# HCSIS Plan Summary Privacy Policy
Prepared September 29, 2026 for version 1.0.6. Publication draft; not yet posted to the live policy page.
Replaces the policy dated September 28, 2026 at https://www.supportivebehavior.com/hcsis_privacy_policy/ when published. Until the new extension version is deployed, the version 0.3.2 distinctions below continue to apply.
HCSIS Plan Summary is provided by Supportive Behavioral Resources, Inc. (SBR) to help authorized users review selected information from the HCSIS Individual Support Plan already open in their browser. It does not expand a user's HCSIS access or replace the source plan.
## Information the extension handles
After a user invokes the extension on a supported plan page, it reads information needed for the summary and its source-navigation features. This can include names, Medical Assistance identifiers, dates of birth, addresses, diagnoses, plan dates, coordinator and supervisor information, coordinator email, program/waiver information, SBR service details, and related outcome statements. This information may include protected health information (PHI). The active tab's URL is checked to confirm that the page is supported; it is not saved as browsing history.
Plan information is used in temporary browser memory to display the summary, navigate to source locations, and fulfill explicit Copy, email, and print actions. The extension does not save plan information in extension-controlled persistent storage or send it to developer-operated servers. It has no advertising, analytics, tracking, or remote-code service. It does not read HCSIS passwords or authentication cookies. Support-section shortcuts locate section headings rather than copy their contents into the summary.
The extension does not send extracted plan information to SBR servers, analytics services, advertising services, or AI services, and it does not log extracted information.
## Copy to clipboard
When a user selects Copy, the extension writes only the selected displayed value as plain text to the system clipboard. Eligible values are displayed fixed plan fields, Diagnosis, individual Outcome Statements, and a valid Supports Coordinator email address. The extension does not offer whole-summary or service-detail copying.
The extension never reads or monitors the clipboard, and it does not log, store, synchronize, or automatically clear clipboard contents. Copied information can include PHI. Once copied, it is outside the extension's control. Operating-system clipboard history, clipboard synchronization, other applications, and pasted destinations may retain or transfer it according to their own settings and policies. Use only organization-approved destinations and follow organizational PHI-handling requirements.
## Display preferences and Chrome synchronization
The extension saves only these two preferences through Chrome's extension storage:
- Selected service-field identifiers (`enabledServiceFieldIds`). These identify which field types to display, not their values.
- The service-detail reference-link setting (`showServiceFieldSourceLinks`), stored as a true/false value.
When Chrome synchronization is enabled and permitted by browser policy, Google Chrome may synchronize these preferences across browsers signed in to the same account. When synchronization is disabled, Chrome keeps these preferences locally. The extension does not manage a separate synchronization server or read the user's Google account identity.
These preferences never contain PHI, plan values, names, addresses, diagnoses, outcome text, coordinator email addresses, source references, page URLs, clipboard contents, or user identifiers. Existing valid local display preferences may be migrated to synchronized storage; the old local preference is removed only after a successful synchronized write. A valid synchronized preference takes precedence over an older local preference.
Synchronization is governed by Chrome settings, organizational browser policy, and Google's applicable privacy terms. The extension's promise is local processing of plan information, not that every preference stays on one device.
## Email and printing
Selecting the coordinator email address opens the configured email application with that validated address. The extension does not add a consumer name, subject, message body, or other plan content, and it does not send an email itself.
Print Summary creates a temporary local print view. Information leaves the extension's control when handled by browser print preview, the operating system, a printer, or a saved PDF. The extension does not track or delete printed pages or saved files. Follow organizational requirements for destinations, access, retention, and disposal.
## Retention and user controls
Plan data is held only as needed in the active summary and temporary print workflow, not saved as a plan cache or record history. The extension clears its rendered summary during supported navigation/tab-change clearing events and clears temporary print content during its cleanup lifecycle. This does not delete the source HCSIS record or copies already placed on the clipboard, printed, saved, or used in another application.
Display preferences persist between sessions. Users can change field selections, reset them to defaults, and change the reference-link setting. These controls update preferences; they are not a delete-all-data function. Organization-managed Chrome settings control synchronization and extension installation. Contact organizational IT for help removing the extension or clearing local/synchronized preference data. The extension cannot delete copies retained by other applications or systems.
## Limited use and sharing
HCSIS Plan Summary uses information only for its stated summary, source-navigation, Copy, email, printing, and display-preference features. It does not sell user data, use it for advertising or profiling, or use it for creditworthiness or lending decisions. It does not provide developers with remote access to plan contents. Transfers are limited to the user-directed actions described above and Chrome synchronization of the two non-PHI preferences.
The extension's use of user data is limited to these user-facing features in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements. This policy does not replace SBR's broader privacy, security, or records-management obligations or the privacy practices of HCSIS, Chrome, email providers, printers, or destination applications.
## Questions and changes
Contact SBR's Director of Business Operations and IT through your established company support channel with questions about this extension or its data handling. Do not include patient records, PHI, or identifiable screenshots in ordinary support messages. Material changes to these practices will be reflected in the privacy policy and relevant extension/store disclosures.
Clipboard copying and synchronized display preferences described here apply to the new version 1.0.6 feature set, not the older published 0.3.2 pilot. Version 0.3.2 stores its two display preferences locally and does not provide the new Copy controls or preference synchronization. Both versions preserve the local-processing boundary for plan information.