REMS Wizard — Privacy Policy

DRAFT v0.1 (2026-09-30) — for attorney review before publication.

Effective date: [launch date]. Applies to the REMS Wizard browser extension and automationwizard.health.

The short version

REMS Wizard runs inside your Chrome browser. Patient information it reads from your EMR or the SPRAVATO® REMS portal stays on your computer. Automation Wizard never receives it. The only information that leaves your browser is what is needed to run your subscription — and none of it is about patients.

What the extension processes on your computer

• Treatment-note values (patient name, date of birth, sex, treatment date, dose, lot number, monitoring minutes, medication list, vital-sign and pulse-oximetry answers, adverse-event answer) — read from the note you have open, held in memory and in browser session storage for that tab, and used to fill the REMS form and show you what was read. Cleared when the tab closes.
• REMS portal information (patient list and profiles: REMS ID, name, date of birth, status, forms on file) — read from your logged-in REMS session to find the right patient, avoid duplicate forms and build audit reports. Stored in the browser’s local extension storage for up to 12 hours (patient list) or until you clear it (audit records).
• Your setup: treatment-site details (healthcare setting name, address, phone, email, DEA number, prescriber name) and the note “mapping” (where each value sits on your note template — labels and page structure only; the extension removes any sample values before saving).
• A diagnostic log of what the extension did (field names, confidence levels, error messages with names, dates and numbers removed). Sent to us only if you choose to email it.

All of the above is stored in Chrome’s extension storage on your computer. If you sign into Chrome with sync turned on, Chrome may synchronize your setup (sites and mappings, never patient data or the portal list) to your Google account so another computer signed into the same account gets the same setup; that is Google’s service under Google’s privacy terms.

What Automation Wizard receives

• Subscription service (when activated): your subscription key, the number of successful forms per month (a count), the number of configured sites, the extension version and the time of the check. No patient information, note content, mappings or portal data — ever.
• Purchases: handled by Stripe. We receive your name, practice name, email and billing status; Stripe receives payment details under Stripe’s privacy policy. We do not store card numbers.
• Support: whatever you choose to send us. Please send note snapshots only for test patients.
• Website: standard server logs [and privacy-respecting analytics — confirm tool].

How we use it

To provide, bill, support and improve the service; to notify you of important changes. We do not sell personal information and do not use it for advertising.

HIPAA

Because the extension does not transmit protected health information to us and we cannot access it, Automation Wizard does not act as a business associate of your practice through your use of the extension. You remain the covered entity responsible for the information on your systems. [Counsel to confirm; consider offering a BAA on request.]

Security

The extension makes no network connections of its own. Data stored by Chrome is protected by your computer’s user account and disk encryption; use device encryption and screen locks as your HIPAA policies require. Report a security concern to [email protected] [confirm].

Your choices

Settings → “Restore to defaults” erases everything the extension stored on that computer. Uninstalling the extension does the same. Email us to delete your subscription account.

Children

The service is for healthcare organizations and is not directed to children.

Changes and contact

We will post changes here with a new effective date and notify subscribers of material changes. Automation Wizard LLC, [registered address], [email protected].