handles PHI as a HIPAA Business Associate, governed by Business Associate Agreements with the practices that use Trellova.

The extension keeps only the pairing config + access token in local browser storage; unpair or uninstall to clear them. All communication with Trellova’s backend is over HTTPS, and the access token is scoped to the paired connection and rotates automatically.

Privacy questions: privacy@trellova.com. We will post any changes to this policy here with an updated date.