Privacy Policy

ClearReport is a software product operated by Skdaddle LLC(“Skdaddle,” “we,” “us”), a Utah corporation. ClearReport helps licensed California assisted living facilities — Residential Care Facilities for the Elderly (RCFEs) — file incident, death, and suspected-abuse reports required by state law.

This policy explains what data we collect, why, with whom we share it, and the rights you have. It applies to www.useclearreport.com and the ClearReport web application.

• Customers: organizations and facilities that subscribe to ClearReport.
• Users: individual staff members (administrators, facility admins, caregivers, nurses) who file or review reports.
• Subjects of reports: residents, family members, staff, and suspected perpetrators referenced in the regulatory reports our customers file using ClearReport. Skdaddle is a data-processor for our customers' report content — the customer facility is the data controller and is responsible for obtaining any consents required under applicable law.

Account & organization data

• Name, email address, and authentication state (provided to us by Clerk, our identity provider)
• Organization name and Clerk organization ID
• Facility details: name, license file number, phone, address, bed count
• Role assignments (org admin / facility admin / worker) and facility scope
• A record of your organization's acceptance of our Terms (accepting user, timestamp, browser user-agent and a salted one-way hash of the IP address; the raw IP is not stored)

Report content

• Resident name, date of birth, sex, room number, admission date
• Incident narrative: description, immediate actions, witnesses, injuries, location, time
• For LIC 624A (death reports): cause of death, place of death, conditions prior to death
• For SOC 341 (suspected abuse reports): abuse categories, reporter observations, suspected abuser details, last 4 digits of victim SSN, reporter information
• Compliance deadlines, agency notifications, audit log entries
• AI-generated suggestions and risk flags attached to each report

Billing data

• Subscription status, plan, trial end date, facility quantity, invoice history
• Stripe customer ID (we do not store full payment card numbers; those live with Stripe)

Usage data

• Server logs (timestamps, request paths, status codes, IP address, user-agent)
• Audit trail of user actions inside the application (who created/edited/deleted each report, who ran AI review)
• Aggregated usage metrics (number of reports, login frequency, feature use) for product improvement
• Site analytics on our public pages and sign-up flow are first-party and cookieless: we record page paths, a daily-rotating anonymous visitor hash, referrer domain and screen size class, and no analytics vendor receives any data

Things we do NOT collect

• Full social security numbers (SOC 341 stores only the last 4 digits, as required by the form)
• Payment card numbers (handled entirely by Stripe)
• Biometric data
• Location data beyond the facility address you provide
• Tracking cookies for advertising

• Provide the service: store and retrieve incident reports and generate the state PDF forms for you to file. ClearReport does not send reports to any agency; your staff file them.
• AI features: send report text to Anthropic (Claude) for the AI wording review and the Ace advisor. Anthropic does not train on this data per their commercial agreement.
• Authentication and access control: verify your identity (via Clerk) and enforce role-based permissions
• Billing: process subscriptions and invoices via Stripe
• Support: respond to your requests, troubleshoot issues, and view account, billing, facility, team and report metadata (form type, dates, status and resident name) through our audited staff portal to help, and open report content only with your explicit per-incident authorization
• Compliance and security: maintain the audit log, detect abuse, comply with subpoenas and regulator requests
• Product improvement: aggregated, de-identified usage statistics

ClearReport depends on third-party services that process customer data on our behalf. Each is engaged under data-processing terms incorporated in its service agreement.

We'll notify customers in writing at least 30 days before adding a new subprocessor with access to report content.

• Report content: kept while your organization is a customer. Filed reports cannot be deleted in the app; they can only be voided with a reason, and a voided report is kept and marked voided. SOC 341 reports cannot be deleted or voided in the app. Drafts that were never submitted can be deleted. After cancellation we keep your records and do not delete them on a timer: before any deletion we give you written notice and a complete export (PDFs, every field and the audit trail), and we will not delete records you tell us are under a legal hold or still inside your retention period (for example, at least 3 years under 22 CCR § 87506; verify the period that applies to you with counsel).
• Account data: until you delete your account or your organization is removed.
• Audit logs: at least 7 years, and never less than the report records they describe. Audit entries can name residents, which is why they are kept under the same confidentiality rules as reports.
• Billing records: 7 years (IRS requirement).
• AI prompts/responses: retained by Anthropic only for the limited abuse-monitoring window in its commercial terms and never used for training; retained by us inside the report record for the same period as the report itself.

HIPAA is not the only law that applies. California's Confidentiality of Medical Information Act (Civil Code § 56 et seq.) may apply to a licensed RCFE and to the medical information in its records, and Title 22 (22 CCR § 87506 and related sections) requires residents' records to be kept confidential and retained. Reports of suspected abuse (SOC 341) are confidential under Welfare and Institutions Code § 15633.

ClearReport handles report content as confidential medical and resident information on your behalf: access is limited by role and facility, SOC 341 reports are never shown to other caregivers, and we disclose report content only to provide the service, as you direct, or as the law requires.

• Encryption in transit: TLS 1.2+ on all connections
• Encryption at rest: AES-256 (Supabase managed)
• Authentication: handled by Clerk; MFA available for all users
• Access control: role-based, scoped to facility for non-org-admins
• Audit trail: every change logged with actor identity; every Skdaddle staff view is logged too
• Backups: daily Supabase point-in-time recovery, 7-day window
• Incident response: we notify affected customers within 72 hours of confirmed unauthorized access

For a more detailed posture, see our Security overview.

California residents (CCPA / CPRA)

You have the right to:

• Know what personal information we collect about you and how we use it (see above)
• Access a copy of your personal information
• Delete your personal information, subject to lawful retention obligations
• Correct inaccurate information
• Opt out of any “sale” or “sharing” of personal information — we do not sell or share personal information for advertising purposes
• Non-discrimination for exercising these rights

To exercise these rights, email contact@useclearreport.com. We verify identity before fulfilling requests and respond within 45 days (extendable to 90 with notice).

Subjects of regulatory reports

If a report filed using ClearReport references you (as a resident, family member, witness, or suspected perpetrator), the data controller is the licensed facility that filed the report, not Skdaddle. Direct access, correction, or deletion requests to that facility. We will forward inquiries we receive directly to the facility you specify.

ClearReport does not sell your personal information, and does not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months.

Because we do not sell or share, there is nothing to opt out of for advertising purposes. If our practices ever change, we will update this section and provide a working opt-out mechanism before any such sale or sharing begins. To submit a privacy request of any kind, or to confirm our no-sale status in writing, email contact@useclearreport.com.

We use first-party cookies to keep you signed in (Clerk session cookies) and to remember UI preferences. We do not use cookies for advertising or cross-site tracking. We do not deploy third-party analytics tags that share data with advertisers. Server-side logs include IP address and user-agent for security and debugging only.

ClearReport is a B2B product used by licensed-facility staff. We do not knowingly collect personal information from anyone under 18 as a user of the service. If you believe a minor has created an account or otherwise provided us information directly, contact us and we'll delete it.

Separately, a regulatory report filed through ClearReport may, in rare cases, reference a subject who is under 18 — for example, a dependent adult who meets the SOC 341 definition. In those cases the data controller is the licensed facility that filed the report, not Skdaddle, and we process that information solely as the facility's processor under the terms above.

Our infrastructure is located in the United States. By using ClearReport, you understand that your data is stored and processed in the U.S. We do not currently offer EU/UK data residency; if your organization requires it, contact us before subscribing.

We may update this policy as our service evolves. We'll notify customers in writing at least 30 days before material changes take effect (for example, adding a subprocessor with access to report content). The effective date at the top of this page reflects the most recent version.

Privacy questions, data-access requests, or breach reports: contact@useclearreport.com

Skdaddle LLC — California assisted living incident reporting.