Patient Compass Carebit Connector privacy notice

GGO Systems Limited publishes the Patient Compass Carebit browser extension. It is a staff tool used with a separately installed, practice-operated local connector. The practice controls access to its Carebit account and is responsible for its patient records, staff authorisation and local document retention.

This notice covers the browser extension, including the 0.3.0 beta, and the Windows local connector, including the 0.2.0 beta. Carebit and The Helm are separate services with their own applicable privacy notices.

When a staff member starts a handoff, the extension reads the selected Carebit record’s identifier from its URL. It does not read the patient’s name, notes or clinical record body from the page. It keeps the record identifier, relevant tab references and workflow status in browser session storage to bind the letter to the intended record.

The staff member chooses the guide in the extension’s panel. Using the staff member’s existing sign-in to The Helm in the same browser, the extension asks The Helm for the practice’s list of available journeys and locations. The extension does not read, store or transmit the staff member’s Helm password.

When the staff member chooses to prepare the document, the extension sends The Helm the chosen journeys, the location, the surgery date or the fact that it is not yet known, and the access duration. The Helm creates the access link and returns the guide letter. The extension does not send the Carebit record identifier, the patient’s name or the generated PDF to The Helm, so The Helm receives this selection without a patient name or record identifier. The extension keeps the pending selection in browser session storage until The Helm has answered.

A staff member may instead make the selection in The Helm itself; the extension then only receives the reviewed letter from The Helm.

The extension passes the letter to the local connector. The letter may include guide links, a QR code and an access code. The connector renders a PDF locally and stores it with the recipient association and upload-reconciliation records. These materials must be treated as confidential practice records.

The selection described above goes to The Helm service used by the practice, and to no other recipient.

After a staff member reviews the PDF and confirms the original recipient, the local connector sends the PDF and recipient association to the practice’s Carebit service to create a draft. It does not enable sharing or notifications. Staff review and any subsequent sending take place separately in Carebit.

The connector does not send operational records to a publisher analytics or telemetry service. It contains no advertising or profiling and does not sell user data. Information is used for document preparation and the associated confirmation and reconciliation workflow, not for unrelated purposes, creditworthiness or lending decisions.

Browser-store installation and update services, and any PDF viewer used by the practice, are separate products with their own applicable privacy notices.

The Windows connector stores practice API credentials encrypted for the current Windows user using Windows Data Protection. The browser extension and The Helm do not receive these credentials. The local connector decrypts them in memory when authenticating to Carebit.

Browser handoff context is held in session storage. Local PDFs, recipient associations and reconciliation records persist after the browser closes. Disconnecting the connector does not delete those records or credentials. This beta does not perform automatic retention-based deletion. The practice must specify and implement its retention and secure-disposal procedure, including reconciliation of uncertain uploads before removing relevant records.

The Windows connector restricts its data folder to the current user and system or administrator access. This does not replace the practice’s device security, account access and backup controls.

This notice will be reviewed when the connector’s data handling changes. Direct patient-record access, correction or deletion requests, and questions about a letter, to the responsible practice.

Do not send patient records, access codes, documents or credentials to the publisher for support.