# Privacy Policy: Refill by Leveret
**Last updated:** November 6, 2026 (version 0.11.0)
Refill by Leveret ("the extension") is a private, internal tool published by Leveret for authorized staff of Trinova Medical, used inside the practice's eClinicalWorks (eCW) web application. It is not offered to the general public.
## What the extension does
The extension works refill requests in eCW under a standing order signed by the practice's physician. It reads each request and the patient's chart, then approves, denies or routes the request, creates telephone encounters and sends patient text messages through eCW. A staff member starts and supervises each run.
## What data the extension handles
- Patient identifiers (name, date of birth, phone number, account number)
- Health information (medications, doses, pharmacies, visit dates, and the notes on a refill request)
- The signed-in staff member's eCW name and Microsoft 365 account name
## Where that data goes
The extension has no server of its own, and Leveret receives nothing from it directly. Data moves only between the operator's browser and these services of the practice:
- **eCW:** the practice's own eCW application, in the open browser tab.
- **The practice's Microsoft 365 account (SharePoint / OneDrive), through Microsoft Graph, signed in as the staff member:**
- it reads and updates the shared refill request workbook;
- it reads the signed standing order;
- it saves a log of each run, including patient names and medications, in a restricted practice folder.
If the log cannot be saved to Microsoft 365, or no log folder is set, the extension downloads it to the operator's computer.
The extension can reach only the Microsoft 365 files that the signed-in staff member is already allowed to open.
## Storage in the browser
The extension keeps its settings, the signed standing order and the most recently loaded request list in Chrome's local extension storage on that computer. The Microsoft sign-in is kept in session storage and is cleared when Chrome closes. eCW's own page storage holds a local record of requests already handled, with patient and medication identifiers hashed where they are used as keys.
## What the extension does not do
The extension does not sell data, use it for advertising, or send it to analytics services or any party other than those named above. Its code is packaged in the extension; it does not download or run remote code.
## Contact
markmryan@leverethealth.com