Ridgevia

Base Camp

Effective September 3, 2026

This policy covers the Base Camp web portal — including "Sign in with Google" and the optional Google Drive/Gmail connection a practice can enable in Settings — and the Base Camp Companion browser extension. Sections are labeled so you can find the one that applies to how you use the product.

What Base Camp is

Base Camp is an admin portal and AI assistant, built by Ridgevia, for staff at direct primary care practices. It helps a practice triage patient messages and gives staff a chat assistant that can answer questions about their own patients and practice data. Base Camp Companion is a companion browser extension that puts the same assistant one click away without leaving another tab. Both are operated by Ridgevia for the practices it serves; neither is offered to the general public.

Accounts and sign-in

Staff sign in with a username and password issued by their practice's Base Camp administrator, or with Sign in with Google. Signing in with Google shares your name, email address, and profile photo (Google's basic openid, email, and profile scopes only) so Base Camp can match you to your existing staff account by email — it does not create a new account on its own, and it never receives or sees your Google password. We link your account to that Google identity ("account linking") so future sign-ins are one click; you can only sign in this way if your email already matches a staff account your practice has provisioned.

Patient information

A practice's message history, AI triage results, and chat conversations with the assistant may reference patients and their health information. This data is encrypted at rest, isolated per practice at the database level so no query can reach another practice's data, and processed only by AI models running under a signed HIPAA Business Associate Agreement (AWS Bedrock, and the OpenAI API) — never sent to a general-purpose consumer AI product. Access is limited to that practice's own staff and is logged for audit purposes.

Google Drive and Gmail connection (optional, per practice)

A practice administrator can optionally connect a Google account in Settings so the AI assistant can look up or save Drive files and read or draft Gmail messages when a staff member asks it to. This is off unless a practice's admin turns it on, and only one Google account is connected per practice — not per staff member.

When connected, Base Camp requests:

Drive access limited to files the app touches (drive.file scope) — Base Camp can only see files it created itself or that a staff member explicitly selected through Google's file picker. It cannot browse, list, or read the rest of that Google account's Drive.
Gmail read access (gmail.readonly) — lets the assistant search and read messages in the connected mailbox when asked.
Gmail draft access (gmail.compose) — lets the assistant create drafts in the connected mailbox. Base Camp never sends email on your behalf. Every message the assistant prepares is saved as a draft; a staff member must open Gmail themselves and click Send.

The connection is stored as an encrypted refresh token tied to that practice. Any staff member can disconnect it at any time from Settings, which revokes Base Camp's access to that Google account immediately.

Base Camp Companion (browser extension)

What this extension is

Base Camp Companion is a Chrome extension that adds a side panel for asking Base Camp's AI assistant questions about a patient without leaving the current tab. It is distributed privately to staff of the practices Ridgevia operates Base Camp for.

The extension has exactly one purpose: let a signed-in staff member send chat messages to their practice's own Base Camp account and read the assistant's replies. It does not read, modify, or inject anything into any other website, including Spruce or any other page open in your browser.

Information the extension handles

Account credentials. The username and password you enter on the extension's login screen are sent directly, over HTTPS, to your practice's Base Camp server to sign you in. The extension itself does not store your password: only the short-lived session token Base Camp issues in return is saved, in Chrome's extension-private local storage (chrome.storage.local), which no website, including Spruce, can read.

Session token. Used to authenticate each request the extension makes to Base Camp. It expires automatically (Base Camp's standard session length) or is cleared immediately if you log out or if Base Camp reports the session invalid.

Messages you send to the assistant. Text you type into the chat, which may reference a patient and their health information, is sent to your practice's own Base Camp server to generate a response. The extension does not retain this text after the panel is closed; any server-side storage of it follows the same practices described under "Patient information" above.

What the extension doesn't collect

The extension has no access to the content of any web page, including Spruce. It requests permission only to reach your Base Camp server's address, nothing else. It does not read your browsing history, location, or any other site's data, and it never auto-detects or scrapes a patient from whatever page you're viewing; you type the patient's name yourself.

How this information is used

Solely to authenticate you, run your practice's triage and chat features, and, if connected, act on the Drive/Gmail requests a staff member makes through the assistant. Nothing you enter is used for advertising, analytics unrelated to the product, or to train any model outside the AI pathway your Base Camp deployment already uses.

Who we share it with

No one outside of the service providers required to run Base Camp itself: AWS Bedrock (BAA-covered AI processing), your practice's own database, and, only if your practice connects it, the Google account your admin chose. Data is never sold, never shared with advertisers, and the extension never sends anything to Google or any other third party on its own.

Security and retention

All traffic is encrypted in transit (HTTPS). Patient information and any stored Google refresh token are encrypted at rest. Session tokens live only in your browser's storage and are removed on logout, on expiry, or if you remove the extension. Retention of message and chat content follows your practice's Base Camp data retention policy.

Your choices

You can end your session at any time, disconnect a linked Google account or the Drive/Gmail connection from Settings, or remove the extension entirely from chrome://extensions, which deletes its locally stored session token immediately.

Children's privacy

Base Camp and Base Camp Companion are workplace tools for verified practice staff accounts and are not directed at, or knowingly used by, children.

Changes to this policy

If this policy changes, the effective date above will be updated. Material changes will be reflected here before they take effect.

Contact us

Questions about this policy, or requests regarding your data, can be sent to ridgeviallc@gmail.com.