HealthChrono Privacy Policy

1. Introduction

Welcome to HealthChrono ("we," "our," or "us"). We are dedicated to maintaining the highest confidentiality, integrity, and security standards for your personal health records. This Privacy Policy explains how our mobile application and accompanying web portal collect, use, encrypt, store, and protect your information when you use our service.

2. Information We Collect

2.1 Self-Reported Health Information

• Symptom logs: Self-reported physical or mental symptoms, date/time stamps, severity levels rated on a 1–10 scale, and trigger notes.
• Medication regimens: Prescription drug names, dosage amounts, scheduled timing, dose frequency, and self-recorded dose adherence markers.
• Physician reports: Custom date ranges and generated clinical PDF summaries formatted for discussion with your healthcare providers.

2.2 Account & Authentication Data

If you create a synced cloud account, we collect your email address and authentication tokens via our secure authentication provider (Clerk). If you choose to use HealthChrono in offline-only mode, no personal identifying account credentials are transmitted to any server.

2.3 Device & Diagnostics (Anonymized)

• Technical device details: Device model, operating system version (iOS/Android), and application build version.
• Crash & performance reports: Anonymized diagnostic logs stripped of personally identifiable information (PII) to resolve bugs and runtime crashes.

3. How We Use Your Information

We process your data strictly for legitimate operational purposes:

• To operate and maintain local symptom tracking and medication management.
• To deliver local push notifications and alarms for medication doses.
• To compile and export structured clinical PDF reports upon your explicit command.
• To synchronize encrypted records between your authorized mobile devices if cloud backup is enabled.
• To maintain application reliability and provide customer support when requested.

4. Cryptographic Security & Local Storage

We implement defense-in-depth security architecture:

You can also configure the in-app Biometric Lock (Face ID, Touch ID, or biometric device lock) to prevent unauthorized local physical access to the application.

5. Data Retention Policy

We retain data only as long as necessary to fulfill the services:

6. Account & Data Deletion

You have absolute control over your health data. You may delete your account and all associated health records at any time:

• In-App Self-Service: Open the app, navigate to Settings > Data Management > Delete Account, and confirm. All records stored on your device and synchronized in the cloud will be permanently and irreversibly destroyed.
• Web Deletion Portal: Visit our dedicated Account & Data Deletion Request Page.
• Email Support: Send a deletion request to [email protected]. We process verified deletion requests within 3 business days.

7. Data Breach Notification

In compliance with the FTC Health Breach Notification Rule and state privacy statutes, in the unlikely event of an unauthorized acquisition or breach affecting your personal health information, HealthChrono will notify affected individuals and regulatory authorities within 60 calendar days of breach confirmation, outlining the incident details, affected data fields, and mitigation recommendations.

8. Your Privacy Rights (GDPR & CCPA/CPRA)

Under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and related privacy laws, you possess the right to:

• Access: Request confirmation of what personal data we process and inspect copies of your records.
• Data Portability: Export your complete health log history in structured, machine-readable formats (PDF, CSV, JSON) directly through app settings.
• Rectification: Correct any inaccurate or incomplete records directly within the app interface.
• Erasure (Right to be Forgotten): Request the permanent deletion of your account and cloud records.
• Opt-Out of Data Sales: HealthChrono does not sell or share personal health information for behavioral advertising or monetary consideration.

9. Third-Party Service Providers

We engage vetted third-party infrastructure providers under strict Data Processing Agreements:

• Clerk: Secure user authentication and token issuance.
• Supabase: High-security cloud database hosting encrypted sync records.
• RevenueCat: In-App Purchase and subscription status management (Apple App Store / Google Play).
• Sentry: Anonymized, non-PII error and crash reporting for software stability.
• Netlify: Static web hosting and secure SSL delivery for this website.

10. Children's Online Privacy Protection Act (COPPA)

HealthChrono is intended for users who are at least 13 years of age (or 16 in the European Economic Area). We do not knowingly collect or solicit personal information from children under 13. If you believe a child has provided us with personal health data, please contact us immediately at [email protected] and we will delete the data promptly.

11. Contact Us & Privacy Officer

For any privacy inquiries, data subject access requests, or regulatory communications: