Trial only — 30-day trial; permanent free habit access not established.1
Client-side charges
Not established — not in the amount
Platform
Not recorded
Observed in an account
No. Everything on this page is documented from the vendor's pages and store listings that were read.
What we could not establish
Nutrition-specific scope; arbitrary recurring habit assignment not established.
Unlimited additional paid seats is metered capacity, not a fixed-price unlimited plan.
Annual billing not established.
No account test or regulatory suitability assessment.
Regulated use — lay reading
Lay reading. What each vendor's own pages say about US HIPAA and Ontario PHIPA, read by habit.report, without legal training. Not legal advice. A vendor's account of the law is not a source for the law. Each feature is assessed separately; evidence for one never covers another.
US HIPAA-covered activity
Not assessed — Contractual and operational suitability not assessed.
Ontario PHIPA-subject activity
Not assessed — Contractual and operational suitability not assessed.
Regulatory features — what the vendor's pages state
Data entry
Vendor states: Terms: "By accepting an invitation from a Pro, a Client consents to the Pro having access to their Account, including the ability to view, add, delete, modify, and comment on the Client's information."2· checked 21 Oct 2026
Hosting
Vendor states: Privacy policy: information is stored "in the cloud and on secure, HIPAA compliant servers in the United States" (the vendor's words), by Cronometer or its third-party service providers; the security page lists "Multi-region cloud provider locations". Terms: the Services may be made available through servers not owned or controlled by Cronometer. Providers are not named.342· checked 21 Oct 2026
Messages
Vendor states: Privacy policy: a user may "send a message to another user or defined group of users through our message, chat, post or other function"; terms: users "may also receive messages and other electronic communications from other users" and can manage them in account settings. No protections are described.32· checked 21 Oct 2026
Notifications
Vendor states: Privacy policy: Cronometer "may occasionally send you updates, patches and related push notifications", and if push is enabled may use a device ID or email address to send them. What notifications contain is not described.3· checked 21 Oct 2026
Attachments
Not stated
Video
Not stated
Exports
Vendor states: Security page: "You have the freedom to export or delete all your data at any time." Privacy policy: on an access request, copies "in a portable and readily usable format". Terms: Pros "may not download, store, or transfer Client data outside of the Services unless expressly authorized by the Client".432· checked 21 Oct 2026
Integrations
Vendor states: Privacy policy: data from a user's Health Connect application when the user gives permission, data from other third-party applications with consent, and "professionals and third party apps which you have connected to your account".3· checked 21 Oct 2026
AI features
Vendor states: Privacy policy: "AI assistant available for our 'Pro' accounts, where we provide certain limited information to OpenAI with your consent", possibly including diary data, anthropometrics and targets, under a Business Associate Agreement with OpenAI for covered-entity customers; a service provider helps analyse uploaded food photos; food photos and related corrections are used "to train and improve our models and artificial intelligence".3· checked 21 Oct 2026
US business associate agreement
Vendor states: Privacy policy refers to organizations that are HIPAA Covered Entities "with which we have a Business Associate Agreement" (and to a Business Associate Agreement between Cronometer and OpenAI), and says PHI use and sharing will follow "the terms and conditions of any applicable Business Associate Agreement". Which plan includes a BAA, and how to obtain one, are not stated.3· checked 21 Oct 2026
Canada or Ontario
Vendor states: Privacy policy and terms: Cronometer Software Inc. is in British Columbia, Canada, "operated from and.. headquartered in the Province of British Columbia", and the documents are governed by British Columbia law; the privacy policy has a notice for Canadian residents and says servers are "in the United States", with possible access by foreign authorities. PHIPA and Ontario do not appear on the pages read.32· checked 21 Oct 2026
Where a statement above quotes the vendor's own words about the law, they are the vendor's words, quoted, not adopted.
Evidence
1. Cronometer Pro · cronometer.com/pro/ Vendor page · Read 21 Oct 2026 · No copy saved Professional edits nutrition targets and reviews client food diaries.USD39.99/month includes10seats; each additional seat2.50/month, dynamically billed. Example12clients44.99.30-day trial. Clients receive Gold while linked. No fixed-price unlimited subscription.
2. Cronometer terms of service · cronometer.com/terms/ Vendor page · Read 21 Oct 2026 · No copy saved Read by searching the full text. Pro Accounts: "By accepting an invitation from a Pro, a Client consents to the Pro having access to their Account, including the ability to view, add, delete, modify, and comment on the Client's information"; "Pros are solely responsible for ensuring that Client data is handled in compliance with applicable privacy laws"; "Pros may not download, store, or transfer Client data outside of the Services unless expressly authorized by the Client and in compliance with all applicable laws." "Cronometer does not verify the qualifications or compliance of Pros with healthcare regulations." Messages: "You may also receive messages and other electronic communications from other users. You can manage the communications you receive from other users.. by managing the settings on your Account(s)." Hosting: "Cronometer may make the Services available through servers that are not owned or controlled by Cronometer"; "This Site is operated from and Cronometer is headquartered in the Province of British Columbia, Canada". AI: terms only prohibit using Content to train AI models; they describe no AI feature. Governing law: British Columbia and federal laws of Canada. No PHIPA or Ontario text.
3. Cronometer privacy policy · cronometer.com/privacy/ Vendor page · Read 21 Oct 2026 · No copy saved Read by searching the full text. Hosting: "Cronometer or our third party service providers retain and store information.. in the cloud and on secure, HIPAA compliant servers in the United States. As Cronometer and some of our third party service providers may retain and store information.. outside of Canada.. courts, law enforcement agencies, regulatory agencies or security authorities in those other provinces or foreign jurisdictions may be entitled to access users' information." AI: "AI assistant available for our 'Pro' accounts, where we provide certain limited information to OpenAI with your consent.. If your organization is a Covered Entity under HIPAA with which we have a Business Associate Agreement, it may enable this feature and if so.. we will provide OpenAI with certain limited information under our Business Associate Agreement with OpenAI." "Food photo AI analytics functionality: we may use a service provider to assist us with the capture, analysis, and correction of food photos". "using the food photos and related comments and corrections you provide to train and improve our models and artificial intelligence". PHI: "We will manage your PHI in accordance with applicable health information privacy legislation, such as HIPAA."; "in conformity with the terms and conditions of any applicable Business Associate Agreement." Messages: "If you choose to send a message to another user or defined group of users through our message, chat, post or other function, we may collect any information you may disclose". Push: "If you choose to enable push notifications, we may use your information such as a device ID or email address". Integrations: "If you give Cronometer permission to access data from your Health Connect application"; "other sources, such as third-party applications, with your consent"; "professionals and third party apps which you have connected to your account". Export: copies "in a portable and readily usable format". Canada: a section "ADDITIONAL PRIVACY NOTICE TO RESIDENTS OF THE EUROPEAN UNION, UNITED KINGOM AND CANADA"; "governed and interpreted pursuant to the laws of the Province of British Columbia, Canada". Searched for PHIPA and Ontario: no match. No BAA plan or how-to-obtain text.
4. Cronometer data security page · cronometer.com/features/data-security.html Vendor page · Read 21 Oct 2026 · No copy saved Read in full (short page). Title: "Privacy-First Nutrition App | HIPAA & GDPR Compliant | Cronometer". Bullets: "Multi-region cloud provider locations", "Regular vulnerability scans of our software", "Regular disaster recovery drills". "We not only adhere but exceed the highest standards of data protection, including HIPAA, GDPR and CCPA compliance." "You have the freedom to export or delete all your data at any time." The page names no provider, country, BAA, Canada or Ontario text and nothing on messages, notifications, attachments, video, integrations or AI.