Legal

Privacy Policy

Effective October 23, 2026 · Version 2026-10-23

This Privacy Policy explains how Medcron LLC (“Medcron”, “we”, “us” or “our”) collects, uses, shares and protects information through the medcron.net website, the Medcron application at app.medcron.net, and our support email.

Medcron serves law firms and other legal organizations. When a customer uploads medical records to prepare a chronology, we process those records on the customer’s behalf and under its instructions, as described in our Terms of Service and, where it applies, our Business Associate Agreement. The customer decides which records to send us; questions from the people described in the records are best directed to that customer, and we will forward any such request we receive to the customer.

1. Information we collect

Website visitors. When you visit medcron.net, our hosting provider receives the technical information any website receives, such as your IP address, browser type, the page requested and the referring page. We use a privacy-focused analytics service that counts page views, referrers and approximate country without cookies and without identifying or tracking you across other websites. If you email us, we receive your name, email address and whatever you include in your message.

Trial requests. If you request a free trial on medcron.net, we receive your name, work email address, firm name and your firm’s approximate monthly page volume. We use them only to reply to you and to set up your firm’s trial. The network address a request comes from is used only to limit how many requests one network can send in an hour; it is kept only in the app’s memory and never written down.

Account and firm information. When your firm creates a workspace: your name, work email address, firm name and, optionally, a phone number; your password, which is stored only in a hashed form; the setup of your authenticator app; invite codes redeemed; and the version of our Terms you accepted and when.

Records and chronologies. The medical records and other documents your firm uploads, which may include protected health information and other sensitive information about the people they describe, and the chronologies we prepare from them.

Order and billing information. Page counts, prices, payment status and the reference numbers Stripe gives us. Your card details are entered directly with Stripe and never reach Medcron.

Security and access logs. Sign-in events, and which account read, downloaded, reviewed or approved an order and when. These logs do not contain record content.

2. How we use information

We use information to provide and secure the Service: to read and organize your records into a chronology, to have a person review it, to deliver it, to take payment, to send you account and order notices, to answer your questions, to prevent misuse, and to meet our legal, tax and accounting obligations. We use operational measurements that contain no record content, such as page counts and processing times, to run and improve the Service.

Order notices contain an order number and a sign-in link, never patient details.

3. How we handle records

We use records only to prepare, review and deliver your chronologies. We do not sell records, use them for advertising, send them to third-party artificial intelligence or cloud language-model services, or use them to train models. Records are processed and stored on servers that Medcron controls in the United States, access is limited to personnel who need it to provide the Service, and records are deleted on the schedule in Section 6.

We share information only as follows:

Stripe, Inc., which processes payments. Stripe receives payment details, the order reference and the amount; it does not receive records.
Google LLC, which provides our email, including account and order notices that contain no patient details.
Vercel Inc., which hosts the medcron.net website and provides its cookieless analytics. The application at app.medcron.net and your records are not hosted by Vercel.
Cloudflare, Inc., which provides domain name (DNS) service for medcron.net. Traffic to the application does not pass through Cloudflare.
Your firm and its Authorized Users, who can see the orders and chronologies in your firm’s workspace.
When required by law, for example in response to a valid subpoena or court order. If a demand concerns a customer’s records, we will notify the customer before responding unless the law prohibits it.
In a business transfer, to a successor in a merger, acquisition or sale of assets, which must honor this Privacy Policy and our agreements with customers.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct marketing purposes.

5. Cookies and tracking

The medcron.net website does not use advertising or tracking cookies. The application uses only the cookies and browser storage needed to keep you signed in and secure. No third party collects information about your online activities over time and across different websites through our website or application. Because we do not track visitors across websites, we do not change our practices in response to “Do Not Track” browser signals.

6. How long we keep information

Records, chronologies and order working files: deleted automatically 14 days after the order starts (when it is paid for, or started with a free order), or 14 days after it was created if it is never started. Encrypted backups containing them are deleted within 8 further days.
Account and firm information and security logs: kept while your workspace is open and deleted within 90 days after it is closed, except where we need to keep them longer to resolve a dispute or meet a legal obligation.
Billing records: kept for seven years to meet tax and accounting obligations.
Support emails: kept for up to two years after the conversation ends.
Trial requests: deleted 90 days after the request was made or last answered.

7. How we protect information

Every account requires a password and an authenticator app. Each firm’s data is isolated from every other firm’s. The application is served only over encrypted connections, records are kept in encrypted storage on servers we control, and backups are encrypted. Reads, downloads, reviews and approvals are recorded in an access log. No security measure is perfect; if a breach of the security of records we maintain for a customer occurs, we notify that customer as described in our Terms and, where it applies, our Business Associate Agreement.

8. Your choices and rights

You can review and update your account information in the application or by writing to support@medcron.net, and you can ask us to close your firm’s workspace and delete its account information. We answer requests within 30 days.

California residents. The California Consumer Privacy Act applies to businesses that meet certain size or data thresholds, which Medcron does not currently meet. We nevertheless honor requests to know about, correct or delete personal information we hold about you as an account holder or website visitor. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about you.

People described in records. Records belong to the customers that upload them. If you believe your records were sent to us, please contact the law firm or organization that holds them; if you write to us, we will forward your request to that customer.

9. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children through the website or application. Records that customers upload may concern minors; they are handled as described in Section 3.

10. Changes to this policy

We will post any update here with a new effective date. If we make a material change, we will also notify account holders by email at least 15 days before it takes effect.

11. Contact

Medcron LLC
385 S. Manchester Ave., Apt. 1073
Orange, CA 92868
support@medcron.net