1. Our Commitment to Patient Privacy

At Cronic Care, protecting patient information is fundamental to the design, development, and operation of our AI-Native Clinical Intelligence Platform.

Healthcare organizations depend on the confidentiality, integrity, and availability of clinical information to deliver effective patient care. Cronic Care is designed to support these responsibilities by combining AI-assisted clinical documentation, clinical intelligence, and physician-governed workflows with security and privacy controls.

Our approach emphasizes:

• Responsible handling of Protected Health Information (PHI).
• Secure and authorized access to clinical information.
• Protection of patient information throughout clinical processing.
• Physician review and approval of AI-generated documentation.
• Appropriate administrative, technical, and physical safeguards.
• Compliance with applicable privacy laws and contractual obligations.

Cronic Care is committed to supporting healthcare organizations in meeting their patient privacy and information security responsibilities.

2. HIPAA and Cronic Care’s Role

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), together with its implementing regulations, establishes federal requirements governing the privacy and security of protected health information.

Cronic Care provides technology services to healthcare organizations, including physician practices, medical groups, clinics, and other authorized healthcare providers.

When Cronic Care creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered healthcare organization, Cronic Care generally operates as a Business Associate under HIPAA.

In that capacity, Cronic Care is subject to applicable HIPAA requirements and the terms of its Business Associate Agreements.

Cronic Care’s responsibilities may include:

• Safeguarding electronic Protected Health Information (ePHI).
• Limiting uses and disclosures of PHI to authorized purposes.
• Maintaining appropriate security policies and procedures.
• Supporting healthcare organizations in fulfilling applicable privacy obligations.
• Responding to and reporting security incidents and breaches as required.
• Ensuring applicable subcontractors are subject to appropriate contractual protections.

HIPAA compliance requires ongoing administrative, technical, contractual, and operational measures.

3. Protected Health Information We Process

Cronic Care’s platform is designed to process clinical information provided by authorized healthcare organizations and their healthcare professionals.

Patient and Encounter Information

• Patient names and identifiers.
• Encounter identification numbers.
• Patient–physician conversations and clinical transcriptions.
• Chief complaints and visit documentation.

Medical and Clinical Information

• Medical and surgical histories.
• Diagnoses, symptoms, and clinical observations.
• Medications, allergies, and treatment histories.
• Family and social histories.
• Vital signs and physical examination findings.

Diagnostic and Supporting Information

• Laboratory findings.
• Radiology and imaging reports.
• Pathology findings.
• Previous clinical documentation.
• Treatment plans, orders, referrals, and follow-up information.

AI-Generated Clinical Documentation

• SOAP notes.
• Assessment & Plan documentation.
• Diagnosis and ICD-10 coding support.
• Clinical intelligence reports.
• Longitudinal and integrated clinical summaries.
• Patient-friendly clinical reports.

Such information is processed for authorized clinical services and subject to applicable privacy and security requirements.

4. Secure Clinical Information Processing

Cronic Care is built around a clinical workflow that transforms patient encounters and authorized clinical information into physician-ready documentation and actionable clinical intelligence.

Patient Encounter → Clinical Transcription → AI Clinical Processing → Physician Documentation → Physician Review and Approval → Clinical Intelligence

At each stage, the platform is intended to support appropriate access controls and information protection.

Clinical information is processed to generate relevant documentation and reporting outputs for authorized healthcare professionals.

AI-generated outputs do not independently establish clinical decisions or replace physician judgment.

5. Cloud Infrastructure and Security Architecture

Cronic Care uses Amazon Web Services (AWS) infrastructure to support its platform operations.

The architecture includes services supporting authentication, application interfaces, processing, storage, clinical workflows, and communications.

Amazon Cognito — Authentication

Supports identity management and authenticated access for authorized platform users.

Amazon API Gateway — Secure Application Interfaces

Provides application endpoints through which authorized platform functions and clinical workflows are accessed.

AWS Lambda — Clinical Processing

Supports application logic, clinical workflow orchestration, and AI-assisted processing functions.

Amazon S3 — Clinical Document Storage

Supports storage and retrieval of clinical documents, transcriptions, and generated reports.

Amazon DynamoDB — Workflow and Application Data

Supports storage of encounter metadata, approval records, clinical context, report recommendations, and related application information.

Amazon SES — Communications

Supports platform-generated email notifications and workflow communications.

Amazon EventBridge — Workflow Automation

Supports event-driven processing and coordination of clinical workflows.

The use of these services does not independently establish HIPAA compliance. Appropriate service configurations, access restrictions, monitoring, risk assessments, and applicable contractual protections are necessary.

6. Identity Verification and Access Control

Cronic Care is designed to restrict access to clinical services to authorized users.

Access management may include:

• Provider account registration and verification.
• Healthcare organization affiliation checks.
• Authenticated user sessions.
• Role-based and organization-based permissions.
• Restricted access to patient and encounter information.
• Controls governing clinical documentation review and approval.

Healthcare organizations are responsible for identifying their authorized users and promptly communicating changes in access eligibility.

Users are responsible for safeguarding their authentication credentials and preventing unauthorized account use.

Access to clinical information must be limited according to legitimate responsibilities and applicable legal requirements.

7. Physician Review, Editing, and Approval

Physician oversight is central to Cronic Care’s clinical documentation model.

The platform is designed to allow authorized physicians to review AI-generated SOAP notes, make necessary corrections, and approve clinical documentation.

The review process supports:

1. Presentation of AI-generated clinical documentation.
2. Physician review of the clinical content.
3. Editing or correction when necessary.
4. Physician approval of the documentation.
5. Use of approved documentation in subsequent clinical intelligence workflows.

Cronic Care’s workflow also supports maintaining information about documentation approval and revisions.

The physician remains responsible for evaluating clinical accuracy, approving documentation, and making patient-care decisions.

AI-generated documentation should not be treated as independently verified clinical information.

8. AI-Powered Clinical Intelligence and Patient Information

Cronic Care uses AI technologies to support clinical documentation and the identification of relevant clinical insights.

Physician Documentation

Preparation of clinical notes, assessments, plans, and supporting documentation for physician review.

CareInsights™

Analysis of approved clinical documentation and available clinical information to identify relevant findings, recommend applicable reports, and support clinical follow-up and reporting.

ResearchInsights

Support for authorized clinical research documentation workflows, subject to applicable research, privacy, and contractual requirements.

AI processing is intended to support authorized clinical functions.

Use of identifiable patient information for purposes outside contracted clinical services, including model training or unrelated product development, requires an appropriate legal and contractual basis.

Cronic Care does not represent AI-generated recommendations as substitutes for professional medical judgment.

9. Administrative, Technical, and Physical Safeguards

Cronic Care recognizes the importance of the three categories of safeguards established by the HIPAA Security Rule.

Administrative Safeguards

Administrative safeguards address organizational responsibility for protecting electronic health information.

• Security risk analysis and risk management.
• Designated security responsibilities.
• Workforce access policies and training.
• Security incident response procedures.
• Vendor and subcontractor oversight.
• Contingency and disaster recovery planning.
• Periodic review of security controls.

Technical Safeguards

Technical safeguards protect information within electronic systems.

• User authentication.
• Access authorization.
• Audit logging.
• Information integrity protections.
• Secure communications.
• Encryption where appropriate.
• Session management.
• Monitoring for unauthorized activity.

Physical Safeguards

Physical safeguards address protection of facilities, equipment, and devices used to access or process sensitive information.

These include appropriate workstation, device, media, and facility controls.

Cronic Care’s implementation of these safeguards must be evaluated through documented security assessments and operational procedures.

10. Encryption and Secure Communications

Encryption is an important component of protecting electronic health information.

Cronic Care’s security approach includes evaluating encryption for clinical information during transmission and storage.

Appropriate encryption, key management, access restrictions, and secure communication protocols help reduce the risk of unauthorized disclosure.

Encryption does not eliminate the need for other safeguards, including identity verification, access management, monitoring, incident response, and backup protection.

11. Clinical Documentation Storage and Retention

Cronic Care may process and store clinical documents, encounter information, transcriptions, reports, and workflow records as required to deliver authorized services.

Different categories of information may have different retention requirements.

• Original clinical encounter information.
• Audio recordings and transcriptions.
• AI-generated clinical documentation.
• Physician-approved documentation.
• Clinical intelligence reports.
• Approval and audit records.
• Application and security logs.

Retention, archival, return, and deletion practices are governed by applicable agreements, legal obligations, and documented organizational policies.

Upon termination of services, PHI must be handled according to applicable Business Associate Agreement requirements, including return or destruction where feasible and continued protection where required.

12. Business Associate Agreements

Cronic Care recognizes that Business Associate Agreements are an important component of HIPAA-regulated healthcare technology relationships.

Where required, a BAA between Cronic Care and a healthcare organization establishes responsibilities relating to:

• Permitted uses and disclosures of PHI.
• Appropriate protection of sensitive information.
• Security incident and breach reporting.
• Subcontractor obligations.
• Assistance with applicable individual privacy rights.
• Return or destruction of PHI following termination.
• Other obligations required by HIPAA.

Where subcontractors create, receive, maintain, or transmit PHI on Cronic Care’s behalf, applicable HIPAA requirements and contractual protections must also be addressed.

13. Data Sharing and Authorized Disclosures

Cronic Care processes clinical information to provide services to authorized healthcare organizations.

PHI may be disclosed only as permitted or required by applicable law and governing agreements.

Potential authorized disclosures may include:

• Healthcare professionals associated with the authorized organization.
• Approved personnel supporting clinical workflows.
• Contracted service providers operating under applicable safeguards.
• Disclosures required by law or valid legal process.

Cronic Care does not authorize unrestricted access to patient information.

Use or disclosure of PHI for unrelated commercial purposes is not permitted unless an appropriate legal basis and any required authorization exist.

14. Security Monitoring and Auditability

Monitoring and auditability support the protection of clinical information and the accountability of authorized users.

Cronic Care’s platform architecture supports workflow records relating to authentication, clinical processing, documentation review, and physician approval.

A comprehensive security program should also address:

• Access monitoring.
• Unauthorized access detection.
• Security event review.
• Audit record protection.
• Investigation of suspicious activity.
• Documentation of corrective actions.

Security monitoring must be maintained according to applicable legal requirements and organizational policies.

15. Security Incident Response and Breach Notification

Cronic Care recognizes the importance of identifying, investigating, containing, and responding to security incidents involving patient information.

An appropriate incident response program addresses:

• Identification and assessment of potential incidents.
• Containment and mitigation.
• Evaluation of affected systems and information.
• Investigation and documentation.
• Notification to affected healthcare organizations when required.
• Remediation and prevention of recurrence.

Where a breach of unsecured PHI occurs, Cronic Care must fulfill applicable notification obligations under HIPAA and its Business Associate Agreements.

Applicable legal and contractual deadlines govern notification requirements.

16. Healthcare Organization Responsibilities

Protecting patient information is a shared responsibility between Cronic Care and its healthcare organization customers.

Healthcare organizations are responsible for:

• Authorizing appropriate personnel.
• Maintaining accurate provider and clinic account information.
• Ensuring lawful submission of patient information.
• Establishing internal clinical documentation policies.
• Reviewing and approving AI-generated clinical documentation.
• Managing patient treatment decisions.
• Protecting user credentials and connected devices.
• Complying with applicable patient privacy and medical record obligations.

Cronic Care provides technology capabilities intended to support these responsibilities.

17. Patient Privacy Rights

Patients may have rights under HIPAA and other applicable laws concerning their protected health information.

These may include rights to:

• Request access to certain medical information.
• Request corrections or amendments.
• Request restrictions on certain uses or disclosures.
• Receive information concerning certain disclosures.
• Submit privacy-related complaints.

Healthcare organizations generally manage these requests for the medical records they maintain.

When Cronic Care acts as a business associate, it will support applicable requests according to governing agreements and legal requirements.

18. Clinical Research and Patient Information

ResearchInsights supports documentation workflows associated with authorized clinical research activities.

Clinical research information may be subject to additional requirements, including institutional review board oversight, research authorizations, informed consent requirements, and applicable privacy protections.

Healthcare organizations and research sponsors remain responsible for ensuring that research activities have the necessary approvals and legal authority.

Cronic Care’s documentation capabilities do not replace research governance, regulatory oversight, or investigator responsibilities.

19. Continuous Security and Privacy Improvement

Healthcare technology, cybersecurity risks, and regulatory expectations continue to evolve.

Cronic Care is committed to improving its approach to information protection through ongoing evaluation of its platform architecture, security practices, and operational procedures.

This includes consideration of:

• Emerging security threats.
• Cloud infrastructure changes.
• Clinical workflow requirements.
• AI-related privacy risks.
• Access control improvements.
• Relevant regulatory developments.
• Feedback from healthcare organizations and authorized users.

Security and privacy protection require ongoing attention rather than a one-time implementation.

20. Contact and Privacy Inquiries

Healthcare organizations, authorized users, and other interested parties may contact Cronic Care regarding questions about privacy, data protection, or its clinical information workflows.

Cronic Care, Inc.
Fresno, California, United States
Website: https://cronic.care
Privacy and Security Contact: privacy@cronic.care

For requests involving medical records, patients should generally contact their healthcare provider directly.