Handling medical records with care
Medical records are sensitive. These are the controls Medcron applies to every order.
Multi-factor sign-in
Every account needs a password of at least 12 characters and an authenticator app code. Records are never available without both.
Separate firm workspaces
Each firm's orders are isolated from every other firm's by the application and by database row-level security.
No outside AI services
Records are read and processed on hardware Medcron controls. They are not sent to third-party AI or cloud language-model services.
No training on your records
Your records and corrections are used only to prepare your chronology. They are not used to train models.
Automatic deletion
Order files are deleted automatically 14 days after the order starts, or 14 days after it's created if it's never started. Encrypted backups of them expire within about eight further days.
Encrypted connections and storage
The application is served only over HTTPS. Records are kept in encrypted storage on servers Medcron controls in the United States, and backups are encrypted. Payment details are handled by Stripe and never reach Medcron.
Access records
Reads, downloads, reviews and approvals are recorded in an access log that lists who acted and when, without record content.
Human release
No chronology is delivered until a reviewer has checked it and approved its exact files.
Incident notification
If the security of records we hold for your firm is breached, we notify you immediately following discovery. Under our business associate agreement, we report within ten business days at most.
No subprocessors for records
No third party stores or processes your records. Our email, payment, website and DNS providers receive only the limited information described in our Privacy Policy.
Business associate agreements
Firms that act as business associates of health care providers or health plans can rely on our Business Associate Agreement. It becomes part of our Terms when such a firm sends us protected health information, and we countersign a copy on request.
Questions
For security questions or to report a concern, write to support@medcron.net.