VaxLink Privacy Policy

This policy describes the current data handling behavior of the VaxLink website and Chrome extension. VaxLink is designed for vaccine barcode parsing, National Vaccine Catalogue lookups, and supported chart-entry workflows in Panorama and InputHealth.

What VaxLink May Handle

Depending on how it is used, VaxLink may handle the following categories of information:

• Barcode payloads and parsed vaccine fields such as GTIN, lot, expiry, serial, DIN, trade name, manufacturer, route, and dose.
• Supported chart-entry values used for review and autofill on Panorama or InputHealth pages.
• Local workflow settings, queue records, cached National Vaccine Catalogue data, and inventory records stored on the local device.
• Local operational analytics such as scan counts, workflow usage, export counts, device identifiers, and optional workstation labels entered by the user.

How VaxLink Uses Data

VaxLink uses data only to support its stated workflow features. This includes:

• Parsing scanned or pasted vaccine barcode data.
• Resolving vaccine and lot details from National Vaccine Catalogue reference data.
• Showing reviewable values before autofill.
• Autofilling supported chart fields on supported pages.
• Maintaining local queue, inventory, reconciliation, monitoring, and export workflows.
• Producing user-requested CSV or JSON exports on the local workstation.

Where Data Is Stored

VaxLink only uses local browser-managed storage on the device where the extension is installed.

• `chrome.storage.local` is used for settings, cached National Vaccine Catalogue data, local queues, and local analytics.
• IndexedDB is used by the inventory manager for inventory items, transaction records, reconciliation data, incidents, monitoring cases, and related operational records.
• If the user exports CSV or JSON files, those files are downloaded to the local device and are managed outside the extension after download.

What Leaves the Browser

The extension may fetch National Vaccine Catalogue reference data from https://nvc-cnv.canada.ca/fhir/v2/Bundle/NVC and related bundle URLs returned by that service so local lookups stay current.

Those network requests are used for reference data refreshes.

Sharing and Disclosure

VaxLink does not sell user data. It does not disclose extension-handled data to advertising platforms, data brokers, or unrelated third parties.

The current extension is designed to keep workflow data local unless the user deliberately exports a file from the workstation.

Retention

Local extension data remains in browser-managed storage until it is cleared by the user, replaced by newer local data, or removed with the extension.

Downloaded export files remain on the device until the user deletes them.

Organizations using VaxLink should apply their own workstation security, retention, and local file handling requirements to exported materials.

User Controls

• Review values in the extension before using autofill on a supported chart page.
• Clear downloaded export files from the device when they are no longer needed.
• Reset local analytics from the extension settings panel where available.
• Clear browser-managed extension data or remove the extension to remove locally stored extension data.

Contact and Deployment Notes

Use the support contact published with the Chrome Web Store listing or the internal deployment owner responsible for your VaxLink rollout if you have a privacy question.

If a specific deployment adds third-party analytics, authentication, or backend services beyond what is described here, that deployment should publish an updated or supplemental privacy notice before use.