Session Recorder privacy notice

Who this covers

This notice applies to computers at practices taking part in the Session Recorder pilot with Well Life Medicine, on which the practice has agreed to install the extension. It covers the extension itself and the Chrome browser management used to install it. It does not cover the practice’s EMR or any other software.

What is recorded

The extension is active only on three websites and their subdomains: modmedapp.com, ema.md and athenahealth.com. On those sites, while the tab is on screen, it records:

• Screenshots of the EMR tab, taken when you click, change a field, press Enter, Tab or Escape, scroll, or the page updates. Identical frames are skipped.
• Where you clicked and what kind of control it was, for example “a button labeled Save” or “a text field named Chief Complaint”. This is the click position and the control’s label, not what the control contains.
• The page address and the time, so the screenshots can be put in order and matched to the part of the EMR in use.

Screenshots show whatever is on the screen at that moment. That can include patient information and text already visible in a field. Well Life treats every recording as protected health information under its HIPAA privacy and security program, and every recording is encrypted on your computer before it is stored or sent, as described below.

What is never recorded

• Other websites or tabs. The extension is not loaded on any other site and cannot capture it.
• What you type. Keystrokes are not captured. The only keys it notes are Enter, Tab and Escape, and only that they were pressed.
• Audio, camera or video. The extension has no microphone, camera or screen-recording permission and contains no code that uses them.
• Passwords, cookies, clipboard contents or selected text. Login and password pages are skipped automatically, and a page showing a password field pauses capture.

How recordings are protected

Each recording is sealed in your browser’s memory with public-key encryption (libsodium sealed box) before anything is written to disk or transmitted. Only the encrypted form is ever stored on your computer or sent, over HTTPS, to Well Life’s receiving service. That service can only accept and store sealed recordings; it holds no key and has no way to read, list or return them. The private key that opens recordings is kept offline at Well Life Medicine, is never installed on any computer that records, and is used only by authorized Well Life reviewers.

Where recordings go and how long they stay

Encrypted recordings are stored in Well Life Medicine’s private Google Cloud Storage in the United States, in a bucket that blocks public access. They are deleted automatically 30 days after they arrive. For 7 days after that deletion, Google Cloud keeps a recoverable copy that only Well Life administrators can restore, after which nothing remains. Well Life does not keep decrypted copies beyond the review work described below.

How recordings are used

Well Life uses recordings for one purpose: to study how clinicians and staff actually use their EMR so that those workflows can be made faster and less error-prone. Recordings are reviewed by authorized Well Life staff on a computer that holds the private key. They are not sold, are not used for advertising, and are not shared with anyone outside Well Life Medicine except the cloud provider that stores the encrypted files under contract with Well Life, and where the law requires disclosure. Findings shared with your practice are about workflows, not about individual patients.

Browser management data

The extension is installed by enrolling Google Chrome on the computer in Well Life Medicine’s Google Admin console for the length of the pilot. While enrolled, Chrome reports its version, the computer’s operating system and its list of installed extensions to Well Life. Well Life uses that only to install, pin, update and eventually remove the extension and to confirm that setup worked. Enrollment does not give Well Life access to your screen, your browsing, or any content beyond the recordings described above. At the end of the pilot Well Life releases the computer, the extension is removed, and a small cleanup job on the computer deletes the enrollment files and itself.

Your controls

You can pause recording at any time from the extension’s toolbar icon; nothing is captured in any tab until you resume. You can stop taking part before the pilot ends by asking Well Life to release the computer, or by running the cleanup job by hand as described in the quick guide. You can ask Well Life what recordings exist from your practice and ask for them to be deleted early.

Contact and changes

Questions about this notice or the pilot go to tech@linuspartnerships.com. If Well Life changes what the extension collects or how it is handled, this page will be updated and the effective date above will change, and participating practices will be told before the change takes effect.