Privacy Policy

Chronico is an app for people managing a long-term condition. It keeps your medication reminders, your readings, and — if you choose to connect one — data from your smartwatch, so that you and the clinicians you choose can see how you are doing.

This summary is for orientation only. The sections below are the policy.

Chronico is operated by Bulletpoint SHPK (company number [NIPT]), registered at Rr. Ishull Shëngjin, Nr. Ap. 7, Shëngjin, Lezhë, Albania. For the purposes of data protection law we are the controller of the personal data described here.

This policy covers everyone who uses Chronico:

• •Patients — people using the app to manage their own condition.
• •Doctors— clinicians linked to a patient's account who can see that patient's data and leave notes.
• •Caretakers — family members or carers a patient has linked to their account.
• •Administrators — staff at the organisation operating this deployment.

We are based in Albania and process personal data under Albanian data protection law. Where you are in the European Economic Area or the United Kingdom, the GDPR applies to you as well, and we honour the rights it gives you regardless of where you live.

Health information is special category data under both. We process it on the basis of your explicit consent, which you give when you create an account and again, separately, when you connect a health device. You can withdraw either at any time — see Your rights.

Account and profile

• •Your email address and password (stored only as a cryptographic hash — we cannot read it).
• •Your name, and optionally a phone number, profile photo, address, city and country.
• •Your role: patient, doctor or caretaker.
• •The conditions you tell us you are managing.
• •Your language preference.
• •Which doctors and caretakers you are linked to.

Health information you enter yourself

• •Medication reminders: the medicine, dose amount and unit, number of pills, schedule, and any notes you add.
• •Readings you record by hand — blood pressure (systolic, diastolic and pulse), blood glucose, weight, temperature and others.
• •Whether you marked a reminder as done, and when — your adherence record.
• •Activities and treatment-tracking entries.
• •Notes your doctor leaves on your record.
• •Messages you send to the in-app AI assistant.

This section describes exactly what happens when you connect a smartwatch or fitness tracker. It is the most sensitive data the app handles and we have tried to describe it precisely rather than generally.

How the connection actually works

Chronico never connects to your watch directly. It has no Bluetooth pairing with your device and cannot control it. Instead it reads from the health store already on your phone, which your watch writes into:

This means two things. First, we only ever see data that is already on your phone. Second, the accuracy, completeness and timeliness of that data are determined by your watch and by Samsung Health, Health Connect or Apple Health — not by us. Data can arrive hours late, or not at all, if those apps are not syncing.

What we read

We ask for permission to read the following measurements. You choose which of them to allow, and you can allow some and refuse others. We only ever read the ones you have granted.

For each reading we store the value, the time it was recorded, the unit, the name of the app that wrote it (for example “Samsung Health”), and — on iOS only — the hardware model that recorded it. On Android, Health Connect does not tell us which device recorded a reading, only which app wrote it, so that field is always empty.

We also store a de-duplication identifier for each reading so that re-reading the same period does not create duplicates. The app deliberately re-reads an overlapping window on every sync, because Samsung Health can write to Health Connect hours after the fact.

Permissions, and historical access

• •Health permissions are granted by you in Health Connect or Apple Health, per measurement. Refusing one only affects that measurement.
• •Historical access is a separate permission on Android. If you do not grant it, we can only ever read data recorded after the moment you connected. Your older data is not hidden from you — it is unreachable to us, and cannot be reached retroactively.
• •Physical Activity is a separate Android system permission needed for step counts. Refusing it affects steps only; everything else still works.

Diagnostic sync logs

Connecting a watch can fail silently in several places, and when it does, the only symptom you see is an empty dashboard. So each sync attempt writes a diagnostic log we can use to tell you what went wrong. A log entry records:

• •The stage reached (availability, permissions, historical access, reading, upload, finish) and a machine-readable outcome code.
• •A human-readable message, such as “Permissions are granted but Health Connect returned no samples for the last 30 days.”
• •Which measurement was being read, how many readings were returned, and how many were new.
• •How long the step took, and when it happened according to your phone's clock.
• •Your device model, OS version, app version, and the name of the health app that supplied the data.
• •A diagnostic detail object containing counts, source app names, permission lists and error strings.

Connection records

We keep a record of the current state of each connection: which health platform, which measurements you granted and refused, whether historical access was given, when it last synced successfully, the last error if there was one, your device and app version, and a running total of readings received. If you use more than one device, there is one such record per device platform.

Apple Health (HealthKit) — specific commitments

Health Connect (Android) — specific commitments

Turning it off

You can disconnect at any time from the app's settings, and you can revoke any or all permissions directly in Health Connect or Apple Health. Doing so stops all future reading immediately. Readings already synced remain in your Chronico record so your history stays intact — to remove those as well, delete your account or ask us to erase them (see Deleting your account and data).

• •Device and app information: device model, operating system version, and app version.
• •Authentication events: when you sign in, and whether your email is verified.
• •Technical logs generated by our servers, including IP address and request times, kept for security and debugging.
• •Push notification tokens, so reminders can reach your device.
• •Error and crash diagnostics.

We do not use third-party advertising identifiers, and we do not track you across other apps or websites.

Chronico includes an AI assistant you can ask questions about your condition and about using the app. You should understand how it works before using it.

We store your conversations with the assistant so you can return to them, along with a count of the tokens used. You can delete a conversation at any time. Administrators at the operating organisation can see conversation records for support and safety review.

The assistant is not a clinician and does not diagnose. See our Terms & Conditions for what it will and will not do.

• •You. Always.
• •Doctors linked to your account. A doctor can see the record of a patient they are linked to, including readings, adherence and device data, and can leave notes. The link must exist before any access is possible — every request is checked against it.
• •Caretakers linked to your account. The same, subject to the same check.
• •Administrators at the organisation operating this deployment, for support, safety and to keep the service running. Administrator access to sync diagnostics is designed around counts and error codes rather than your readings.

You control who is linked to you, and can remove a link at any time from the app, which ends that person's access.

We use a small number of service providers who process data on our instructions, under contract, and only for the purposes below. They are not permitted to use your data for their own purposes.

We may also disclose information where we are legally required to:

• •To comply with a court order, law or binding regulatory request.
• •To protect against imminent risk to someone's life or safety.
• •In connection with a merger or acquisition — in which case you will be told before your data is transferred, and the acquirer will be bound by this policy.

Your data is stored in [HOSTING REGION, e.g. EU (Frankfurt)]. Where a provider listed above processes data outside your country, we rely on appropriate safeguards — Standard Contractual Clauses, or an adequacy decision covering the destination. You can ask us for a copy of the safeguards that apply to you.

• •All traffic between the app and our servers is encrypted in transit (TLS).
• •Data is encrypted at rest.
• •Passwords are stored only as salted cryptographic hashes and are never recoverable.
• •Access to production systems is restricted to named staff and logged.
• •Access to a patient's record is checked against an explicit link on every request, not assumed from a role.
• •Diagnostic logging is designed so that health values never enter it.

No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will tell you and the relevant regulator without undue delay, and in any case within the statutory deadline.

Under Albanian data protection law, and under the GDPR where it applies to you, you have the right to:

• •Access the personal data we hold about you, and get a copy.
• •Correct anything inaccurate.
• •Delete your data — see the next section.
• •Port your data to another service in a machine-readable format.
• •Object to or restrict certain processing.
• •Withdraw consent at any time — for health data generally, for the device connection specifically, or for the AI assistant. Withdrawing does not affect processing that already happened.
• •Complain to a data protection regulator — in Albania, the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale); in the EEA or UK, your national supervisory authority.

To exercise any of these, email privacy@chronico.app. We respond within one month. We will not charge you or make the service worse for asking.

Data Protection Officer: [DPO NAME AND EMAIL, or remove this line]

When you delete your account we erase:

• •Your profile, contact details and login credentials.
• •Your reminders, readings, adherence history and notes.
• •Every reading synced from your watch or phone health app.
• •Your device connection records and sync diagnostics.
• •Your AI assistant conversations.
• •Your links to doctors and caretakers.

Deletion is completed within 30 days. Backups are purged on a 35-day rolling cycle, after which no copy remains. We may retain a minimal record of the deletion itself, and anything we are legally required to keep, in which case we will tell you what and why.

You can also delete individual items — a reading, a reminder, a conversation — without deleting your whole account, and you can disconnect your device while keeping the rest of your record.

Chronico is not intended for children under 16. We do not knowingly collect data from them. If a child under that age has created an account, contact privacy@chronico.app and we will delete it. Where a child is managed by a parent or guardian through the caretaker role, the adult account holder is responsible for that relationship and for the consent it relies on.

We will post any change here and update the date at the top. If a change materially affects how we use your health data, we will tell you in the app and, where the law requires it, ask for your consent again before the change applies to you.

Privacy questions and rights requests: privacy@chronico.app
Everything else: support@chronico.app

Bulletpoint SHPK
Rr. Ishull Shëngjin, Nr. Ap. 7, Shëngjin, Lezhë, Albania