Security

Last updated: 10 October 2026. How ChronoPill protects your data, in plain words. The legal reference is our Privacy Policy.

1. On your device

Your medications, doses, notes and profiles are stored in the app's private storage on your phone. On iPhone, this database is encrypted by iOS file protection, which relies on your device passcode, and it is excluded from iCloud and device backups. On Android, it is kept in storage that only the app can access, and Google cloud backup is turned off for the app. ChronoPill has no cloud sync between devices.

You can add an app lock with Face ID, Touch ID or another biometric unlock, or a PIN of 4 or 6 digits. The PIN is stored only as a salted hash, and repeated wrong attempts are slowed down.

Sign-in tokens are kept in the iOS Keychain on this device only, or encrypted with a key held by the Android Keystore.

A backup file is encrypted on your device (AES-256-GCM) with a password you choose, before you decide where to save it. ChronoPill never receives the file or the password.

Discreet mode replaces medication and person names in notifications with neutral text.

2. What leaves your device

Each online flow, with what is sent, who receives it and how long it is kept, is listed in Section 2.2 of our Privacy Policy.

• Key points (AI) summaries are requested only after you tap the button. The request carries the official leaflet text, the product name, the country and the reading level, never your medication list, your doses or your profile.
• Box photos (Premium) are processed in memory and are not stored on our servers.
• Usage analytics on iPhone stay off until you turn them on, and no advertising identifier is collected.
• This website sets no cookies and loads no third-party tracker.

3. Caregiver dashboard (iPhone)

When you share a dashboard, your iPhone encrypts your medication list, today's doses and the names (AES-256-GCM) before anything is uploaded. For a share created with the current version of the app, the key is only in the link you give your caregiver, after the # sign, which browsers do not send to servers: our server stores an encrypted copy that it cannot decrypt.

To show a summary, the number of doses taken and planned today, a percentage and the time of the last sync are stored unencrypted. A share created with an earlier version of the app uses a key derived from its share code, which our server also receives: create a new share to replace it.

Anyone who has the complete link can open the dashboard until the share expires or you revoke it, so share the link the way you would share a key. A share is deleted when you revoke it, when the access time you chose ends, and at the latest 30 days after the last sync.

The stored copies are also encrypted at rest with AWS Key Management Service.

4. Our servers

Our servers run on Amazon Web Services (AWS). Accounts, purchases, support requests and caregiver copies are stored in the United States (US East).

Connections use HTTPS with TLS 1.2 or newer, and plain HTTP is redirected to HTTPS. For our main servers, the apps accept only certificates from the certificate authorities we expect.

The configuration file that the apps download is signed, and the apps check the signature before using it. Drug databases are delivered encrypted for your device.

Stored data is encrypted at rest by AWS. We never store your password, only a salted hash of it. The keys that our servers use to call other services are kept in a dedicated secrets service, not in the code.

Each server function runs under its own access role. Sign-in, verification codes and password resets are rate limited.

Our server logs are designed not to contain personal data: account identifiers are shortened, email addresses are masked, and the text you send for an AI summary is not logged. An automated check runs on code changes to catch code that would log request or health data.

Access to the stored caregiver copies, to stored email and to the account and support databases is recorded in audit logs. Security and audit logs are kept for at least 6 years.

Our account and support databases can be restored to an earlier point in time, up to 35 days back, and are protected against accidental deletion.

Before an app version is released, an automated check suite runs on it, including a scan for leaked secrets, a scan of dependencies for known vulnerabilities, static analysis and tests.

5. Deletion

You can export your data, erase it from your device or delete your account directly in the app, as described in Section 5 of our Privacy Policy.

Deleting your account in the app removes your account record from our live systems at once; copies in our database backups are gone within 35 days.

Support requests are deleted automatically 24 months after they are written. Please do not include medical details in a support request: support does not need them to help you.

6. Reporting a security problem

If you believe you have found a security vulnerability in ChronoPill, write to contact@chronopill.com with a subject line that starts with the word Security. Describe what you found and where, and leave personal data, health data and working exploit details out of the first message.

Test only with your own accounts, devices and data. Do not access, change or delete other people's data, and do not run denial-of-service tests or send spam.

7. For healthcare organisations

We maintain a documented security programme, aligned with the HIPAA Security Rule.

Our cloud providers, AWS and Google Workspace, are under HIPAA business associate agreements (BAA).

Each agreement covers the services that its provider lists as eligible.

Security documentation is available to healthcare organisations on request: contact@chronopill.com.

Partnerships: we work with healthcare organisations on pilots, licensing and integrations. Our HIPAA readiness programme is underway; we will say so on this page when it is complete.

8. What we do not claim

• ChronoPill is a consumer app that you install yourself. It is not a HIPAA covered entity.
• This alignment is our own work: no authority or independent auditor has reviewed or certified it, and ChronoPill does not claim to be HIPAA compliant.
• ChronoPill holds no security or privacy certification. The certifications of AWS cover its own infrastructure, not ChronoPill.
• ChronoPill has not had an independent security audit or penetration test; our testing so far uses automated scanning tools.
• ChronoPill is not a medical device.
• No system is perfectly secure.