Trust & legal
One place for everything legal.
ClearReport stores legally sensitive incident reports for licensed California assisted living facilities. We expose every document an IT team, privacy officer, or compliance reviewer is likely to ask for — directly on this page, no email exchange required for the public docs.
For documents marked “available on request” (MSA), email contact@useclearreport.com and we'll get a signed version to you within two business days.
Public documents
Privacy Policy
PublicWhat we collect, why, with whom we share it, your rights under CCPA/CPRA, and how long we keep it.
Required reading for every customer.
Terms of Service
PublicThe contract governing your use of ClearReport. Billing, AI disclaimer, liability cap, governing law.
Required reading for every customer.
Security Overview
PublicEncryption, access control, audit logging, backups, breach response. The doc your IT team will want.
Hand this to a security reviewer for first-pass evaluation.
Data Processing Addendum (DPA)
PublicHow we process customer personal information on your behalf. CCPA/CPRA service-provider terms, GDPR-compatible language.
Enterprise IT teams and privacy counsel will want this.
Acceptable Use Policy (AUP)
PublicWhat you can't do with ClearReport. Standalone version of the rules summarized in our Terms.
Required for some enterprise procurement reviews.
Subprocessor list
PublicEvery third party that processes customer data on our behalf, what they do, and where they're located.
Updated when subprocessors change. We notify in writing 30 days before any change with access to report content.
Business Associate Agreement (BAA)
Not offeredNot currently offered. RCFEs are generally not HIPAA covered entities. Published for reference so a compliance reviewer can see the terms we would expect to operate under if we pursue HIPAA readiness.
If you are a covered entity, talk to us before purchasing.
Available on request
Compliance posture
CCPA / CPRA
In scope. We operate as a service provider; consumer-request workflow documented in Privacy Policy.
HIPAA
ClearReport does not sign BAAs today and does not hold itself out as a HIPAA Business Associate. California RCFEs are generally not HIPAA covered entities, so most customers do not need one. If your organization is a covered entity (for example, you also operate a skilled-nursing facility), email contact@useclearreport.com before purchasing and we will tell you honestly whether ClearReport fits your requirements.
CMIA and Title 22
HIPAA is not the only law that applies. California's Confidentiality of Medical Information Act (Civil Code § 56 et seq.) may apply to a licensed RCFE and to the medical information in its records, and Title 22 (22 CCR § 87506 and related sections) requires residents' records to be kept confidential and retained. Reports of suspected abuse (SOC 341) are confidential under Welfare and Institutions Code § 15633.
22 CCR § 87211
Embedded directly into AI prompts and deadline engine. Updated when CDSS publishes revisions.
SOC 2
Type I planned once we cross 25 paying customers or a contractual requirement. Until then, ask us for a walkthrough.
Penetration testing
Not yet performed. We'll commission one prior to enterprise contracts requiring it.
Incident notification SLA
72 hours from confirmed unauthorized access. See Security Overview.
Last reviewed October 16, 2026. When a document that organizations accept changes, we tell you in advance and ask an administrator to accept the new version in the app.
Operated by Skdaddle LLC — California assisted living incident reporting.