1. Introduction

Cronic Care, Inc. (“Cronic Care,” “Company,” “we,” “us,” or “our”) recognizes that the confidentiality, integrity, and availability of healthcare information are essential to responsible clinical technology.

Cronic Care develops an AI-Native Clinical Intelligence Platform designed to transform authorized patient encounters and clinical information into physician-ready documentation and actionable clinical intelligence.

Our Services may process sensitive information, including patient encounter recordings, clinical transcripts, AI-generated documentation, physician-approved SOAP notes, clinical intelligence reports, and related healthcare information.

This Security & Responsible Disclosure Policy (“Policy”) describes our approach to information security, the responsibilities of authorized users, and the procedures through which individuals may responsibly report potential security vulnerabilities.

Our security objective is to protect sensitive healthcare information, maintain appropriate access controls, support reliable clinical workflows, and encourage responsible reporting of potential security concerns.

Security is an ongoing process requiring appropriate technical safeguards, administrative procedures, organizational accountability, and continuous evaluation.

2. Purpose of This Policy

This Policy is intended to:

• Explain Cronic Care’s information security principles.
• Describe the categories of information requiring protection.
• Address security considerations associated with cloud infrastructure.
• Explain authentication and authorization objectives.
• Address security in clinical documentation and AI-assisted workflows.
• Describe vulnerability reporting procedures.
• Establish expectations for responsible security research.
• Explain how reported vulnerabilities may be evaluated and addressed.
• Describe incident response and notification principles.
• Clarify the responsibilities of Cronic Care, healthcare organizations, and third-party providers.

This Policy is not a substitute for applicable contracts, Business Associate Agreements, or internal information security procedures.

3. Scope and Applicability

This Policy applies, as relevant, to:

• The Cronic Care public website.
• Authorized clinic and provider accounts.
• Physician authentication and account administration.
• Patient encounter processing.
• Clinical audio recording and transcription.
• AI-generated clinical documentation.
• Physician review, editing, and approval.
• CareInsights™ clinical intelligence workflows.
• ResearchInsights documentation workflows.
• Clinical report generation and delivery.
• APIs and related application interfaces.
• Cloud-based storage and processing.
• Administrative and operational systems.
• Authorized third-party services supporting Cronic Care.

Security requirements may differ according to the sensitivity of information, technical environment, applicable agreements, and legal obligations.

4. Information Security Principles

Cronic Care’s security approach is guided by three foundational principles.

Confidentiality: Sensitive information should be accessible only to appropriately authorized individuals and systems.

Integrity: Information should be protected against unauthorized modification, corruption, or improper alteration.

Availability: Authorized users should have appropriate access to information and services necessary for supported workflows.

Additional principles include accountability, least privilege, data minimization, secure processing, appropriate monitoring, and timely evaluation of identified risks.

5. Protection of Healthcare Information

Cronic Care may process Protected Health Information (PHI) and other sensitive clinical information on behalf of authorized healthcare organizations.

Such information may include:

• Patient identifiers and encounter information.
• Patient-physician audio recordings.
• Clinical transcripts.
• Medical histories.
• Diagnoses and symptoms.
• Medication information.
• Diagnostic and laboratory findings.
• AI-generated clinical documentation.
• Physician-approved documentation.
• Clinical intelligence reports.
• Research-related clinical information.

Cronic Care seeks to apply appropriate safeguards to information according to its sensitivity, permitted purpose, and applicable legal and contractual requirements.

6. HIPAA and Healthcare Security Responsibilities

Depending on the applicable relationship, Cronic Care may act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA).

Where HIPAA applies, Cronic Care is responsible for satisfying the requirements applicable to its role, including relevant provisions of the HIPAA Security Rule and contractual obligations under applicable Business Associate Agreements.

Healthcare organizations retain their own obligations as Covered Entities or other legally responsible organizations.

HIPAA responsibilities are shared according to applicable law and agreements; the use of Cronic Care does not eliminate a healthcare organization’s independent compliance obligations.

Cronic Care does not represent that publication of this Policy alone establishes HIPAA compliance.

7. Security Governance

Cronic Care recognizes the importance of assigning responsibility for information security.

Appropriate governance activities may include:

• Identifying security responsibilities.
• Maintaining relevant security policies.
• Reviewing information security risks.
• Establishing incident escalation procedures.
• Managing authorized access.
• Evaluating third-party security dependencies.
• Reviewing security-related changes.
• Maintaining appropriate compliance documentation.

The specific governance processes implemented by Cronic Care should be documented internally and periodically reviewed.

8. Risk Assessment and Management

Information security risks may arise from technology, human activity, third-party dependencies, configuration errors, and evolving cybersecurity threats.

Cronic Care’s security management objectives include identifying, evaluating, prioritizing, and addressing relevant risks.

Risk considerations may include:

• Unauthorized access to PHI.
• Compromised provider credentials.
• Improper access between healthcare organizations.
• Application vulnerabilities.
• Cloud configuration errors.
• Insecure data transmission.
• Improper disclosure of clinical reports.
• Loss or corruption of documentation.
• Unauthorized changes to physician-approved records.
• Third-party service disruptions.

Where legally required, formal risk analysis and risk management activities must satisfy applicable requirements.

9. Cloud Infrastructure Security

Cronic Care uses cloud-based infrastructure to support clinical processing and platform operations.

Depending on the deployed configuration, relevant Amazon Web Services technologies may include:

• Amazon Simple Storage Service (Amazon S3).
• Amazon DynamoDB.
• AWS Lambda.
• Amazon API Gateway.
• Amazon Cognito.
• Amazon Simple Email Service.
• Amazon EventBridge.
• Other authorized AWS services.

Security responsibilities are shared between Cronic Care and its cloud providers according to the applicable service and deployment model.

Use of AWS does not automatically establish that an application or workflow is secure or HIPAA compliant.

Cronic Care remains responsible for appropriately configuring and managing the components within its control.

10. Infrastructure Configuration and Hardening

Secure configuration is an important component of cloud application security.

Relevant objectives may include:

• Restricting public access to sensitive storage.
• Managing cloud identity and access permissions.
• Protecting application configuration.
• Limiting unnecessary services and permissions.
• Reviewing API exposure.
• Maintaining appropriate logging.
• Managing software dependencies.
• Protecting application secrets.
• Reviewing infrastructure changes.

Specific controls should be implemented and verified according to the applicable architecture and risk assessment.

11. Identity and Authentication Security

Cronic Care uses restricted access for authorized clinical and administrative workflows.

Authentication may involve an identity provider, account credentials, authentication tokens, and related session controls.

Security objectives include:

• Verifying user identity.
• Restricting access to authorized accounts.
• Protecting authentication credentials.
• Managing session expiration.
• Supporting appropriate account revocation.
• Reducing unauthorized account access.

Authentication mechanisms and their configuration may evolve as the platform develops.

12. Authorization and Access Control

Authentication establishes user identity, while authorization determines what information and functions the user may access.

Cronic Care recognizes the importance of enforcing authorization within backend systems rather than relying solely on visible website controls.

Relevant access control considerations include:

• Clinic-level access restrictions.
• Provider-specific permissions.
• Administrative role limitations.
• Patient and encounter authorization.
• Protection of clinical reports.
• Restricted documentation approval functions.
• Prevention of unauthorized cross-organization access.

A valid sign-in session should not, by itself, authorize access to every patient, encounter, clinic, or report.

Authorization must be evaluated according to the relevant user, resource, and permitted action.

13. Least Privilege

Cronic Care seeks to apply the principle of least privilege.

Under this principle, users and systems should receive only the permissions necessary for their authorized functions.

Least privilege considerations may apply to:

• Physicians.
• Clinic administrators.
• Internal administrators.
• Application services.
• AWS identities and roles.
• Automated processing components.
• Third-party service integrations.

Permissions should be reviewed and adjusted as responsibilities change.

14. Provider and Clinic Account Security

Cronic Care may maintain information about authorized clinics, providers, and administrative users.

Account security considerations include:

• Verification of authorized clinic participation.
• Appropriate provider account provisioning.
• Role-based permissions.
• Protection of professional account information.
• Controlled account updates.
• Timely access revocation.
• Appropriate handling of inactive accounts.

Healthcare organizations are responsible for informing Cronic Care of relevant changes when required by applicable agreements and procedures.

15. Session and Token Security

Certain Cronic Care interfaces may use authentication tokens or session-based access.

Security considerations include:

• Token expiration.
• Appropriate token validation.
• Secure transmission.
• Protection against unauthorized disclosure.
• Appropriate session termination.
• Prevention of unauthorized token reuse.
• Management of compromised sessions.

Client-side storage and authentication behavior should be evaluated according to the sensitivity of the application and current security guidance.

16. API Security

Cronic Care may use application programming interfaces (APIs) to support documentation, account administration, clinical intelligence, and reporting workflows.

API security objectives include:

• Appropriate authentication.
• Resource-level authorization.
• Input validation.
• Secure request handling.
• Restricted access to sensitive operations.
• Appropriate error handling.
• Prevention of unintended information disclosure.
• Logging of relevant security events.

Security checks should be enforced by the responsible backend services.

17. Clinical Data Transmission

Cronic Care may transmit information between authorized users, application interfaces, cloud services, and approved processing components.

Appropriate transmission safeguards should be applied according to the sensitivity of the information and applicable requirements.

Security objectives include protecting information against unauthorized interception, modification, and disclosure.

Transmission security must be assessed across the entire workflow, including external services and document delivery methods.

18. Encryption and Data Protection

Encryption can help protect sensitive information during transmission and storage.

Cronic Care seeks to use appropriate encryption and key management safeguards for sensitive information.

Encryption requirements may differ by service, data category, and applicable agreement.

Relevant considerations include:

• Encryption during transmission.
• Encryption of stored sensitive information.
• Appropriate key management.
• Restricted access to encryption-related resources.
• Secure handling of credentials and secrets.

Cronic Care should not represent that all information is encrypted in every location unless the relevant storage, processing, and delivery paths have been verified.

19. Patient Encounter Audio Security

Patient encounter recordings may contain sensitive PHI.

Security considerations include:

• Authorized recording.
• Secure upload and transmission.
• Restricted storage access.
• Authorized transcription processing.
• Appropriate retention periods.
• Secure deletion when required.
• Prevention of unauthorized audio disclosure.

Healthcare organizations remain responsible for obtaining required patient recording notices and consents.

20. Clinical Transcription Security

Cronic Care may use authorized transcription services to convert clinical audio into text.

Transcripts may contain sensitive medical information.

Relevant safeguards include controlling access, protecting transmission and storage, and limiting use to authorized purposes.

Transcription service arrangements should be evaluated for applicable privacy, security, and contractual requirements.

21. AI Processing Security

Cronic Care may use AI technologies to process authorized clinical information.

AI-related security considerations include:

• Protection of sensitive inputs.
• Authorized processing purposes.
• Appropriate handling of generated outputs.
• Restriction of unnecessary data disclosure.
• Evaluation of third-party AI services.
• Protection against unauthorized workflow manipulation.
• Review of applicable retention and secondary-use restrictions.

The use of AI does not eliminate traditional information security responsibilities.

22. Prompt Injection and AI Workflow Manipulation

AI-assisted workflows may encounter malicious, misleading, or unauthorized instructions embedded in source information.

Such information may appear in uploaded documents, transcripts, clinical notes, or other inputs.

Cronic Care recognizes the importance of separating clinical source content from trusted application instructions and authorization controls.

Security objectives include preventing untrusted content from overriding application rules, obtaining unauthorized information, or triggering unauthorized actions.

AI-generated content should not be treated as an independent source of access authority.

23. AI Agents and Automated Clinical Workflows

CareInsights™ may use AI agents to analyze physician-approved documentation and recommend relevant clinical reports.

Automated processing should operate within defined authorization and workflow boundaries.

Security considerations include:

• Authorized access to clinical source information.
• Restricted report generation.
• Protection of encounter identifiers.
• Appropriate control of processing actions.
• Prevention of unauthorized report disclosure.
• Auditability of significant workflow events.

Automated agents should not be granted unrestricted access merely because they operate within the platform.

24. Physician Review and Approval Security

Cronic Care supports physician review and approval of clinical documentation.

Security objectives include:

• Restricting approval to authorized users.
• Protecting documentation integrity.
• Distinguishing draft and approved content.
• Recording relevant approval information.
• Preventing unauthorized changes.
• Preserving applicable version and audit information.

Physician approval is a clinical governance control and does not replace cybersecurity safeguards.

25. Documentation Integrity and Version Control

Clinical documentation may be edited, approved, or superseded through authorized workflows.

Cronic Care recognizes the importance of maintaining accurate document status and preventing unauthorized modification.

Versioning and integrity controls should reflect applicable clinical, legal, contractual, and operational requirements.

Where required, prior documentation versions and approval records should be preserved appropriately.

26. CareInsights™ Report Security

CareInsights™ may generate clinical intelligence reports containing PHI.

Report security considerations include:

• Authorized report selection.
• Restricted report generation.
• Appropriate access to source documentation.
• Protection of generated reports.
• Secure report delivery.
• Prevention of cross-clinic information disclosure.
• Appropriate report retention and deletion.

The existence of a report identifier or encounter identifier must not independently grant access to sensitive information.

27. Email and Clinical Information Delivery

Cronic Care may use email to deliver notifications or information related to clinical workflows.

Email security considerations include:

• Avoiding unnecessary PHI in message bodies.
• Verifying intended recipients.
• Restricting sensitive information in URLs.
• Using authenticated access for protected clinical content.
• Managing the risks of forwarded messages.
• Applying appropriate transmission safeguards.

Where feasible, notifications should direct authorized users to secured clinical interfaces rather than unnecessarily exposing sensitive information in email.

An email link alone should not be treated as sufficient authorization to access protected clinical information.

28. ResearchInsights Security

ResearchInsights may process information associated with authorized clinical research activities.

Security requirements may arise from research protocols, sponsor agreements, institutional requirements, and applicable laws.

Relevant objectives include:

• Restricting access to authorized research information.
• Protecting participant confidentiality.
• Maintaining appropriate documentation integrity.
• Supporting applicable retention requirements.
• Managing authorized research-related disclosures.

Research-specific obligations may differ from ordinary clinical documentation workflows.

29. Data Retention and Secure Deletion

Information security includes managing data throughout its lifecycle.

Cronic Care seeks to establish appropriate retention and deletion procedures for:

• Audio recordings.
• Clinical transcripts.
• Draft documentation.
• Approved SOAP notes.
• Clinical intelligence records.
• Generated reports.
• Provider account information.
• Security logs.
• Backup copies.

Applicable requirements are addressed further in Cronic Care’s Data Retention & Deletion Policy.

30. Backups and Business Continuity

Cronic Care recognizes the importance of service resilience and data recovery.

Depending on the applicable infrastructure and service configuration, continuity planning may include:

• Backup arrangements.
• Recovery procedures.
• Service monitoring.
• Incident escalation.
• Infrastructure redundancy.
• Restoration testing.
• Data integrity verification.

Specific recovery capabilities and commitments should be documented and verified before being represented as guaranteed service levels.

31. Monitoring and Security Logging

Appropriate security monitoring can assist in identifying suspicious activity and investigating incidents.

Monitoring considerations may include:

• Authentication failures.
• Unauthorized access attempts.
• Unusual API activity.
• Privileged administrative changes.
• Security-related processing errors.
• Unexpected access patterns.

Monitoring must be conducted in accordance with applicable privacy and security requirements.

Sensitive clinical information should not be unnecessarily exposed through logs.

32. Security Testing and Vulnerability Management

Cronic Care recognizes the importance of identifying and addressing security weaknesses.

Security evaluation activities may include:

• Application security review.
• Dependency assessment.
• Configuration review.
• API security testing.
• Access control evaluation.
• Vulnerability scanning.
• Penetration testing by authorized parties.
• Review of reported vulnerabilities.

Testing methods and frequency should be appropriate to the platform’s risk profile and operational maturity.

This Policy does not represent that Cronic Care has completed any particular certification, penetration test, or independent security audit.

33. Software Updates and Change Management

Security weaknesses may arise from outdated software, configuration changes, or new application functionality.

Cronic Care seeks to consider security during development and system changes.

Relevant practices may include:

• Reviewing software dependencies.
• Evaluating security updates.
• Testing changes before deployment.
• Limiting unauthorized production modifications.
• Maintaining appropriate change records.
• Reviewing newly introduced permissions and integrations.

Changes affecting clinical workflows should also consider documentation integrity and patient information protection.

34. Third-Party Service Provider Security

Cronic Care may rely on third-party providers for hosting, authentication, transcription, AI processing, email delivery, and other functions.

Third-party relationships should be evaluated according to applicable legal, contractual, privacy, and security requirements.

Where required, appropriate agreements, including Business Associate Agreements, should be established before a provider processes PHI.

Third-party security certifications do not automatically extend to Cronic Care’s complete platform.

35. Employee, Contractor, and Authorized Personnel Security

Individuals with authorized access to Cronic Care systems or sensitive information must follow applicable confidentiality and security requirements.

Relevant controls may include:

• Appropriate access authorization.
• Confidentiality obligations.
• Security awareness.
• Restricted use of sensitive information.
• Timely removal of unnecessary permissions.
• Reporting of suspected security incidents.

Access should be limited according to legitimate responsibilities.

36. Security Incident Identification

A security incident may involve attempted or actual unauthorized access, disclosure, alteration, destruction, or disruption of information or systems.

Examples may include:

• Compromised credentials.
• Unauthorized PHI access.
• Accidental disclosure of clinical reports.
• Suspicious API activity.
• Unauthorized modification of documentation.
• Malware.
• Misconfigured cloud resources.
• Loss of sensitive information.
• Exploitation of application vulnerabilities.

Not every security event constitutes a reportable data breach.

37. Incident Response

Cronic Care seeks to maintain appropriate processes for evaluating and responding to security incidents.

Response activities may include:

1. Receiving and identifying the reported concern.
2. Assessing potential impact.
3. Restricting or containing unauthorized activity.
4. Investigating relevant systems and records.
5. Addressing identified vulnerabilities.
6. Restoring affected services where appropriate.
7. Evaluating notification obligations.
8. Documenting relevant findings.
9. Reviewing opportunities for improvement.

Actual response procedures should be maintained internally and adapted to the nature of the incident.

38. Security Incident and Breach Notification

Where an incident affects PHI or other protected information, notification requirements may arise under HIPAA, applicable state laws, Business Associate Agreements, or other obligations.

Cronic Care will assess applicable notification duties according to the facts and legal requirements.

Notification responsibilities and deadlines may differ depending on the parties involved and the type of information affected.

This Policy does not establish a universal incident notification deadline or replace legally required notification procedures.

39. Responsible Vulnerability Disclosure

Cronic Care welcomes good-faith reports of potential security vulnerabilities affecting systems and services under its control.

Responsible disclosure helps organizations identify and address security weaknesses before they cause harm.

Individuals who believe they have discovered a vulnerability are encouraged to report it privately through Cronic Care’s designated security contact.

Please do not publicly disclose an unremediated vulnerability or attempt to exploit it beyond what is necessary to prepare a responsible report.

Cronic Care does not authorize unrestricted security testing through publication of this Policy.

40. How to Report a Security Vulnerability

Security concerns should be submitted to:

Cronic Care, Inc.
Security Contact: [Insert official security email address]
Website: https://cronic.care

A useful report may include:

• A description of the suspected vulnerability.
• The affected webpage, endpoint, or feature.
• The potential security impact.
• Steps to reproduce the issue, if safely obtained.
• Relevant technical observations.
• The date and approximate time of discovery.
• Contact information for follow-up, if desired.

Reports should contain only the minimum information necessary to explain the concern.

Do not include actual patient records, PHI, passwords, authentication tokens, or other sensitive information in ordinary email reports.

If sensitive information is involved, request a secure reporting method before transmitting it.

41. Good-Faith Security Research

Cronic Care appreciates responsible efforts to identify and communicate security concerns.

Good-faith researchers are expected to:

• Avoid accessing information that does not belong to them.
• Avoid collecting or retaining PHI.
• Avoid disrupting clinical services.
• Avoid modifying or deleting information.
• Avoid bypassing authorization to access real patient records.
• Stop testing if sensitive information is unexpectedly exposed.
• Report findings promptly and privately.
• Comply with applicable laws and express authorization requirements.

Researchers should request written permission before conducting active testing of Cronic Care systems.

42. Activities Not Authorized

Unless Cronic Care has expressly authorized them in writing, the following activities are prohibited:

• Accessing another user’s account or patient information.
• Accessing real PHI without authorization.
• Social engineering or phishing.
• Denial-of-service testing.
• Excessive automated scanning.
• Malware deployment.
• Credential attacks or password spraying.
• Exploiting vulnerabilities to establish persistence.
• Altering or deleting clinical information.
• Disrupting physician documentation or approval workflows.
• Testing third-party infrastructure without permission.
• Publicly exposing sensitive information.

This Policy does not grant permission to violate applicable law, contractual restrictions, or third-party rights.

43. Vulnerability Disclosure and Safe Harbor

Cronic Care encourages responsible reporting but does not establish a blanket legal safe harbor or unrestricted testing authorization through this Policy.

Any authorized security testing must remain within the expressly approved scope and applicable law.

Cronic Care may consider good-faith conduct when evaluating reported activity, but cannot bind third parties or guarantee immunity from legal action.

Researchers seeking testing authorization should contact Cronic Care before proceeding.

44. Handling of Reported Vulnerabilities

Upon receiving a vulnerability report, Cronic Care intends to evaluate the information and determine appropriate next steps.

Depending on the report, activities may include:

• Confirming receipt.
• Reviewing technical details.
• Assessing whether the issue is reproducible.
• Evaluating severity and potential impact.
• Determining remediation priorities.
• Requesting additional information.
• Implementing appropriate corrective measures.
• Reviewing whether broader security action is required.

Response times may vary based on severity, complexity, available information, and operational circumstances.

45. Vulnerability Severity and Prioritization

Potential vulnerabilities may be prioritized according to factors such as:

• Likelihood of exploitation.
• Potential exposure of PHI.
• Unauthorized access risk.
• Impact on clinical documentation integrity.
• Ability to affect multiple organizations.
• Availability impact.
• Ease of exploitation.
• Existing mitigating controls.

Vulnerabilities affecting patient confidentiality or critical clinical workflows may require heightened attention.

Cronic Care does not guarantee a specific remediation timeline through this public Policy.

46. Coordinated Public Disclosure

Cronic Care encourages researchers to coordinate public disclosure of vulnerabilities with the Company.

Public disclosure should take into account:

• The nature of the vulnerability.
• Whether affected information is sensitive.
• Potential patient or organizational impact.
• Availability of a remediation.
• Risk of exploitation.
• Applicable legal obligations.

Cronic Care may communicate with researchers regarding an appropriate disclosure approach.

Researchers must not disclose PHI or other protected information.

47. Security Research Recognition and Rewards

Cronic Care does not establish a public bug bounty or financial reward program through this Policy.

Submitting a vulnerability report does not create an entitlement to payment, employment, contractual benefits, or public recognition.

Any recognition or reward must be separately authorized by Cronic Care.

48. Reporting Suspected Unauthorized Access

Authorized users who suspect unauthorized access to their Cronic Care accounts should promptly notify their organization’s administrator and Cronic Care through the appropriate support or security channel.

Relevant circumstances may include:

• Unexpected account activity.
• Suspicious sign-in attempts.
• Unauthorized documentation changes.
• Unexpected clinical report access.
• Lost or compromised credentials.
• Suspicious emails or links.

Users should avoid sharing passwords or authentication tokens when reporting concerns.

49. Healthcare Organization Security Responsibilities

Healthcare organizations using Cronic Care retain responsibility for security practices within their control.

These may include:

• Authorizing provider accounts.
• Managing personnel access.
• Protecting account credentials.
• Using supported and appropriately secured devices.
• Obtaining required patient consents.
• Reviewing clinical documentation.
• Maintaining official medical records.
• Reporting suspected security incidents.
• Managing security within their EMR and local networks.

Responsibilities are subject to applicable agreements and law.

50. Security and Clinical Responsibility

Cronic Care’s security controls are intended to support the safe handling of information, not to replace professional clinical judgment.

AI-generated documentation and clinical intelligence may require physician review and approval.

Security measures cannot guarantee that generated clinical content is accurate, complete, or appropriate for every patient.

Clinical validation, professional judgment, and cybersecurity safeguards are complementary responsibilities.

51. Data Privacy and Confidentiality

Information security and data privacy are closely related but distinct.

Security safeguards help protect information against unauthorized access and misuse.

Privacy requirements govern how information may be collected, used, disclosed, retained, and otherwise processed.

Cronic Care’s Privacy Policy and HIPAA & Patient Data Protection Policy provide additional information regarding privacy practices and responsibilities.

52. Security Limitations

No internet-connected service, cloud infrastructure, or software application can guarantee absolute security.

Security risks may arise from vulnerabilities, user behavior, third-party services, evolving threats, or circumstances outside an organization’s control.

Cronic Care seeks to identify and address relevant risks through appropriate safeguards and operational practices.

Cronic Care does not guarantee that its Services are immune from every security threat, interruption, or unauthorized attempt.

Nothing in this section limits obligations imposed by applicable law or governing agreements.

53. Policy Review and Updates

Cronic Care may periodically review and update this Policy to reflect:

• Changes in security risks.
• New clinical workflows.
• Changes in AWS architecture.
• New AI agents and processing capabilities.
• Changes in applicable law.
• Updated industry guidance.
• New third-party integrations.
• Changes in vulnerability reporting procedures.
• Identified security improvement opportunities.

Updates will be published with a revised effective date.

54. Relationship to Other Policies and Agreements

This Policy supplements Cronic Care’s:

• Privacy Policy.
• Terms of Use.
• Cookie Policy.
• HIPAA & Patient Data Protection Policy.
• AI Transparency & Clinical Responsibility Policy.
• Data Retention & Deletion Policy.
• Accessibility Statement.
• Applicable Business Associate Agreements.
• Master Services Agreements.
• Clinical Evaluation Agreements.

In the event of a conflict, applicable law and controlling contractual provisions govern.

Nothing in this Policy limits rights or obligations that cannot lawfully be waived.

55. Security Contact Information

For security questions, suspected vulnerabilities, or responsible disclosure inquiries, contact:

Cronic Care, Inc.
Fresno, California, United States
Website: https://cronic.care
Security Email: privacy@cronic.care

Please describe the issue clearly and avoid including patient-identifiable information or PHI in unsecured communications.

For urgent concerns involving potential exposure of clinical information, contact Cronic Care through an established authorized customer support or security channel.