Effective date: July 13, 2026 · Last updated: October 1, 2026 · Company: Mahlum Innovations LLC
Read this first. Chronos is a business-to-business (B2B) service sold to law firms and legal teams in the United States. This Policy describes how we handle data about the firms and individual professionals who use our platform, and how we handle the case files — including Protected Health Information (PHI) — that customer firms upload for processing. If you are an individual whose medical records were reviewed using Chronos, we process your records only on behalf of the law firm that engaged us; please contact that firm directly.
When you create an account or set up your firm, we collect: name, work email address, firm name and address, phone number, job title, and role/permission settings. Authentication (including mandatory multi-factor authentication) is handled by our identity provider, Clerk; no PHI is stored in the authentication system.
1b. Billing data
Payments are processed by Stripe. Stripe collects and stores payment card details; we receive only a tokenized reference, billing contact details, and transaction history. We never store raw card numbers, and no PHI is shared with Stripe.
1c. Usage and telemetry data
We automatically collect service-interaction data: pages and features used, actions taken (uploads, exports, logins), timestamps, session duration, device/browser type, and IP address. We use this to operate and improve the service, detect security issues, and maintain the audit log we make available to firms for compliance review.
1d. Uploaded case files and PHI (processed on your firm's behalf)
When your firm uploads medical records or other case files, we process the contents — which may include PHI as defined by HIPAA (patient names, dates of service, diagnoses, treatment notes, billing records) — solely as a service provider / HIPAA business associate acting on your firm's behalf and at its direction, after an authorized firm administrator explicitly accepts the Business Associate Agreement (BAA). The exact accepted version and signature evidence are retained, and the executed copy is available in Settings → Legal & Compliance. Your firm controls this data.
1e. Support and communications
If you email us, request a demo, or open a support ticket, we retain those communications to respond and improve support. Do not include PHI in support emails; use in-app channels for case-specific issues.
2. How we use data
We use the data above to: provide, operate, secure, and maintain the service (including generating AI-assisted chronologies with per-line source-page citations on your firm's behalf); authenticate users and enforce role-based access; process payments and manage credit balances; maintain audit logs; send transactional communications; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations, including HIPAA breach-notification duties.
We may use aggregated, de-identified usage data (never case files or PHI) to improve the service.
3. What we never do
We do not sell personal information. We do use consent-controlled advertising measurement tags on public pages; depending on the law and circumstances, some disclosures to advertising providers may be considered "sharing" or targeted advertising. You can decline or withdraw marketing consent as described below.
We do not use your case files, uploaded records, PHI, or AI outputs to train AI models — ours or anyone else's. Our AI inference provider operates under a BAA with zero data retention and contractual prohibitions on training.
We do not use marketing trackers in the authenticated application. Advertising measurement technologies are limited to public pages and are subject to the consent choices described in Section 9.
We do not use profiling to make decisions that produce legal or similarly significant effects.
4. AI processing disclosure
Chronos uses large language models to extract and structure information from uploaded records and to generate draft chronologies with per-line citations to source pages. AI inference runs on a HIPAA-eligible gateway under a BAA, with zero data retention and no training on customer content. All output is an AI-generated draft: attorney review is required, and each entry should be verified against its cited source page. Chronos provides no legal or medical advice. We describe our compliance posture as HIPAA-aligned; an authorized administrator must explicitly accept the BAA before the firm processes PHI — no government body certifies HIPAA compliance.
5. Subprocessors and sharing
To provide the customer service, we share account, billing, and case data with service providers that help operate and secure it, including the customer-service subprocessors listed at medchronosai.com/subprocessors. Providers receive data needed for their role and are subject to applicable contractual safeguards; a BAA applies where a provider processes PHI for us. This subprocessor list describes customer-service providers.
Separately, optional analytics and advertising measurement technologies on public pages may receive public-site visit and conversion information or online identifiers, as described in Section 9. Those technologies do not receive case files or PHI and are subject to the consent choices described there. They are not customer-service subprocessors processing PHI under a BAA.
Current customer-service subprocessor categories:
Hosting and deployment: Aptible, Inc. — HIPAA-eligible infrastructure, BAA signed.
Object storage: Google Cloud Storage, US region — BAA signed.
AI inference: Aptible AI Gateway — BAA signed, zero data retention, no training on customer content. See the full subprocessors list for current details.
Authentication: Clerk, Inc. — no PHI stored in authentication system.
Payments: Stripe, Inc. — no PHI shared with Stripe.
We may also disclose data: (a) when required by law, court order, or valid legal process; (b) in a merger, acquisition, or sale of assets, with prior notice to affected customers before PHI is transferred or becomes subject to a materially different policy; or (c) with your consent.
6. Data retention and deletion
Case files and PHI: firm-controlled. Each firm sets its own retention period in workspace settings. Deleting a case moves it to Trash for that recovery window; after the window expires, or when an administrator chooses Purge now, the application hard-deletes its application data, attempts to remove associated stored files, records the purge result, and reports storage deletion failures for operational follow-up. Encrypted backup copies (AES-256) age out automatically on the hosting provider's fixed schedule: daily backups are retained for 30 days and monthly backups for 12 months. Backup copies are used only for disaster recovery.
Account and firm data: retained for the life of the account plus up to 3 years after closure for legal and billing purposes.
Audit logs: retained for 6 years, consistent with HIPAA documentation requirements (45 C.F.R. § 164.316(b)(2)(i)).
Payment records: retained for 7 years for tax and accounting obligations.
De-identified, aggregated usage data: may be retained indefinitely.
Upon account termination we return or destroy PHI in accordance with your BAA. You may trigger an immediate hard purge at any time using the in-app purge control.
7. Security
Chronos uses HIPAA-eligible infrastructure with provider-managed encryption at rest (AES-256), encryption in transit (TLS), mandatory MFA for all users, role-based access controls, security audit logging, and least-privilege internal access. We operate a SOC 2 readiness program — we do not represent that we hold SOC 2 certification unless and until a report is issued. Details: medchronosai.com/security. To report a vulnerability: security@medchronosai.com.
8. Data residency
All customer data, including uploaded case files and PHI, is stored and processed in the United States. We do not transfer customer case data outside the US.
9. Cookies and Tracking Technologies
We use browser storage, cookies, and similar technologies for authentication, site preferences, analytics, and advertising measurement. Optional analytics and marketing technologies are controlled by your consent choices; they are not needed to use the service. Google and X measurement tags are restricted to public pages and are not loaded in the authenticated application where customer case information and PHI may be present. Other platform services and error reporting described below may operate at the hosting layer or within the application.
Necessary authentication and security. Clerk, our authentication provider, uses necessary cookies and related storage for sign-in, session management, and security. These are required for account access. The application also uses a functional sidebar_state cookie to remember the sidebar setting for up to seven days.
Hosting and load-balancing. Replit (for Replit-hosted previews or deployments), Aptible (our production hosting provider), and their traffic-routing, load-balancing, or security layers may set necessary infrastructure cookies or similar identifiers to route requests, maintain service availability, and protect the service. These are controlled by the relevant provider and disabling them may prevent the site or service from working correctly.
Google Analytics 4 (GA4). On public pages, Chronos uses GA4 measurement ID G-NVH64DZNLC for page views and conversion measurement. It receives public-page paths and events such as successful demo requests; query strings are excluded from page-view paths. GA4 is loaded only after analytics consent and is not loaded for authenticated routes.
Google Ads conversion measurement. Google Ads ID AW-18161124084 is configured for conversion measurement, including sign-up and demo-request conversions. It is loaded only with your marketing consent, on public pages, and is not loaded for authenticated routes.
X (formerly Twitter) Ads measurement. The X Ads tag (pixel ID rb17d) measures public-page visits and sign-up clicks. It is loaded only with your marketing consent and is not loaded for authenticated routes.
Replit Project Analytics and platform telemetry. Replit may independently collect cookieless network and browser metrics, and operational hosting telemetry, at its hosting layer under its own terms and privacy practices. Replit may inject https://i.replit.com/script.js into hosted HTML; Chronos's production content security policy blocks that script, so it is not an active Chronos browser analytics collector in production. These platform-level metrics are distinct from Chronos's consent-controlled analytics and advertising tags.
Error reporting. Browser error reporting through Sentry is enabled only when a Sentry DSN is configured for the build. It is for error diagnostics, not advertising; default personal data, user identity, request bodies, and cookies are excluded, and event data is scrubbed before sending. Free-form names in error text may not be reliably detected. Performance tracing, profiling, and session replay are not configured.
Your choices and consent storage
You can accept, reject, or change optional analytics and marketing technologies using the privacy preferences control. Your choice is saved in localStorage in this browser, with the consent categories and policy version, for up to 12 months; after that you will be asked to choose again. If a preference write fails, a necessary rejection-only cookie, chronos_tracking_denied, keeps optional tracking off for up to 12 months. Clearing browser storage also removes the saved choice. You may change your choice at any time:
Where supported, a Global Privacy Control (GPC) signal is treated as an opt-out of sale/sharing and targeted advertising and forces marketing consent to denied for that browser, overriding a prior marketing choice. GPC does not turn on optional technologies. You can also use browser settings or available provider opt-out controls; blocking necessary cookies or storage may impair sign-in or service functionality.
10. Your state privacy rights
Case-file note: Rights described here concern personal information Chronos handles for its own business purposes, such as account, billing, and public-site information. Medical records and other PHI that a firm provides for processing are handled on that firm's behalf; contact the law firm about rights concerning those records.
Rights and how to exercise them
Depending on where you live and the law that applies, you may have the right to request access to or a copy of personal information; correction of inaccurate information; deletion; and a portable copy. You may also have the right to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling, and to appeal a decision on a privacy request. We do not sell personal information. Some disclosures through the optional advertising measurement technologies described in Section 9 may be treated as sharing or targeted advertising under applicable law; you can opt out by rejecting or withdrawing marketing consent, and a recognized GPC signal forces marketing consent to denied.
To make a request or appeal, contact us at legal@medchronosai.com. We may need information to verify and process your request, and applicable exceptions may apply. If you use an authorized agent, we may request proof of authority where permitted by law. We will respond within the time required by applicable law.
11. Children
Chronos is a professional tool for licensed legal professionals and their staff. It is not directed to, and may not be used by, anyone under 18, and we do not knowingly collect personal information from minors. (Medical records uploaded by firms may pertain to minors; that data is PHI processed on the firm's behalf under the BAA and the firm's own authority.)
12. Changes to this policy
We may update this Policy. For material changes we will notify account holders by email and post notice on our website at least 30 days before the changes take effect. The "Last updated" date above reflects the current version; prior versions are available on request.
13. Contact us
For privacy-related questions, requests, or concerns — including HIPAA-related inquiries — contact us at: