Compliance & Legal
Self-declared regulatory positioning · Positionnement réglementaire auto-déclaré
Last updated: 5 August 2026 · compliance-1.0
1. Not a medical device reference only
EN. ChronoPill provides reference information about medicines from official sources. It is not a medical device and does not provide clinical decision support, diagnosis, prescription advice, or treatment recommendations. Always consult a qualified healthcare professional. This positioning is self-determined and documented, on the following basis:
- EU - Regulation (EU) 2017/745 (MDR) & MDCG 2019-11 software qualification: informational reference, not decision support.
- USA - FDA 21st Century Cures Act: non-device Clinical Decision Support exemption (informational, transparent official sources, independently reviewable by the user).
- UK - MHRA: informational reference, not a medical device.
- Japan - PMD Act: informational reference, not a medical device.
FR. ChronoPill fournit une information de référence sur les médicaments, issue de sources officielles. Ce n'est pas un dispositif médical et n'assure aucune aide à la décision clinique, diagnostic, ni recommandation de traitement. Consultez toujours un professionnel de santé.
2. Data protection & privacy by design
EN. ChronoPill is built privacy-first: your medication data, schedules and health metrics (HealthKit height/weight) are stored locally on your device and are never transmitted to our servers. Our reference/clinical database layer contains no personal or identifiable patient data (no PHI). We use no advertising or third-party tracking SDKs. We self-declare compliance with the applicable data-protection law of each market where the app is offered:
| Market | Applicable data-protection framework |
|---|---|
| 🇪🇺 EU / 🇫🇷 France | GDPR / RGPD (health data = special category, Art. 9); FR: hosting on HDS-certified infrastructure; EHDS / EU Data Act |
| 🇺🇸 USA | HIPAA (by design outside scope: no PHI stored server-side; safeguards aligned where applicable), HITECH, CCPA/CPRA |
| 🇬🇧 United Kingdom | UK GDPR + Data Protection Act 2018 |
| 🇦🇩 Japan | APPI (health data = sensitive; consent-based) |
| 🇨🇦 Canada | PIPEDA + provincial (PHIPA Ontario, Law 25 Québec) |
| 🇲🇦 Morocco | Loi 09-08 + CNDP |
FR. Données de santé stockées localement sur l'appareil, jamais transmises à nos serveurs ; la couche de référence ne contient aucune donnée personnelle. Conformité auto-déclarée au cadre de protection des données applicable dans chaque marché.
3. Security & hosting
EN. ChronoPill's backend runs on Amazon Web Services (AWS), whose infrastructure is independently certified (ISO/IEC 27001, 27017, 27018, SOC 2; HDS-certified regions available; Business Associate Agreement available for HIPAA). ChronoPill targets ISO/IEC 27001 and 27701 and SOC 2 Type II for its B2B / hospital offering; these are pursued through independent third-party audit and are not claimed as obtained unless a valid certificate is held.
4. Interoperability & source compliance
EN. Clinical coding in each market uses that country's official terminologies: ICD-10 (national editions), MedDRA (MedDRA/J in Japan), SNOMED CT (UK & US editions), dm+d (UK), YJ code (Japan), UNII/RxNorm (US), BDPM (France), AMMPS/EAN-13 (Morocco), ATC. Every data value carries per-field provenance; inferred or cross-country values are explicitly flagged, never presented as official source data.
Target markets & languages
Markets: European Union (incl. France), United States, United Kingdom, Canada, Japan, Morocco.
Authoritative languages of this notice: English, Français. Localized versions (العربية / 日本語 and other market languages) are provided for convenience only and will be reviewed by qualified counsel; in case of discrepancy the English or French version prevails.
This notice is a good-faith self-declaration of ChronoPill's regulatory positioning and does not constitute legal advice. Questions: contact us via the app or website.