Cann Companion Portal Assist: privacy policy

Effective 5 October 2026

Cann Companion Portal Assist is a Chrome extension that helps a prescriber fill the TGA SAS & AP Online System form in their own logged-in browser session, from details they have entered in Cann Companion. It is an independent tool. It is not affiliated with or endorsed by the Therapeutic Goods Administration.

Who operates it

CannCompounding Pharmacy SA Pty Ltd t/a CannCompanion (ABN 87 663 554 667).

What data it handles

Only what the portal's steps ask for, and only when you choose "Fill in TGA portal (you submit)" in a signed-in Cann Companion account. That is the SAS-B application content you have prepared: your prescriber and practice details; the product, dosage form and indication; the dosing and clinical text; the patient's initials, date of birth and sex; and the diagnosis. The patient's full name, address and (for the Northern Territory) Medicare number are included only if you switch on the state step in Cann Companion, and only for that step.

Where it is held and for how long

In your browser's session memory (chrome.storage.session), on your own computer. It is not written to disk. It is deleted when the Summary check passes (or, if there is no Summary check, when every included step has been filled), or when you choose "Clear data" in the extension. In any case it expires 30 minutes after it arrived: from then on it can no longer be used to fill anything, and Chrome deletes it at the next scheduled clean-up or the next time the extension runs. Clearing the extension's data does not erase fields already filled in the portal; those stay in your TGA session until you change them there.

What it does not do

• The extension itself sends nothing to any server and stores nothing on disk. It makes no network requests of its own, and has no analytics, advertising or tracking.
• "Find in portal" asks the TGA portal to run its own lookup search, in your signed-in session, just as if you had typed and pressed search yourself. The portal, not the extension, then makes that request to the TGA. The search text is only the name of the ingredient, dosage form or indication being looked up: it contains no patient details.
• We do not sell this data, share it with third parties, or use it for anything unrelated to filling the portal form you asked for.
• It does not read your portal password, and it does not read any website other than the TGA SAS & AP Online System pages on compliance.health.gov.au/sas/.
• It fills a step only when you click "Fill this step", in the extension's toolbar button or in its panel on the portal page, after checking the patient initials. Only a real click from you counts: scripts on the web page cannot start a fill. It never saves, submits or ticks a declaration. You review every field and use the portal's own buttons.
• Its only other clicks are on a product lookup, when you press "Find in portal" beside it: it opens that lookup, types a search and presses the lookup window's own search button. It does not mark, tick or choose a result for you. It never ticks or clicks a result row and never presses the lookup's Select: you pick the value yourself.

Permissions it asks for

• storage: the temporary session memory described above.
• alarms: to schedule the clean-up of expired details. Chrome may run it late if the computer is asleep; expired details are never used to fill a form.
• compliance.health.gov.au/sas/*: to show its status panel on the portal's application pages, fill the step you confirm and search the lookup you ask it to.

Cann Companion itself

The extension receives details from Cann Companion, which has its own handling of patient and prescriber records. That is covered by the main Cann Companion privacy policy, not this page.

Changes

If the extension's data handling changes, this page will be updated before the change ships, with a new effective date.

Contact

Questions about this policy or the extension: companion@cannhg.com.au.