Privacy Policy

1. Who is responsible for your information

Patient information belongs to the clinic. When a clinic uses CHIRON to care for its patients, the clinic decides why and how patient information is used. Under the LGPD the clinic is the controller and CHIRON is the processor (operator). In the United States the clinic is the HIPAA covered entity and CHIRON is its business associate, under a written Business Associate Agreement signed before any Protected Health Information enters the Service.

CHIRON is the controller only of the information it needs to run its own business: clinic accounts, staff profiles, billing contacts, and the information of people who visit our website or write to us.

If you are a patient, your clinic's own privacy notice (in the United States, its Notice of Privacy Practices) governs how it uses your information. Questions about your health record are best sent to your clinic; we will help them answer.

2. Information we process

• Identifiers: name, date of birth, phone number, e-mail and, in Brazil, the CPF.
• Health information: procedures and visits, conditions, allergies, medications and doses, symptom and recovery diary entries, photos the patient chooses to send, exam requests and results, clinical notes and documents written by the care team.
• Visit recordings: the text of a visit that the clinician records. The audio is transcribed and is not stored by CHIRON. The text is kept only when the patient has authorized it in the app; without that authorization the note is created and the transcript is discarded.
• Voice: when someone speaks to CHIRON or dictates, the audio is converted to text and is not kept.
• Account and security information: login e-mail, roles and permissions, two-factor authentication status, signed-in devices, IP address and the audit trail of who accessed what.
• Usage information: pages and features used, errors and performance data. Product analytics about clinics never include patient information.
• Billing information for clinics: plan, invoices and payment status. Card numbers are handled by our payment processor and never reach our servers.
• Website visitors: what you type in our contact or demo forms, and strictly necessary cookies.

3. Where the information comes from

• From the clinic and its team, when they register a patient or write in the record.
• From the patient, through the app (diary, photos, messages, consents).
• From the patient's own devices and health portals, when the patient connects them: in the mobile app, the heart rate, oxygen saturation, blood pressure, temperature and weight that a watch, ring or blood pressure monitor records in Apple Health (iPhone) or Health Connect (Android); and, when the patient links a health portal from another provider (for example, Epic MyChart), the conditions, medications, allergies and vital signs recorded there. This happens only after the patient authorizes it, and the patient can revoke access at any time in the Health app, in Health Connect or in the portal.
• From integrations the clinic turns on, such as a spreadsheet or FHIR import, or a calendar.
• From sign-in providers you choose (for example, signing in with Google gives us your name and e-mail).
• Automatically, from the devices that use the Service (logs and security events).

4. How we use it

Legal bases under the LGPD: health information is processed for the protection of health by health professionals and services (art. 11, II, f) and, where applicable, with the patient's consent (art. 11, I). Other information is processed to perform the contract, to meet legal obligations and for our legitimate interest in operating and securing the Service (art. 7).

Information read from Apple Health, Health Connect or a patient's health portal is used only for the care follow-up the clinic provides. It is never used for advertising or marketing, never sold, never shared beyond the service providers in section 7, and never stored in iCloud. The app never writes to Apple Health or Health Connect.

• To provide the Service the clinic contracted: follow-up, reminders, messages between patient and care team, scheduling and documents.
• To help clinicians document and organize care with AI, always as a draft the clinician reviews. CHIRON does not diagnose, prescribe or discharge anyone on its own.
• To keep the Service secure: authentication, two-factor checks, fraud and abuse prevention, the access audit trail and incident response.
• To bill clinics and run our business, and to meet legal obligations.
• To improve the Service using clinic usage analytics that contain no patient information.

5. Artificial intelligence

AI features (the CHIRON assistant, note drafting, summaries) support the clinician and never replace clinical judgment. Nothing is written to the record without a clinician confirming it.

Before content is sent to an AI provider, direct identifiers are reduced. AI providers process requests under zero data retention terms and may not use the content to train their models. We do not sell patient information or use it to train AI models.

6. Recording a visit

A clinician can record a visit so that CHIRON drafts the note. The clinician must tell the patient the visit is being recorded and obtain any consent the law of their state or country requires; several U.S. states require the consent of everyone in the conversation.

When the transcription runs in the browser (Chrome or Edge), speech recognition is performed by the browser's own provider. When it runs through CHIRON, audio goes in short segments to our transcription provider, which does not keep it.

7. Who we share information with

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising. We share it only with:

• Service providers that run the Service for us, under contract and confidentiality and, for patient information in the United States, under a Business Associate Agreement where required: database and hosting, AI processing, speech transcription and voice, payment processing, product analytics (no patient information), and messaging by WhatsApp, SMS or e-mail when the clinic turns it on. What each provider does and where is on our Security page; the name of each is available on request through our privacy contact.
• The patient's own clinic and care team, and people the patient or the clinic authorizes.
• Public authorities, when the law or a court order requires it.
• A buyer or successor, if CHIRON is involved in a merger or acquisition, under the same protections described here.

8. Where information is stored and international transfers

Records, photos and messages are stored in a managed database in the United States (Oregon), and the application runs on servers in the United States. Information is encrypted in transit and at rest.

For clinics and patients in Brazil, this is an international transfer under articles 33 to 36 of the LGPD, made under standard contractual clauses as regulated by the ANPD (Resolution CD/ANPD 19/2024).

9. How long we keep it

Patient information is kept for as long as the clinic uses the Service and then for as long as medical-record retention laws require (in Brazil, Law 13.787/2018; in the United States, the law of the clinic's state). When a clinic leaves, we return or delete its information, unless the law requires us to keep it.

Visit transcripts follow the clinic's record. Voice audio is not kept. Security logs are kept for as long as they are needed to protect the Service and to answer for access to records. What you send through our website forms is kept while we follow up with you, and deleted when you ask.

10. How we protect it

• Each clinic's information is isolated in the database by row-level security.
• Two-factor authentication for clinic staff: once someone turns it on, the database itself refuses their session without the second factor, and a clinic can require it for the whole team.
• Encryption in transit and at rest, and field-by-field encryption of integration tokens and secrets.
• Role-based access, with an audit trail of who accessed each record. Patients can see in the app who accessed their record and which devices are signed in, and sign any of them out.
• Daily encrypted backups.

11. Your rights in Brazil (LGPD)

Under article 18 of the LGPD you can ask us to confirm that we process your information; to access, correct, anonymize, block or delete it; to port it; to know who we share it with; to withdraw consent; and to have an automated decision reviewed by a person. You can also petition the Brazilian Data Protection Authority (ANPD). Our Privacy Center explains each right and how to use it.

12. Your rights in the United States

Patients exercise their HIPAA rights (access, amendment, restrictions, confidential communications and an accounting of disclosures) through their clinic. We support the clinic in answering within the HIPAA deadlines.

Depending on your state (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the other states with comprehensive privacy laws), you may have the right to know what personal information we hold about you and how we use it, to get a copy, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising (we do none of these), and to limit the use of sensitive personal information (we use it only to provide the Service). Where your state provides one, you may appeal our answer.

We honor the Global Privacy Control (GPC) signal as a request to opt out. We will not discriminate against you for using any of these rights.

You can send a request yourself or through an authorized agent. We will verify your identity before acting, and answer within the time your state's law allows (45 days in California, extendable once when the law permits).

13. Consumer health data (Washington, Nevada and Connecticut)

Information that is Protected Health Information under HIPAA is governed by HIPAA and by your clinic. For any other consumer health data we may process (for example, health information a visitor types in a website form), we collect only what is needed to answer you, use it only for that purpose, never sell it, and share it only with the service providers described above. You can ask us to confirm, access, delete or stop processing it, and withdraw any consent you gave, through the channel below.

14. Text messages and e-mail

Clinics send text messages only to patients who agreed to receive them. Reply STOP to stop text messages and HELP for help; app notifications continue. Message and data rates may apply.

Marketing e-mails from CHIRON identify us and include a link to unsubscribe, which we honor promptly. Service e-mails about your account continue while you use the Service.

15. Children

The Service is not directed to children under 13 and we do not knowingly collect their information directly. Information about minors who are patients is entered by their clinic, with a parent or guardian, under the clinic's responsibility.

16. Cookies and similar technologies

We use cookies that are strictly necessary for sign-in, security and the Service to work. Optional cookies, if any, depend on your consent, which you can change at any time in the Privacy Center. Product analytics run on our servers and do not include patient information.

17. Security incidents

If an incident affects personal information, we notify the affected clinics without undue delay so they can meet their obligations, and we notify authorities and individuals when the law requires it, including the ANPD in Brazil and, for clinics in the United States, as set out in the Business Associate Agreement and the HIPAA Breach Notification Rule.

18. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your information, we tell clinics and users in the Service before it takes effect.

19. Contact and data protection officer

To exercise any right or ask a question about this policy, contact our data protection officer through the form at https://www.chironmedi.com/contato.

Responsible company: CHIRON Tecnologia Ltda..

This English version and the Portuguese version describe the same practices. For clinics and patients in Brazil, the Portuguese version prevails if they ever differ.