Effective date: July 13, 2026 · Company: Mahlum Innovations LLC d/b/a Chronos
Please read these Terms carefully. This Master Subscription Agreement governs your access to and use of the Chronos platform. By executing an Order Form, clicking "I agree," or using the Service, you agree to this Agreement on behalf of yourself and your firm.
2.1 Provision of Service. Subject to this Agreement and payment of fees, Chronos grants Customer a non-exclusive, non-transferable right during the subscription term for its Users to access and use the Service for Customer's internal legal-practice purposes.
2.2 User Accounts. Customer is responsible for (a) provisioning and deprovisioning Users promptly, (b) the confidentiality of credentials, and (c) all activity under its Users' accounts. Multi-factor authentication (TOTP) is mandatory for all Users and cannot be disabled.
2.3 Support; Service Levels. Chronos will provide support and uptime commitments as described in the Chronos Service Level Agreement (SLA), incorporated by reference.
2.4 Changes to the Service. Chronos may enhance or modify the Service, provided no change materially degrades the core functionality, security commitments, or AI data-handling commitments (Section 5) during a paid subscription term. Chronos will provide at least 30 days' notice of any material adverse change.
2.5 Beta Features. Features identified as beta or early access are provided "as is" and are excluded from the SLA — but all data-handling commitments in Sections 5, 6, and 7 (no-training, zero-retention, confidentiality, security) apply to beta features without exception.
3.1 Customer Owns Customer Data. As between the parties, Customer owns all right, title, and interest in and to Customer Data. Customer grants Chronos a limited, non-exclusive license to host, copy, transmit, and process Customer Data solely (a) to provide, secure, and support the Service at Customer's direction; (b) to comply with law; and (c) as otherwise instructed by Customer in writing. Chronos acquires no other rights in Customer Data.
3.2 Customer Owns Outputs. As between the parties, Customer owns all right, title, and interest in and to the Outputs. To the extent Chronos holds any intellectual-property rights in Outputs, Chronos hereby assigns them to Customer upon generation. Chronos claims no ownership of any Output.
3.3 Responsibility for Customer Data. Customer represents that it has the legal right to upload Customer Data and to direct its processing as contemplated here.
3.4 Aggregate Statistics. Chronos may generate and use aggregate, de-identified operational metrics to operate and improve the Service. Aggregate Statistics never include PHI, Customer Data content, Output content, or any information identifiable to Customer or any individual, and are never used to train AI models.
⚠ Attorney supervision required
THE OUTPUTS ARE AI-GENERATED DRAFTS PROVIDED AS A STARTING POINT FOR ATTORNEY WORK. OUTPUTS MAY CONTAIN ERRORS, OMISSIONS, MISREADINGS, OR HALLUCINATIONS. EVERY OUTPUT MUST BE REVIEWED AND VERIFIED BY A LICENSED ATTORNEY OR QUALIFIED PROFESSIONAL BEFORE ANY USE IN A CLIENT MATTER, DEMAND, PLEADING, FILING, OR SUBMISSION.
4.1 Verification Aids. The Service provides per-line source-page citations linking each extracted event to the specific page(s) of the underlying medical record as a verification aid. Customer remains solely responsible for verifying each entry against the source record.
4.2 No Legal or Medical Advice. Chronos is a software provider. The Service and Outputs do not constitute legal advice, medical advice, expert opinion, or the practice of law or medicine, and no attorney-client, physician-patient, or fiduciary relationship is created between Chronos and Customer or any Firm client.
4.3 Customer's Professional Responsibility. Customer is solely responsible for its use of Outputs, for compliance with all applicable rules of professional conduct, court rules and standing orders regarding AI-assisted work product, and for the accuracy of anything Customer files or serves.
This Section may not be modified except in a writing signed by both parties.
5.1 No Training. Chronos will not use Customer Data or Outputs (or any data derived from them) to train, fine-tune, retrain, or otherwise improve any artificial-intelligence or machine-learning model, whether Chronos's own or any third party's. There is no opt-out to exercise because there is no training use to opt out of.
5.2 Zero Retention at the Model Layer. AI inference is performed through the Aptible AI Gateway under a signed Business Associate Agreement with zero data retention: only the parsed text necessary for the specific request is transmitted per-request; model providers do not retain inputs or outputs after the response is returned, do not log prompt content for human review, and do not use inputs or outputs for training.
5.3 Flow-Down to Model Providers and Subprocessors. Chronos will only route Customer Data to model providers and Subprocessors that are bound by written contractual commitments at least as protective as Sections 5.1 and 5.2 and, where Customer Data includes PHI, a BAA or equivalent. Chronos will not use any consumer-tier AI service to process Customer Data.
5.4 Subprocessor Change Notice. Chronos will update the subprocessors list and provide notice at least 30 days before adding a new Subprocessor that will process Customer Data.
5.5 No Cross-Customer Use. Customer Data and Outputs are logically segregated per firm and are never shared with, disclosed to, or made accessible to any other Chronos customer.
5.6 Survival. The commitments in this Section 5 apply from first upload and survive termination for as long as Chronos retains any Customer Data or Outputs.
6.1 Confidential Information. "Confidential Information" means non-public information disclosed by one party to the other that is designated confidential or that reasonably should be understood to be confidential, including Customer Data, Outputs, Firm client information, matter information, and the terms of this Agreement. Customer Data and Outputs are Customer's Confidential Information without need for marking.
6.2 Obligations. The receiving party will (a) use Confidential Information only to perform under or exercise rights granted by this Agreement; (b) not disclose it except to employees, Affiliates, and contractors with a need to know who are bound by obligations at least as protective; and (c) protect it with at least the care it uses for its own similar information and no less than reasonable care. These obligations survive termination; for Customer Data and Outputs they survive indefinitely.
6.3 Privilege and Work-Product Acknowledgment. The parties acknowledge and intend that: (a) Customer Data and Outputs may constitute attorney-client privileged communications and attorney work product; (b) Chronos processes Customer Data solely as a technology vendor acting at the direction of Customer's attorneys; (c) the confidentiality, no-training, and zero-retention commitments of this Agreement are intended to preserve Customer's and its clients' reasonable expectation of confidentiality; and (d) neither the use of the Service nor Chronos's processing of Customer Data is intended to effect any waiver of privilege or work-product protection.
6.4 Compelled Disclosure. If Chronos is subject to a subpoena, court order, or other legal demand for Customer Data or Outputs, Chronos will (unless legally prohibited) promptly notify Customer before disclosure and reasonably cooperate, at Customer's expense, with Customer's efforts to quash, limit, or obtain protective treatment. Chronos will disclose only the minimum required.
6.5 No Conflicts Screening Role; Ethical Walls. Chronos maintains per-firm logical segregation and will never disclose to any customer the identity of any other customer's matters, clients, or data.
7.1 Security Program. Chronos maintains a written information-security program with administrative, technical, and physical safeguards appropriate to PHI and privileged legal materials, aligned with the HIPAA Security Rule, including: hosting on Aptible (HIPAA-eligible, dedicated stack, signed BAA); AES-256 encryption at rest; TLS encryption in transit; PITR backups; mandatory TOTP MFA (fail-closed); role-based access control; per-firm append-only exportable audit log; and vulnerability management with no PHI in development environments.
7.2 Customer Data Controls. The Service provides customer-controlled atomic hard purge (permanent deletion on demand) and per-firm retention settings with automated nightly purge. Customer is responsible for configuring retention consistent with its own legal-hold and client obligations.
7.3 Compliance Posture. Chronos is HIPAA-aligned and signs a BAA with every account. Chronos operates a SOC 2 readiness program. Chronos does not represent that it holds SOC 2 certification or any government "HIPAA certification." Upon reasonable request (no more than once per 12 months), Chronos will complete a reasonable security questionnaire under NDA.
7.4 Security Incident Notice — 72 Hours. Chronos will notify Customer without undue delay and in no event later than 72 hours after confirming a Security Incident. This Section supplements breach-notification obligations in the BAA and applicable law.
7.5 Data Location. Customer Data is stored and processed in the United States.
Customer's use of the Service is subject to the Chronos Acceptable Use Policy (AUP), incorporated by reference. In summary, Customer will not: (a) upload data it lacks the right to process; (b) use the Service to violate law or professional-conduct rules; (c) attempt to probe, breach, or circumvent security controls or MFA; (d) reverse-engineer, scrape, or benchmark the Service to build a competing product; (e) resell or provide service-bureau access to non-Users; or (f) use the Service for any purpose other than legitimate legal-practice work. Chronos may suspend access for material AUP violations, with notice and an opportunity to cure where practicable.
9.1 Fees. Customer will pay the fees stated in the applicable Order Form or checkout flow. Except as expressly provided in this Agreement, fees are non-refundable.
9.2 Billing via Stripe. Subscription fees are billed through Stripe on the cycle stated in the Order Form (monthly or annual). Customer authorizes recurring charges to its payment method. Chronos does not store full card numbers.
9.3 Renewal. Subscriptions automatically renew for successive periods equal to the then-current term unless either party gives notice of non-renewal at least 30 days before the end of the then-current term (Customer may also cancel auto-renewal in-app). Chronos may change pricing effective upon renewal with at least 45 days' prior notice.
9.4 Late Payment; Suspension. Undisputed amounts more than 15 days overdue may accrue interest at the lesser of 1.5% per month or the maximum lawful rate. Chronos may suspend access for amounts more than 30 days overdue, after at least 10 days' written notice. Suspension does not delete Customer Data, and Sections 5–7 continue to apply during suspension.
9.5 Taxes. Fees exclude taxes; Customer is responsible for applicable sales, use, and similar taxes (excluding taxes on Chronos's income).
10.1 Term. This Agreement runs from the effective date of the first Order Form until all Order Forms have expired or terminated.
10.2 Termination for Cause. Either party may terminate this Agreement or an affected Order Form if the other party (a) materially breaches and fails to cure within 30 days of written notice, or (b) becomes insolvent or subject to bankruptcy proceedings not dismissed within 60 days.
10.3 Termination by Customer for Convenience. Monthly-plan Customers may terminate this Agreement or any Order Form for convenience at any time, effective at the end of the then-current billing period; fees already paid are non-refundable. Annual-plan subscriptions run for the full Subscription Term and may not be terminated for convenience, unless otherwise stated in an Order Form.
10.4 Effect of Termination; Refunds. Upon termination by Customer for Chronos's uncured material breach, Chronos will refund prepaid fees for the unused remainder of the Subscription Term.
10.5 Data Return and Deletion — 30-Day Window. For 30 days after expiration or termination, Chronos will make the Service available in export-only mode at no charge so Customer can retrieve Customer Data and Outputs. After the 30-day window, Chronos will permanently and irreversibly purge all Customer Data and Outputs from production systems within 7 days. Residual copies in encrypted backups age out on the hosting provider's fixed retention schedule (daily 30 days / monthly 12 months / yearly 6 years) and are never restored except for disaster recovery. Upon written request, Chronos will certify deletion.
10.6 Survival. Sections 3, 4, 5, 6, 7.4, 10.5, 11, 12, 13, 15, and 16 survive termination.
11.1 Mutual Warranties. Each party warrants that it has the authority to enter into this Agreement and that it will comply with laws applicable to its performance.
11.2 Chronos Warranties. Chronos warrants that during the Subscription Term: (a) the Service will perform materially in accordance with the Documentation; (b) Chronos will not materially diminish the security protections described in Section 7; and (c) Chronos will provide the Service in a professional and workmanlike manner. Customer's exclusive remedies for breach of (a) are re-performance/repair and, if Chronos cannot cure within 30 days, termination of the affected Order Form with a pro-rata refund of prepaid, unused fees.
11.3 DISCLAIMER. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICE, AI FEATURES, AND OUTPUTS ARE PROVIDED "AS IS," AND CHRONOS DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITING SECTION 4, CHRONOS DOES NOT WARRANT THAT OUTPUTS WILL BE ACCURATE, COMPLETE, OR ERROR-FREE, THAT THE SERVICE WILL BE UNINTERRUPTED (UPTIME COMMITMENTS ARE EXCLUSIVELY AS STATED IN THE SLA), OR THAT THE SERVICE WILL SATISFY ANY COURT RULE OR PROFESSIONAL OBLIGATION APPLICABLE TO CUSTOMER.
12.1 Chronos IP Indemnity. Chronos will defend Customer against any third-party claim alleging that the Service (excluding Customer Data and Outputs) infringes a U.S. patent, copyright, or trademark or misappropriates a trade secret, and will indemnify Customer against damages, costs, and reasonable attorneys' fees finally awarded or agreed in settlement. This Section does not apply to claims arising from Customer Data, combination with items not provided by Chronos, or use in violation of this Agreement.
12.2 Customer Indemnity. Customer will defend Chronos against any third-party claim arising from (a) Customer Data, including any claim that Customer lacked the right to upload or process it, or (b) Customer's use of Outputs in client matters, filings, or demands, except to the extent the claim results from Chronos's breach of this Agreement; and will indemnify Chronos against damages, costs, and reasonable attorneys' fees finally awarded or agreed in settlement.
12.3 Procedure. The indemnified party must give prompt notice, sole control of defense and settlement to the indemnifying party (no settlement imposing non-monetary obligations on the indemnified party without its consent), and reasonable cooperation at the indemnifying party's expense.
13.1 No Consequential Damages. EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, OR LOSS OF DATA (OTHER THAN LOSS CAUSED BY CHRONOS'S BREACH OF SECTIONS 5, 6, OR 7), EVEN IF ADVISED OF THE POSSIBILITY.
13.2 General Cap. EXCEPT FOR EXCLUDED CLAIMS AND ENHANCED CLAIMS, EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER IN THE 12 MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY.
13.3 Enhanced Cap for Data Claims. FOR CLAIMS ARISING FROM CHRONOS'S BREACH OF SECTION 5 (AI DATA COMMITMENTS), SECTION 6 (CONFIDENTIALITY), SECTION 7 (SECURITY, INCLUDING A SECURITY INCIDENT), OR THE BAA/DPA ("ENHANCED CLAIMS"), CHRONOS'S AGGREGATE LIABILITY WILL NOT EXCEED 2× THE GENERAL CAP OR $1,000,000, WHICHEVER IS GREATER.
13.4 Excluded Claims. Nothing in this Agreement limits liability for: (a) a party's gross negligence, fraud, or willful misconduct; (b) Customer's payment obligations; (c) either party's indemnification obligations under Section 12; or (d) any liability that cannot be limited under applicable law.
13.5 Basis of the Bargain. The parties agree the limitations above are a reasoned allocation of risk reflected in the pricing and would apply even if a limited remedy fails of its essential purpose.
During the Subscription Term, Chronos will maintain: (a) cyber liability / technology errors & omissions insurance with limits of at least $1,000,000 per claim / $2,000,000 aggregate; (b) commercial general liability of at least $1,000,000 per occurrence; and (c) any statutorily required coverage. Upon request, Chronos will provide certificates of insurance annually.
15.1 Governing Law. This Agreement is governed by the laws of the State of Montana, without regard to conflict-of-laws rules.
15.2 Forum. The state and federal courts located in Flathead County, Montana have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and each party consents to personal jurisdiction and venue there. There is no mandatory arbitration under this Agreement.
15.3 Jury Waiver; No Class Actions. TO THE EXTENT PERMITTED BY LAW, EACH PARTY WAIVES TRIAL BY JURY, AND DISPUTES WILL BE BROUGHT ONLY ON AN INDIVIDUAL BASIS AND NOT AS A CLASS OR REPRESENTATIVE ACTION.
15.4 Injunctive Relief. Either party may seek injunctive or equitable relief in any court of competent jurisdiction for breach of Sections 5, 6, or 8 or infringement of intellectual property, without posting bond.
15.5 Attorneys' Fees. Each party bears its own attorneys' fees and costs.
16.1 Order of Precedence. In case of conflict: (1) the BAA (PHI/HIPAA matters); (2) the DPA, if any (data protection); (3) the Order Form (commercial terms, only where it expressly amends this Agreement); (4) this Agreement; (5) the SLA; (6) the AUP and Documentation. No term in the SLA, AUP, or Documentation reduces the protections of Sections 5–7.
16.2 Entire Agreement; Amendments. This Agreement (with its Order Forms, exhibits, BAA, DPA, SLA, and AUP) is the entire agreement and supersedes prior discussions. Terms on a Customer purchase order or vendor-onboarding portal are void even if signed or clicked. Chronos may update these Terms for new subscription terms with 30 days' notice.
16.3 Assignment. Neither party may assign this Agreement without the other's consent, except either party may assign it in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations (including Sections 5–7) and Chronos gives Customer notice.
16.4 Notices. Legal notices to Chronos: Mahlum Innovations LLC, Attn: Legal, 850 Holt Drive, Bigfork, MT 59911, with a copy to legal@medchronosai.com.
16.5 Force Majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, except payment obligations and except that force majeure does not excuse Chronos's breach-notice obligation in Section 7.4.
16.6 Independent Contractors; No Third-Party Beneficiaries. The parties are independent contractors. There are no third-party beneficiaries; Firm clients are not parties to this Agreement, though Sections 5 and 6 are intended to protect their information.
16.7 Publicity. Chronos will not use Customer's name or logo publicly without Customer's prior written consent.
16.8 Severability; Waiver. Invalid provisions are reformed to the minimum extent necessary; failure to enforce is not waiver.
Questions about these Terms? Contact us:
Mahlum Innovations LLC d/b/a Chronos
Legal: legal@medchronosai.com
Billing: billing@medchronosai.com
850 Holt Drive, Bigfork, Montana, United States
See also: Privacy Policy · Acceptable Use Policy · SLA · Security overview