1. Introduction

Cronic Care, Inc. (“Cronic Care,” “Company,” “we,” “us,” or “our”) recognizes the importance of protecting clinical information throughout its lifecycle, from initial collection and processing through retention, archival, return, and secure deletion.

Cronic Care develops an AI-Native Clinical Intelligence Platform designed to transform authorized patient encounters and clinical information into physician-ready documentation and actionable clinical intelligence.

The platform may process patient encounter recordings, transcripts, AI-generated clinical documentation, physician-approved SOAP notes, clinical intelligence reports, research documentation, and related operational information.

This Data Retention & Deletion Policy (“Policy”) describes Cronic Care’s approach to managing the lifecycle of information processed through its website and clinical platform.

Cronic Care’s guiding principle is to retain information only for authorized purposes and applicable retention periods, and to securely delete, return, or de-identify information when appropriate and legally permitted.

This Policy is subject to Cronic Care’s actual technical capabilities, applicable laws, contractual obligations, and authorized customer instructions.

2. Purpose of This Policy

This Policy is intended to explain:

• The categories of information Cronic Care may collect, process, and store.
• The purposes for which information may be retained.
• How retention periods are established.
• The distinction between temporary processing data and finalized clinical records.
• The responsibilities of healthcare organizations and Cronic Care.
• How authorized deletion requests are handled.
• How information may be returned or exported.
• How backup and archived information is managed.
• How security, audit, and operational records are retained.
• How applicable privacy and healthcare regulations affect retention and deletion.

This Policy does not establish a single universal retention period for all categories of information.

3. Scope and Applicability

This Policy applies to information processed in connection with:

• The Cronic Care public website.
• Authorized clinic and provider accounts.
• Patient encounter processing.
• Audio recordings and clinical transcription.
• AI-assisted clinical documentation.
• Physician review, editing, and approval.
• CareInsights™ clinical intelligence workflows.
• AI agent processing and report recommendations.
• Clinical intelligence reports.
• ResearchInsights clinical research documentation.
• Administrative and security operations.
• Customer support and technical services.
• Other authorized services provided by Cronic Care.

The Policy applies to personal information, Protected Health Information (PHI), clinical documentation, system records, and other information within its scope.

Different categories of information may be governed by different legal, contractual, and operational retention requirements.

4. Relationship to Healthcare Organizations

Cronic Care generally provides technology services to healthcare organizations and authorized healthcare professionals.

Depending on the circumstances, a healthcare organization may act as the HIPAA Covered Entity or another legally responsible healthcare data custodian, while Cronic Care may act as its Business Associate or service provider.

Healthcare organizations generally determine the purposes for which patient information is processed and their own obligations to maintain patient medical records.

Cronic Care processes information according to applicable service agreements, Business Associate Agreements, authorized instructions, and legal requirements.

Healthcare organizations remain responsible for their medical record retention obligations. Cronic Care remains responsible for the retention, protection, return, and disposal obligations applicable to its own role.

The allocation of responsibilities may differ depending on the customer relationship and applicable law.

5. Categories of Information

Cronic Care may process the following categories of information, depending on the Services used.

5.1 Patient Encounter Information

Information relating to authorized patient visits, including encounter identifiers, visit dates, and other clinical context.

5.2 Audio Recordings

Audio captured during authorized patient-physician encounters for transcription or clinical documentation processing.

5.3 Clinical Transcripts

Text generated from encounter recordings or other authorized transcription inputs.

5.4 AI-Generated Clinical Documentation

Draft SOAP notes, Assessment & Plan information, coding suggestions, and other AI-generated clinical content.

5.5 Physician-Approved Documentation

Clinical documentation reviewed and approved by an authorized physician or other permitted healthcare professional.

5.6 Clinical Intelligence Information

Clinical context records, extracted findings, report recommendations, generated reports, and related CareInsights™ outputs.

5.7 Clinical Research Documentation

Authorized research visit information, protocol-related documentation, and ResearchInsights outputs.

5.8 Provider and Organization Information

Clinic account information, provider identities, professional credentials, contact information, and account permissions.

5.9 Authentication and Security Information

Authentication identifiers, access records, security events, and related technical information.

5.10 Administrative and Operational Information

Subscription records, support communications, billing information, technical logs, and service administration records.

6. Data Lifecycle Management

Cronic Care’s information lifecycle may include:

1. Authorized collection or receipt.
2. Secure transmission.
3. Temporary processing.
4. AI-assisted analysis.
5. Documentation generation.
6. Physician review and approval.
7. Clinical intelligence processing.
8. Authorized report generation.
9. Storage and permitted access.
10. Retention or archival.
11. Return, export, deletion, or de-identification.

Not every category of information passes through every stage.

Retention and deletion requirements may differ by data category and workflow.

7. General Retention Principles

Cronic Care’s intended retention framework is guided by the following principles:

• Purpose Limitation: Information should be retained for legitimate, authorized purposes.
• Data Minimization: Information should not be retained unnecessarily.
• Contractual Compliance: Retention must reflect applicable customer agreements and Business Associate Agreements.
• Legal Compliance: Applicable laws, preservation obligations, and regulatory requirements must be considered.
• Security: Retained information should be protected against unauthorized access, alteration, or disclosure.
• Lifecycle Accountability: Information should be subject to appropriate retention and disposition controls.
• Secure Disposal: Information that is no longer required should be securely deleted or otherwise disposed of when appropriate.

These principles require supporting technical and administrative procedures to be effective.

8. Retention Period Determination

Retention periods may be determined by:

• The category of information.
• The purpose for which information was collected.
• Applicable customer instructions.
• Service agreements.
• Business Associate Agreements.
• Healthcare recordkeeping requirements.
• Research requirements.
• Applicable privacy and security laws.
• Security and operational needs.
• Litigation holds or preservation obligations.
• Technical backup and recovery arrangements.

Cronic Care does not represent that every category of information is retained for the same duration.

Specific retention schedules should be documented in applicable agreements, internal procedures, or service-specific disclosures.

9. Patient Encounter Audio Recordings

Cronic Care may process authorized encounter audio for transcription and clinical documentation generation.

Audio recordings may contain sensitive patient information and must be handled under applicable privacy, security, and contractual requirements.

Retention of encounter audio should be limited to authorized processing, quality review, troubleshooting, or other permitted purposes.

Where temporary audio storage is used, Cronic Care should establish defined retention and deletion controls.

Audio should not be retained indefinitely merely because it was used to generate clinical documentation.

Healthcare organizations are responsible for obtaining legally required recording notices and consents.

Deletion of an audio recording does not necessarily require deletion of authorized clinical documentation generated from that recording.

The applicable treatment of recordings depends on customer agreements, retention settings, and legal obligations.

10. Clinical Transcripts

Clinical transcripts may be generated from authorized audio recordings.

Transcripts may be retained temporarily or for other authorized purposes, depending on the workflow.

Transcripts can contain PHI and must be protected accordingly.

Cronic Care should establish appropriate retention periods for transcripts based on their operational purpose and applicable customer instructions.

Where a transcript is no longer needed and no applicable obligation requires its preservation, it should be eligible for secure deletion under established procedures.

Deleting a transcript does not automatically delete physician-approved clinical documentation derived from it.

11. AI-Generated Draft Documentation

Cronic Care may generate draft clinical documentation before physician review.

Draft information may include:

• SOAP notes.
• Assessment & Plan content.
• ICD-10 suggestions.
• Extracted clinical findings.
• Documentation summaries.
• Intermediate processing results.

Draft documentation may contain inaccuracies or incomplete information.

Retention should reflect the need to support authorized review, editing, troubleshooting, version management, and applicable legal obligations.

Cronic Care should distinguish draft documentation from physician-approved records where supported by the system.

Draft information should not be retained indefinitely without an authorized purpose.

12. Physician-Approved Clinical Documentation

Physician-approved documentation may represent a finalized output of an authorized clinical documentation workflow.

Depending on the system configuration, Cronic Care may maintain:

• Approved SOAP notes.
• Approved documentation versions.
• Approval status.
• Approval timestamps.
• Authorized approving user identifiers.
• Documentation references.
• Related audit information.

Approved documentation may be subject to longer retention requirements than temporary audio or intermediate processing data.

The healthcare organization remains responsible for determining the applicable retention obligations for its official medical records.

Physician approval within Cronic Care does not necessarily mean the documentation has been incorporated into the healthcare organization’s designated Electronic Medical Record (EMR).

Healthcare organizations should ensure that finalized documentation is appropriately transferred, stored, and retained within their required medical record systems.

13. Documentation Versioning and Superseded Records

Cronic Care may maintain different versions of clinical documentation.

For example, a physician may edit an AI-generated SOAP note before approval.

Depending on the workflow, an original draft may be marked as superseded while an edited version becomes the approved documentation.

Retention of superseded versions should be governed by authorized operational needs, audit requirements, applicable agreements, and legal obligations.

Superseded information should not be treated as the current approved clinical record.

Deletion or disposition of prior versions must account for any applicable record integrity or preservation requirements.

14. Physician Approval and Audit Records

Cronic Care may maintain approval-related information to support accountability and documentation integrity.

Such information may include:

• Encounter identifiers.
• Approval status.
• Approval dates and times.
• Authorized physician identifiers.
• Documentation version references.
• Edit indicators.
• Related workflow records.

Audit and approval information may need to be retained separately from the underlying documentation.

Deletion of clinical content does not automatically require deletion of every associated audit or security record.

Any continued retention must have an appropriate legal, contractual, or operational basis.

15. CareInsights™ Clinical Context Information

CareInsights™ may analyze physician-approved documentation and other authorized information to generate structured clinical context.

Clinical context records may include:

• Active conditions.
• Historical conditions.
• Symptoms.
• Medications.
• Diagnostic findings.
• Orders.
• Referrals.
• Follow-up information.
• Clinical domains.

These records may contain PHI.

Retention should be based on the purpose of the clinical intelligence workflow, authorized access requirements, and applicable agreements.

Clinical context records should not be retained indefinitely solely because they were created through automated processing.

16. AI Agent Processing Information

Cronic Care may use AI agents to perform defined clinical information processing tasks.

These tasks may create intermediate records such as:

• Processing status.
• Clinical context summaries.
• Report recommendations.
• Workflow identifiers.
• Report generation requests.
• Processing errors.
• Technical execution records.

Some intermediate records may contain PHI or information that can be associated with a patient encounter.

Retention should be appropriate to the sensitivity and purpose of the information.

Cronic Care should distinguish operational metadata from clinical content when establishing retention requirements.

17. Report Recommendations

CareInsights™ may generate recommendations identifying potentially relevant clinical intelligence reports.

Recommendation records may include:

• Encounter references.
• Recommended report types.
• Reasons for recommendations.
• Recommendation status.
• Physician selection information.
• Processing timestamps.

Such information may be retained to support authorized reporting workflows and operational traceability.

Retention periods should be defined according to applicable agreements and internal procedures.

18. Generated Clinical Intelligence Reports

Cronic Care may generate clinical intelligence reports from authorized clinical information.

Reports may include:

• Patient Visit Insights.
• Diagnostic Reports.
• Integrated Clinical Summaries.
• Patient-Friendly Reports.
• Specialty-Specific Reports.
• Disease-Specific Reports.
• Follow-Up and Care Action Reports.
• Revenue-Cycle Documentation Support.

These reports may contain PHI and other sensitive information.

Retention may depend on whether the report is a temporary processing output, an approved clinical document, or a record required by the healthcare organization.

Generated reports should not automatically be treated as the organization’s official medical record unless adopted into its authorized recordkeeping workflow.

19. Longitudinal Clinical Information

Cronic Care may process information spanning multiple patient encounters or clinical documents.

Longitudinal information may include:

• Historical diagnoses.
• Medication history.
• Diagnostic trends.
• Prior procedures.
• Changes in clinical conditions.
• Follow-up history.

Retention of longitudinal information should be governed by authorized purposes and applicable agreements.

Cronic Care should not assume that information from prior encounters may be retained or reused without appropriate authorization.

20. ResearchInsights and Clinical Research Data

ResearchInsights may process information associated with authorized clinical research activities.

Research information may be subject to:

• Research protocols.
• Sponsor agreements.
• Investigator obligations.
• Institutional Review Board requirements.
• Informed consent.
• Applicable research regulations.
• Record preservation requirements.

Research retention periods may differ substantially from ordinary clinical documentation retention.

Cronic Care should follow applicable contractual and legal requirements when retaining, returning, or deleting research information.

Research data subject to mandatory preservation requirements must not be deleted solely because a general account deletion request is received.

21. Provider and Clinic Account Information

Cronic Care may retain information necessary to administer authorized healthcare organization accounts.

Such information may include:

• Clinic identifiers.
• Organization names.
• Provider names.
• Professional credentials.
• NPI information.
• License information.
• Business contact information.
• Account status.
• User roles and permissions.

Retention may continue while an account remains active and for an appropriate period afterward where required for contractual, legal, security, or administrative purposes.

Account deactivation does not necessarily require immediate deletion of all associated records.

22. Authentication Information

Cronic Care may use authentication technologies to control access to restricted platform functions.

Authentication information may include:

• User identifiers.
• Authentication-related metadata.
• Session information.
• Access permissions.
• Account status.
• Security events.

Authentication credentials and tokens should be subject to appropriate expiration, revocation, and security controls.

Cronic Care should avoid retaining authentication secrets longer than necessary.

Account termination should include appropriate access revocation procedures.

23. Security Logs and Audit Trails

Cronic Care may retain security and operational logs for authorized purposes.

Such purposes may include:

• Detecting unauthorized access.
• Investigating suspicious activity.
• Troubleshooting errors.
• Supporting security reviews.
• Meeting applicable compliance obligations.
• Investigating incidents.
• Maintaining system integrity.

Security logs should be protected against unauthorized access and alteration.

Retention periods should reflect applicable legal, contractual, and operational requirements.

Logs should not unnecessarily contain full clinical records, authentication secrets, or sensitive patient information.

24. Website and Cookie Information

The Cronic Care public website may process information associated with cookies, browser storage, analytics, and website functionality.

Retention depends on the specific technologies implemented.

Relevant information may include:

• Website preferences.
• Session identifiers.
• Technical diagnostics.
• Consent records.
• Website interaction information.

Further details are provided in Cronic Care’s Cookie Policy and Privacy Policy.

Website information should not automatically be subject to the same retention schedule as clinical records.

25. Customer Communications and Support Records

Cronic Care may retain business communications and support records for legitimate operational purposes.

Such records may include:

• Support requests.
• Technical issue descriptions.
• Customer correspondence.
• Account inquiries.
• Service-related communications.
• Contract administration information.

Support channels should not be used to transmit PHI unless appropriately authorized and secured.

Retention may depend on the nature of the communication, contractual requirements, and applicable laws.

26. Subscription, Billing, and Financial Records

Cronic Care may retain subscription, billing, payment, and financial information for legitimate business purposes.

Such records may be subject to accounting, tax, contractual, and other legal requirements.

Financial record retention may continue after the related subscription or account ends.

Deletion requests may be limited where information must be retained to comply with applicable legal obligations.

27. Cloud Infrastructure and Data Storage

Cronic Care uses cloud-based infrastructure to support its platform.

Depending on the service and configuration, information may be processed or stored using Amazon Web Services technologies, including:

• Amazon Simple Storage Service (Amazon S3).
• Amazon DynamoDB.
• AWS Lambda.
• Amazon Cognito.
• Other authorized infrastructure services.

Different services may store different categories of information.

Deleting information from one service does not necessarily delete copies or related records stored in other services.

Cronic Care should maintain appropriate data inventories and deletion procedures covering relevant storage locations.

28. Storage Separation and Data Classification

Cronic Care should classify information according to its sensitivity, purpose, and applicable obligations.

Relevant categories may include:

• Temporary processing information.
• Clinical source information.
• Draft documentation.
• Physician-approved documentation.
• Clinical intelligence outputs.
• Operational metadata.
• Authentication information.
• Security logs.
• Financial records.

Retention and deletion controls should account for these distinctions.

Information containing PHI requires appropriate privacy and security safeguards.

29. Backups and Disaster Recovery Copies

Cronic Care may maintain backup or recovery copies of information to support business continuity and system restoration.

Backup copies may not be immediately modified when information is deleted from active systems.

Where deletion from backups cannot be performed immediately, information should remain protected and subject to defined backup expiration or disposition procedures.

Restoration procedures should account for deletion requests and prevent previously deleted information from being improperly reintroduced into active use.

Cronic Care should not promise immediate deletion from all backups unless that capability has been verified.

Backup retention periods should be documented and periodically reviewed.

30. Archived Information

Certain information may be moved to archival storage for authorized purposes.

Archival retention may be appropriate for:

• Legal preservation.
• Contractual obligations.
• Research requirements.
• Security investigations.
• Operational continuity.
• Other legitimate purposes.

Archived information should remain subject to appropriate access restrictions and security controls.

Archival status does not eliminate privacy or deletion obligations.

31. Data Minimization

Cronic Care should collect and retain only information reasonably necessary for authorized purposes.

Data minimization may include:

• Limiting unnecessary audio retention.
• Reducing temporary processing copies.
• Restricting sensitive information in logs.
• Avoiding duplicate clinical records where unnecessary.
• Applying appropriate retention settings.
• Reviewing unused data.
• Limiting third-party access.

Data minimization supports privacy, security, and efficient system operations.

32. Secure Deletion Principles

Secure deletion is intended to reduce the risk that information remains accessible after its authorized retention period ends.

Depending on the system, deletion may involve:

• Removing active database records.
• Deleting stored files or objects.
• Expiring temporary information.
• Revoking access.
• Deleting eligible document versions.
• Removing related processing records.
• Applying approved cryptographic deletion methods where appropriate.
• Allowing protected backups to expire under established procedures.

Deletion methods should be appropriate to the storage technology and sensitivity of the information.

33. Deletion of Audio Recordings

Audio recordings may be eligible for deletion after their authorized processing and retention purposes have been satisfied.

Before deletion, Cronic Care should consider:

• Whether transcription has completed.
• Whether required processing has completed.
• Whether customer instructions require retention.
• Whether a legal hold applies.
• Whether an authorized quality review remains pending.
• Whether applicable law requires preservation.

Deletion of an audio file should not be assumed to delete associated transcripts, documentation, or reports.

34. Deletion of Transcripts

Transcripts may be deleted according to applicable retention schedules and authorized instructions.

Deletion procedures should account for copies maintained in active storage, processing systems, and other relevant locations.

Where transcripts are retained for a permitted purpose, access should remain appropriately restricted.

Deletion of transcripts does not necessarily affect finalized clinical records derived from them.

35. Deletion of Draft and Superseded Documentation

Draft or superseded clinical documentation may be subject to deletion or archival according to applicable recordkeeping and audit requirements.

Deletion should not compromise required documentation integrity, version history, or legal preservation obligations.

Healthcare organizations should determine whether particular draft or superseded records must be preserved under their applicable policies and laws.

36. Deletion of Physician-Approved Documentation

Physician-approved documentation may be subject to medical record retention requirements.

Cronic Care should not automatically delete approved documentation without considering applicable agreements, customer instructions, and legal obligations.

Where approved documentation is eligible for deletion, the process should account for associated storage objects, metadata, and applicable audit requirements.

Healthcare organizations remain responsible for maintaining required official medical records.

37. Deletion of Clinical Intelligence Reports

Clinical intelligence reports may be deleted according to applicable retention schedules, authorized instructions, and legal requirements.

Deletion may need to account for:

• Report files.
• Structured report data.
• Processing metadata.
• Report recommendations.
• Related clinical context.
• Associated storage references.

Deletion of one report does not necessarily delete the source documentation from which it was generated.

38. Data Return and Export

Healthcare organizations may require access to or return of their information when a service relationship ends.

Depending on applicable agreements and technical capabilities, Cronic Care may support authorized export or return of information in available formats.

Such formats may include documents or structured data.

The scope, format, timing, and method of data return should be established through applicable customer agreements.

Cronic Care should verify the identity and authority of parties requesting data exports.

Data return does not necessarily constitute deletion of all remaining copies.

39. Account Deactivation

Account deactivation may prevent a user from accessing Cronic Care Services without immediately deleting all associated information.

Deactivation may be appropriate when:

• A provider leaves an organization.
• A clinic administrator changes access permissions.
• An account is suspended.
• A subscription expires.
• Security concerns require access restrictions.

Account deactivation and data deletion are separate operations.

Retained information remains subject to applicable security and privacy obligations.

40. Customer Account Termination

When a healthcare organization’s service relationship with Cronic Care ends, applicable agreements should govern:

• Termination of user access.
• Data export or return.
• Retention of required records.
• Deletion of eligible customer information.
• Treatment of backups.
• Handling of outstanding legal obligations.
• Applicable transition assistance.

Cronic Care should not delete information in a manner that conflicts with applicable legal preservation requirements or governing agreements.

41. Deletion Requests From Healthcare Organizations

Authorized healthcare organizations may request deletion of information under applicable agreements.

Requests should identify, as appropriate:

• The requesting organization.
• Authorized requesting representative.
• Relevant account or clinic.
• Categories of information.
• Relevant patients or encounters, where necessary.
• Requested scope of deletion.
• Any applicable contractual requirements.

Cronic Care may need to verify authority before processing the request.

Deletion may be limited by legal, contractual, security, or preservation obligations.

42. Patient Requests for Deletion

Patients may have privacy rights under applicable law.

However, Cronic Care may process PHI on behalf of a healthcare organization rather than directly controlling the patient’s official medical record.

Where appropriate, patients seeking access, correction, or deletion of medical information should contact their healthcare provider or the organization responsible for the record.

Cronic Care may refer relevant requests to the responsible healthcare organization or assist with requests as required by applicable law and agreements.

A patient’s request does not automatically require deletion of medical records that a healthcare organization is legally required or permitted to retain.

43. California Privacy Rights

California residents may have certain rights regarding personal information under applicable California privacy laws.

Depending on Cronic Care’s legal status and the information involved, these may include rights to:

• Know about certain information practices.
• Access personal information.
• Request deletion.
• Request correction.
• Exercise applicable opt-out rights.

Certain information regulated under HIPAA may be exempt from specific provisions of California consumer privacy law.

Other website, employment, business contact, or operational information may be subject to different requirements.

Cronic Care should evaluate each request according to applicable law and its role in processing the information.

44. HIPAA and Data Retention

HIPAA establishes requirements relating to the privacy, security, and availability of PHI.

HIPAA does not impose a single universal retention period for all patient medical records.

Medical record retention requirements may arise from state law, federal program requirements, professional obligations, contractual arrangements, or other applicable rules.

HIPAA does require certain policies, procedures, and other compliance documentation to be retained for specified periods.

Cronic Care must distinguish medical record retention requirements from HIPAA administrative documentation retention requirements.

45. Business Associate Agreement Requirements

Where Cronic Care acts as a Business Associate, applicable Business Associate Agreements may govern the return, retention, and destruction of PHI.

Upon termination, an agreement may require Cronic Care to return or destroy PHI where feasible, subject to applicable legal and contractual provisions.

Where return or destruction is infeasible, applicable safeguards and restrictions may continue to apply.

This Policy does not override any applicable Business Associate Agreement.

46. Legal Holds and Preservation Obligations

Cronic Care may be required to preserve certain information in connection with:

• Litigation.
• Regulatory investigations.
• Subpoenas.
• Court orders.
• Security investigations.
• Government inquiries.
• Other legally required preservation activities.

Information subject to a valid legal hold may be retained beyond its ordinary retention period.

Deletion may resume when the applicable preservation obligation ends and no other retention requirement applies.

47. Security Incident Investigations

Information relevant to a security incident may need to be preserved for investigation, remediation, reporting, or legal compliance.

Such information may include:

• Security logs.
• Access records.
• Technical evidence.
• Incident communications.
• Relevant system metadata.

Preservation should be limited to authorized purposes and subject to appropriate security controls.

Incident-related retention may differ from routine operational retention.

48. Third-Party Service Providers and Subprocessors

Cronic Care may use authorized third-party providers to support hosting, transcription, AI processing, authentication, and other Services.

Where third parties process information on Cronic Care’s behalf, relevant agreements should address appropriate privacy, security, retention, and deletion responsibilities.

Cronic Care should evaluate how third-party retention practices affect its contractual and legal obligations.

Deletion of information from Cronic Care-controlled storage does not automatically establish that every third-party copy has been deleted.

Appropriate vendor procedures and contractual protections may be required.

49. AI Model Training and Secondary Data Use

Retention of clinical information for service delivery does not independently authorize use of that information for AI model training or unrelated secondary purposes.

Any such use must have an appropriate legal and contractual basis.

Cronic Care should distinguish information retained for:

• Clinical documentation processing.
• Authorized reporting.
• Security and troubleshooting.
• Permitted evaluation.
• AI model improvement.
• Other secondary purposes.

Where applicable, restrictions under HIPAA, Business Associate Agreements, and customer contracts govern these activities.

50. De-Identification and Aggregated Information

Cronic Care may process de-identified or aggregated information where permitted by applicable law and agreements.

De-identification of PHI must satisfy applicable HIPAA requirements when those requirements apply.

Removing a patient’s name alone does not necessarily make information de-identified.

Information that has been appropriately de-identified may be subject to different legal requirements from identifiable PHI.

Any continued retention or use must remain consistent with applicable contractual restrictions.

51. Data Portability and Interoperability

Cronic Care is designed to support clinical documentation workflows alongside healthcare organizations’ existing systems.

Depending on the enabled capabilities, authorized outputs may be available in document or structured formats.

Data portability should support healthcare organizations’ ability to manage their information without creating unnecessary dependence on a single technology provider.

The available export formats and related service commitments should be defined through applicable agreements and product capabilities.

52. Verification of Deletion

Where appropriate, Cronic Care should maintain procedures for verifying that authorized deletion actions have been completed.

Verification may include:

• Confirming deletion from designated active storage.
• Checking relevant database records.
• Reviewing deletion processing results.
• Recording completion status.
• Identifying exceptions.
• Documenting outstanding backup expiration or legal preservation obligations.

Verification methods depend on the storage systems and deletion capabilities involved.

A deletion confirmation should accurately describe the scope of deletion performed and any remaining limitations.

53. Deletion Audit Records

Cronic Care may maintain limited records of authorized deletion activities.

Such records may include:

• Request identifiers.
• Request dates.
• Authorized requester information.
• Data categories involved.
• Processing status.
• Completion dates.
• Exceptions.
• Relevant approval information.

Deletion audit records should avoid unnecessarily reproducing the deleted clinical content.

Their retention should be limited to legitimate compliance, security, and operational purposes.

54. Exceptions to Deletion

Cronic Care may be required or permitted to retain certain information despite a deletion request.

Examples may include:

• Legal preservation obligations.
• Medical record retention requirements.
• Research recordkeeping requirements.
• Contractual obligations.
• Security investigations.
• Fraud prevention.
• Financial record retention.
• Regulatory compliance.
• Protected backup copies pending expiration.
• Other legally permitted or required purposes.

Any exception should be evaluated according to applicable law, agreements, and the nature of the information.

55. Data Retention Schedule

Cronic Care should maintain a documented retention schedule for information processed through its Services.

The schedule should identify the data category, purpose, retention trigger, retention period, storage location, and approved disposition method.

The following framework identifies categories requiring defined retention rules.

Specific time periods must be established and verified before Cronic Care represents this schedule as an implemented operational commitment.

56. Data Retention Responsibilities

Cronic Care and its healthcare customers may have different responsibilities.

Cronic Care Responsibilities

• Implementing contractual retention and deletion obligations.
• Protecting retained information.
• Managing access to information within its systems.
• Supporting authorized return or export.
• Processing valid deletion instructions.
• Maintaining appropriate operational records.
• Managing applicable third-party obligations.

Healthcare Organization Responsibilities

• Determining medical record retention requirements.
• Obtaining required patient consents.
• Establishing authorized data processing purposes.
• Maintaining official patient medical records.
• Submitting authorized deletion instructions.
• Preserving records required by law.
• Managing access by clinical personnel.

Responsibilities are subject to applicable agreements and law.

57. Internal Policies and Procedures

Cronic Care should maintain internal procedures supporting this Policy.

These may include:

• Data inventory management.
• Retention schedule administration.
• Access control.
• Secure deletion procedures.
• Backup lifecycle management.
• Customer termination processing.
• Legal hold procedures.
• Vendor management.
• Incident response.
• Audit record maintenance.
• Periodic compliance reviews.

Public disclosure of this Policy does not establish that every described procedure has already been implemented.

Operational practices must be verified and maintained separately.

58. Periodic Review and Improvement

Cronic Care should periodically review its retention and deletion practices.

Reviews may consider:

• Changes in applicable law.
• Changes in customer agreements.
• New clinical capabilities.
• Changes in AWS infrastructure.
• New AI agents.
• Additional reporting functions.
• Updated security requirements.
• Changes in backup technology.
• New research requirements.
• Identified operational risks.

Policies and procedures should be updated when necessary.

59. Changes to This Policy

Cronic Care may update this Policy to reflect changes in its Services, information processing practices, applicable laws, contractual requirements, or technical capabilities.

Material changes may require corresponding updates to customer agreements, internal procedures, or other privacy disclosures.

The revised Policy will be published with an updated effective date.

Where legally or contractually required, additional notice will be provided.

60. Relationship to Other Policies and Agreements

This Policy supplements:

• Privacy Policy.
• Terms of Use.
• Cookie Policy.
• HIPAA & Patient Data Protection information.
• AI Transparency & Clinical Responsibility Policy.
• Applicable Business Associate Agreements.
• Master Services Agreements.
• Clinical Evaluation Agreements.
• Other applicable customer agreements.

In the event of a conflict, applicable law and controlling contractual provisions govern.

Nothing in this Policy limits rights or obligations that cannot lawfully be waived.

61. Contact Information

For questions about data retention, deletion, information return, or privacy practices, contact:

Cronic Care, Inc.
Fresno, California, United States
Website: https://cronic.care
Email: privacy@cronic.care

Healthcare organizations should submit requests involving PHI through an authorized, appropriately secured communication channel.

Patients seeking access to or changes in their medical records should generally contact the healthcare organization responsible for those records.