Intake.Dental Connector — Privacy Policy

Effective June 10, 2026

The Intake.Dental Connector ("the Extension") is a browser extension that lets a dental practice connect its logged-in CareStack session to Intake.Dental, so Intake.Dental can write AI-generated clinical notes and insurance-verification results back into the practice's CareStack chart on the practice's behalf. This policy explains exactly what the Extension accesses, why, and where it goes.

In one sentence: the Extension reads only your *.carestack.com session cookies and sends them to your own practice's Intake.Dental account so notes can be written to your chart. It does not read other websites, does not track your browsing, and contains no analytics or advertising.

1. What the Extension accesses

CareStack session cookies only. Using the browser's cookies permission, the Extension reads the cookies for *.carestack.com (including the secure, HTTP-only session cookie a normal web page cannot read). These cookies authenticate the write-back to your chart.
A connect code you provide. Stored locally via the browser's storage permission so the Extension can identify which Intake.Dental practice account to sync to. It is a practice-scoped access token, not your CareStack password.

The Extension does not read cookies, page content, history, or form data from any site other than CareStack.

2. How the data is used

The CareStack session cookies are sent over HTTPS to the Intake.Dental API (api2.intake.dental), authenticated with your connect code, solely to let Intake.Dental's server-side automation sign in as your established session and write clinical notes and verification results into your CareStack chart. The cookies are not used for any other purpose.

3. Why a background refresh runs

The Extension uses the alarms permission to re-read and re-sync the CareStack session about every 30 minutes while you are using CareStack, so the connection stays valid without you having to reconnect. No data is collected during this refresh beyond the same CareStack session cookies described above.

4. Where the data is stored and how it is protected

Session cookies are stored server-side, encrypted with AES-256-GCM, scoped to your individual practice. They are accessible only to the automation that writes to your CareStack chart.
Intake.Dental handles Protected Health Information (PHI) under a Business Associate Agreement (BAA) and applies HIPAA-aligned safeguards.
The connect code is stored only in your browser's local extension storage.

5. What we do not do

We do not sell, rent, or share your data with third parties.
We do not use the data for advertising or for any analytics or tracking.
We do not access non-CareStack sites, your browsing history, or keystrokes.

6. Disconnecting and data deletion

You can disconnect at any time by removing the Extension from your browser (which clears the locally stored connect code) and/or disconnecting CareStack in your Intake.Dental dashboard, which deletes the stored session cookies server-side. To request deletion of any associated data, contact us using the details below.

7. Changes to this policy

We may update this policy as the Extension evolves. Material changes will be reflected by an updated effective date on this page.

8. Contact

Questions about this policy or your data: support@intake.dental.