MLS Assist — Privacy Policy

Last updated: July 24, 2026 · Provided by MLS Scribe LLC

The full MLS Scribe privacy policy is at mlsscribe.com/privacy.html; where the two differ, that policy governs.

MLS Assist is a Chrome extension used to evaluate MLS alongside athenaOne and the MLS app. It supports clinician-started live schedule reads, supervised reads from the one chart the clinician selects, and reviewed draft placement. The current hosted release is not authorized for real patient information.

Single purpose

MLS Assist responds only to a clinician-started action, except for an optional scheduled snapshot of the one exact Athena chart already open. It does not walk a patient roster in the background, sign a note, submit a claim, or attest for a clinician.

What the extension accesses

• Schedule or visit content you explicitly request — the visible athenaOne day/month schedule or the one patient chart you select, only when you start the corresponding read.
• One optional scheduled chart snapshot — only the exact patient chart already open in signed-in athenaOne. If no stable verified chart is open, nothing is read or sent.
• Local settings — your preferences (via the browser storage API) are kept on your device.

How the information is used

During synthetic evaluation, requested content may be sent over HTTPS to the configured MLS backend solely for the MLS action the clinician started. This policy does not assert that a vendor BAA, zero-retention term, regulated hosting configuration, or production legal release is in effect. Do not use MLS Assist with real patient information until MLS publishes and the server verifies that readiness.

Permissions, and why each is needed

• activeTab / scripting — to read the visit and take approved steps on the EMR page you're actively using.
• tabs — to identify the EMR tab to act on and return you to MLS.
• storage — to remember your local settings.
• alarms — to run the optional one-open-chart snapshot at the time you choose.
• webNavigation — to identify which frame of the EMR page holds the chart being read.
• system.display — to place the MLS and EMR windows side by side when you start a pull.
• offscreen — to hold the audio recorder in a background document so recording survives tab changes.
• host access — see the exact list below.

Exactly which sites the extension can access

• athenanet.athenahealth.com — your EMR: reading the visit and taking the steps you approve.
• mlsscribe.com (and subdomains) — the MLS app itself.
• scrivara-backend.onrender.com — the MLS backend that stores your account data and clinical content.
• localhost / 127.0.0.1 — development builds only; unused in the published extension.
• Google Maps, g.page, Healthgrades, Vitals, WebMD, RateMDs, Zocdoc, Yelp, Facebook — used only by the optional reputation tools, and only when you start a scan. These read public business listings and public reviews about your practice. No patient information is sent to any of them, and they are never touched during clinical work.

Protected health information (HIPAA)

The current release is for synthetic evaluation and does not represent that it is approved for real PHI or that any BAA is executed. Production clinical use must remain disabled until the backend verifies an immutable, counsel-approved legal release and server-recorded user grant.

Data retention & deletion

Visit and roster data live in your MLS account; you can delete records from within MLS, and may request account deletion by contacting us. Local settings are removed when you uninstall the extension.

Contact

MLS Scribe LLC — michael@mlsscribe.com