Privacy Policy

This Privacy Policy explains how A2 Foundry, Inc. ("A2 Foundry," "we," "us") collects, uses, and protects your information when you use Chrona.

1. Products covered

This policy covers three Chrona products operated by A2 Foundry, Inc.:

• Chrona Enterprise — the web application at app.chronabio.ai and the enterprise-deployed Word Add-in. Used by regulatory teams at biotech companies. Reads documents from your organization's SharePoint Online via Microsoft Graph API; document content is not copied to A2 Foundry servers.
• Chrona Pro — the Word Add-in distributed via Microsoft Marketplace for individual regulatory writers. Runs entirely inside Microsoft Word's add-in sandbox. Document content never leaves Word. A2 Foundry receives only your authentication identity, your saved rule preferences, and anonymized usage telemetry.
• CTDCommons Viewer — the public reference viewer at commons.chronabio.ai. Account requires email and password only. CTDCommons is a free public archive sponsored by 1Day Sooner. A2 Foundry operates CTDCommons and its viewer registration under its own Terms of Use and this Privacy Policy, and A2 Foundry — not the sponsor — is responsible for the registration information you give us. We may share a limited set of that registration information with 1Day Sooner, as described in Section 5.2.

Where this policy refers to "Chrona" generally, it applies to all three products. Where data behavior differs, the relevant product is named.

2. What we collect

Information you provide: Email address, display name, and organization name when you create an account. For Chrona Pro and Chrona Enterprise users who sign in through Microsoft single sign-on, we receive the identity claims your organization releases (typically email, display name, and tenant identifier).

Information we collect automatically: When you use Chrona we collect usage data including pages visited, features used, browser type, and device information. We collect this through PostHog, our analytics provider, using cookies and similar technologies. The Chrona Word Add-in (both Enterprise and Pro) sends usage telemetry — which ribbon buttons you click, which checks you run, error events — to PostHog. Document content, document text, and the bodies of any rules, comments, or findings inside your document are never included in telemetry.

Information we do not collect: We do not collect or store the contents of your regulatory documents on A2 Foundry infrastructure. For Chrona Enterprise, documents remain in your organization's own storage environment, and structured excerpts are sent to your configured LLM provider at the time of analysis and are not retained by A2 Foundry. For Chrona Pro, document content stays inside the Word add-in sandbox and is not transmitted to A2 Foundry or any third party as part of normal use.

3. How we use your information

We use your information to:

• Operate and maintain your Chrona account
• Provide and improve Chrona's features
• Send you product updates and feature announcements (you can opt out at any time)
• Monitor service performance and fix issues
• Respond to your questions or requests

4. What we don't do

• We do not sell your personal information
• We do not share your information with third parties for their own marketing or fundraising purposes. The CTDCommons sponsor sharing described in Section 5.2 is limited to administering CTDCommons and does not authorize marketing or fundraising unrelated to CTDCommons
• We do not use your information for advertising
• We do not use the content of your regulatory documents to train AI models

5. Who we share with

We share your information in two situations, and only as described below: with the service providers that help us operate Chrona (Section 5.1), and — for CTDCommons only — with the CTDCommons sponsor (Section 5.2).

5.1 Service providers

We share your information with service providers that help us operate Chrona:

These providers access your information only to perform services on our behalf and are not permitted to use it for other purposes.

5.2 The CTDCommons sponsor (1Day Sooner)

1Day Sooner is the sponsor of CTDCommons. 1Day Sooner is not a service provider to A2 Foundry: it does not process information on our behalf, and the sharing described in this section is a separate, limited disclosure rather than part of Section 5.1.

Purpose. We may share CTDCommons registration information with 1Day Sooner so that it can help administer the CTDCommons community and support the continuity of the archive and its communications.

What may be shared. Your email address and, where we have collected it, your name, your organization, your communication preferences, and the consent records relating to CTDCommons.

What is never shared. Passwords and password hashes; authentication tokens, API keys, or any other credentials; your individual usage history in CTDCommons or any other Chrona product; and any information that relates solely to Chrona Enterprise or Chrona Pro. This section applies to CTDCommons registration information only — it does not extend to our other products.

How 1Day Sooner may use it. 1Day Sooner is required to protect the information it receives and to use it only to administer CTDCommons and to communicate with the CTDCommons community, consistent with the notices you were given, the consents you provided, and the communication preferences you set. This does not authorize marketing or fundraising unrelated to CTDCommons.

If the CTDCommons services end. If A2 Foundry stops operating the CTDCommons services, we may provide 1Day Sooner with a portable export of the CTDCommons registration information described above within 30 days after those services end, so that the community and the archive can continue. Any such export is limited to the fields listed above and is subject to applicable law and to any notices and consents that the law requires at that time.

Your choice. If you registered for CTDCommons before this section took effect, we will not share your previously collected registration information with 1Day Sooner unless you give us your explicit consent. We will ask you separately, by email. Continuing to use CTDCommons is not consent, and neither is a change to the "Last updated" date of this policy. Your CTDCommons account and your access to the archive are unaffected by your answer, and you can change your answer at any time by emailing contact@chronabio.ai.

5.3 Legal disclosures

We may also disclose your information if required by law, legal process, or to protect the rights or safety of A2 Foundry, our users, or others.

6. Your LLM provider

When you use Chrona Enterprise features that perform LLM-based analysis (consistency review, abbreviation extraction, dose/unit checks, codename detection), structured excerpts of your document content are sent directly to your configured LLM provider using your own API keys (BYOK). A2 Foundry does not retain these excerpts and does not control how your LLM provider handles them. You are responsible for reviewing your provider's data handling and retention policies.

Chrona Pro does not send document content to any LLM provider at runtime. All checks and custom rules are executed locally inside the Word add-in sandbox.

7. Cookies

We use cookies and similar technologies for session management (keeping you logged in) and analytics (understanding how Chrona is used). We do not use advertising or tracking cookies.

8. Data retention

We retain your account information for as long as your account is active. If you close your account, we will delete your personal information within 30 days, except where we are required to retain it by law.

If the CTDCommons services end, a limited export of CTDCommons registration information may be provided to the CTDCommons sponsor within 30 days — see Section 5.2 for the fields involved and the consent that applies.

For Chrona Enterprise customers, audit trail records (findings, dismissals, sign-offs, readiness snapshots) are retained for the duration of your subscription plus the retention period required by your customer agreement, typically aligned with 21 CFR Part 11 expectations. These records are not deleted on account closure unless explicitly requested in writing and permitted by applicable regulatory retention obligations.

9. Data security

We use industry-standard security measures to protect your information, including encrypted connections (TLS), role-based access controls, and secure hosting infrastructure. Our security practices are documented in our Data Handling & Security documentation, available to customers on request.

10. Your rights

You may:

• Request a copy of the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal information
• Opt out of product communications at any time
• Give or withdraw your consent to the CTDCommons sponsor sharing described in Section 5.2, without losing access to your CTDCommons account

To exercise any of these rights, email us at contact@chronabio.ai.

11. Children

Chrona is not intended for anyone under 18. We do not knowingly collect information from anyone under 18.

12. Regional rights

Depending on your location, you may have additional rights under laws such as the EU/UK GDPR or the California Consumer Privacy Act (CCPA), including rights of access, correction, portability, and deletion. We honor these rights for all users regardless of location. To exercise them, contact us at contact@chronabio.ai.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and notify you via email or in-app notice.

14. Contact

Questions about this Privacy Policy? Reach us at contact@chronabio.ai.