Chrome extension

KeepMD EOB Decoder Chrome Extension Privacy Policy

This policy explains what the KeepMD EOB Decoder Chrome extension does with information you interact with while using it. It applies only to the extension on the Chrome Web Store. Use of the KeepMD mobile app and keepmd.org website is covered by separate policies.

Summary in one paragraph

KeepMD EOB Decoder runs entirely in your browser. When you paste bill text, upload a text-based PDF, or right click to decode selected text, the decoding happens locally on your device. KeepMD does not receive your bill text, PDFs, codes, names, dollar amounts, or web addresses. We do not use advertising trackers, we do not sell your data, and we do not collect your browsing history.

Quick facts

Who this policy is for

Adults who are reviewing an Explanation of Benefits, a medical bill, a claim, or similar health and insurance paperwork for themselves or a family member they help.

On-device decode runs locally in Chrome without an account or login.Text-based PDFs are read locally with pdf.js and are never transmitted.The local activity log is optional, off by default, and clearable.Encrypted mobile handoff is optional and user-initiated.Raw EOB or bill text is not persisted or transmitted in plaintext for local decode.

Chrome Web Store

Information the extension may touch

The text you choose to decode can contain information that falls into Chrome Web Store data categories. All of it is processed locally in your browser.

  • Personally identifiable information, for example names on a bill.
  • Health information, for example diagnosis codes or service descriptions.
  • Financial and payment information, for example billed amounts, allowed amounts, deductibles, copays, coinsurance, patient responsibility, and out-of-pocket dollar amounts.
  • Website content, for example text you highlight on a page.

What never leaves your device

  • Your raw bill text, claim text, or EOB text.
  • PDF file contents.
  • Diagnosis codes, procedure codes, HCPCS codes.
  • Provider names, patient names, member IDs, claim numbers.
  • Dollar amounts or payment details.
  • Web page URLs or browsing history.
  • Anything typed into the popup.

What the extension does

  • Decodes ICD-10-CM diagnosis codes, HCPCS Level II service and supply codes, and common insurance and billing terms into plain English explanations.
  • Accepts text you paste into the popup, text-based PDF files you open in the popup, or text you highlight on a webpage and send to the extension through the right click menu.
  • Optionally creates an encrypted handoff link that lets you continue a decoded draft on the KeepMD mobile app by scanning a QR code.

Information stored locally on your device

The extension uses the Chrome storage API on your computer only. It stores your one-time acknowledgement that you have seen the privacy notice, your preference for the optional local activity log, and, if the local activity log is on, a simple tally of feature taps.

The local activity log is the optional aggregate telemetry shown to users in plain English. It is off by default. If enabled, it counts only feature actions such as Decode Text, Upload PDF, selected-text decode, copy, download, privacy detail views, clear-log actions, and handoff attempts.

The local activity log never contains your bill text, PDF contents, codes, names, numbers, amounts, or URLs. It is a personal usage counter that stays on your device.

  • You can turn it off at any time from the popup.
  • You can tap Clear activity log to erase the counts.

Optional encrypted mobile handoff

If you choose to continue a decoded draft on the KeepMD mobile app, the extension encrypts the draft in the browser with client-side AES-GCM, creates a ciphertext envelope, and shows you a QR code or a link.

The decryption key is placed in the URL fragment, which is the part after the hash symbol and is never sent to KeepMD servers by browsers. Only a device that scans the QR code or opens the full link can decrypt the draft.

  • The envelope is short lived.
  • You control when to generate it.
  • The server receives ciphertext only.

Data sharing and sales

KeepMD does not sell your data. KeepMD does not transfer your extension data to third parties. KeepMD does not use your extension data for advertising, credit, lending, or any purpose other than the extension's single purpose, which is to help you understand medical bill and EOB text.

Remote code and third party services

The extension does not download or run remote code. All JavaScript and WebAssembly are bundled inside the extension package at install time. The extension does not use analytics SDKs, advertising SDKs, or social media SDKs.

Children's privacy

The extension is not directed to children under 13 and is not intended for use by minors. Do not install or use the extension if you are under 13.

Your rights and controls

  • Turn the local activity log on or off at any time in the popup.
  • Tap Clear activity log in the popup to delete the local counts on your device.
  • Uninstall the extension in Chrome at any time to remove all local data stored by the extension.
  • Because the extension does not transmit your data to KeepMD for local decode, there is nothing for KeepMD to delete on its side.

Data security

Decoding happens locally in your browser, which limits exposure. The optional mobile handoff encrypts the draft with client-side AES-GCM and a key that stays in the URL fragment and is not sent to servers. The extension is code signed and distributed through the Chrome Web Store.

Data retention

Local storage items remain on your device until you clear them or uninstall the extension. KeepMD does not retain copies because KeepMD does not receive them for local decode.

Changes to this policy

If this policy changes, we will update the Last updated date at the top of this page and, for material changes, surface a notice in the extension popup on next launch.

Permission justification

Chrome permissions and why the extension needs each one

The extension uses only the permissions needed for the behaviors described on this page.

contextMenus

Adds a right click menu item so you can send selected text to the extension for decoding. Used only when you start the action.

activeTab

Gives the extension temporary access to the current tab after you invoke the extension or the right click menu, so it can read the text you selected and return a decode result.

scripting

Draws the decode result overlay on the current page after you request a decode from selected text, so the explanation appears in context.

storage

Saves your privacy acknowledgement, your local activity log preference, and the activity counts if you turn them on. Raw text and URLs are never stored.

downloads

Lets you export a local draft JSON file after decoding, only when you tap the download action.

Local storage keys

These technical keys stay in chrome.storage.local on your device.

hasSeenPrivacy Remembers that the privacy notice was acknowledged.
telemetryOptIn Remembers the local activity log preference.
telemetryAggregate Stores local counters if the activity log is enabled.

Contact

Questions about this policy can be sent by email. Extension help is available in the support section on the KeepMD EOB Decoder page.

privacy@keepmd.org /eob-decoder/#support