Tarsi Migration Tool — Privacy Policy

Version 1.2 — Effective July 6, 2026

This Privacy Policy describes how the Tarsi Migration Tool browser extension ("the Extension") handles information. It is specific to the Extension and is separate from, but governed alongside, the main Tarsi Privacy Policy and Data Processing Addendum. The Extension is published by Tarsi ("we", "us").

What the Extension does

The Extension has a single purpose: to help an authorized clinic operator move their own practice data out of a supported source system — Jane App or Aesthetic Record — and into their own Tarsi account. It reads patient records the operator is already signed in to view in that source (profiles, chart notes, attached photos, and — for Jane App — appointment and invoice history) and transmits them into a staging area inside that operator's Tarsi organization, where the operator reviews them in Tarsi before they become live patient records.

The Extension is a conduit. It does not run on its own, does not operate in the background, and only acts while the operator has it open and has explicitly started an import.

Information the Extension accesses

While an import is running, the Extension reads, from the operator's own authenticated session on the source system they are migrating from (Jane App or Aesthetic Record):

• Patient profile fields (name, contact details, demographics)
• Clinical chart notes and treatment history
• Photos and documents attached to patient records
• Appointment history and invoice/billing history (Jane App only — the Aesthetic Record adapter does not migrate appointments or invoices)

This information is protected health information belonging to the operator's clinic and the clinic's patients. The Extension accesses it solely to copy it into the operator's Tarsi account at the operator's direction.

How information flows

1. The operator signs in to Tarsi through a secure OAuth 2.0 (PKCE) consent screen. This authorizes the Extension to write to that operator's Tarsi organization only.
2. The Extension reads records from the operator's active source session (Jane App or Aesthetic Record) in the same browser.
3. As each record is read, it is sent directly from the operator's browser to Tarsi's backend (Supabase) over an encrypted HTTPS connection, into staging/import tables scoped to the operator's Tarsi organization. This transmission happens automatically as part of the import — it is not withheld until the operator reviews the record.
4. The operator then reviews the staged records inside Tarsi (not inside the Extension) before anything becomes a live patient record. Only records the operator confirms are materialized into the clinic's active patient data; the rest can be discarded from staging.

The Extension itself talks only to two places: the operator's active source session (Jane App or Aesthetic Record), and Tarsi's backend. It does not send data to any third-party server of its own, and it is not used for any purpose other than completing the import the operator requested.

Once a record reaches Tarsi's backend, it is handled the same way as every other record in that clinic's Tarsi account — including by the infrastructure providers Tarsi's platform itself runs on (for example, its database/storage provider and its content-delivery/edge provider). Those are not parties the Extension chooses or contacts directly; they are part of how the Tarsi platform operates, and they are bound by the same Data Processing Addendum that governs the rest of the clinic's Tarsi data. Staged data is visible only to staff within the destination organization — the same access controls that protect the rest of that clinic's Tarsi data apply to it immediately on arrival, before and after review.

What the Extension stores, versus what Tarsi stores

These are two different things, and it matters which one a given record is in:

On the operator's device (the Extension itself): the Extension stores only the operator's Tarsi sign-in tokens (an OAuth access token and refresh token) in the browser's local extension storage (chrome.storage.local). These tokens let the import continue without repeated sign-ins. They are stored on the operator's own device and are removed when the operator signs out or uninstalls the Extension. The Extension itself keeps no local database of patient records — once a record is transmitted (see "How information flows" above), the Extension holds no further copy of it.

In Tarsi's backend (not the Extension): every record the Extension transmits is necessarily stored there — first in staging, then, once the operator confirms it, as a live patient record in the operator's Tarsi organization. This is not optional or something the Extension controls — it is how the import and review process works. That data does not disappear after import; it is retained as part of the clinic's Tarsi account for as long as the clinic's Tarsi data generally is, and is governed by the Tarsi Privacy Policy and Data Processing Addendum — the same policies that govern every other patient record in that clinic's Tarsi account, not by this Extension-specific policy.

What the Extension does NOT do

• It does not sell or rent any data to anyone.
• It does not share data with advertisers, data brokers, or any outside party for that party's own use. (The infrastructure providers that run the Tarsi platform — described under "How information flows" above — process the imported data only as part of delivering Tarsi to the clinic, under Tarsi's Data Processing Addendum; they are not third parties using the data for their own purposes, and the Extension does not contact them directly.)
• It does not use data for advertising, profiling, or any purpose unrelated to the import.
• It does not include analytics, tracking pixels, or telemetry.
• It does not monitor browsing history, search history, or activity on any site other than the Jane App or Aesthetic Record pages required to perform the import.
• It does not transfer data for creditworthiness or lending decisions.

Permissions and why they are needed

Who may use the Extension

The Extension is intended only for clinic operators who are authorized to access both the source account (Jane App or Aesthetic Record) and the destination Tarsi account. Operators are responsible for ensuring they have the legal right to migrate the data they import and for their own obligations to their patients under applicable privacy law.

Security

• All network traffic uses encrypted HTTPS (TLS).
• Sign-in uses OAuth 2.0 with PKCE; the Extension never sees or stores a Tarsi password.
• Sign-in tokens are short-lived and refreshed automatically; the operator can revoke them at any time by signing out or uninstalling.

Data retention and deletion

See "What the Extension stores, versus what Tarsi stores" above: on-device, only sign-in tokens are retained, and only until the operator signs out or uninstalls. Staged and imported patient records are retained inside the operator's Tarsi account under the Tarsi Privacy Policy and the operator clinic's own retention practices — not by the Extension.

Changes to this policy

We may update this policy as the Extension evolves. Material changes will be reflected by a new version number and effective date at the top of this page.

Contact

Questions about this policy or the Extension can be sent to [email protected].