Privacy Policy

This Privacy Policy describes how ClearPass.health collects, uses, transmits, retains, and protects information when you use the ClearPass.health clinical documentation assistance service ("ClearPass.health" or "the Service") at clearpass.health and related domains.

ClearPass.health is available to clinicians in any country. Wherever you practise, the data-protection and health-information law of your own country applies to you as the clinician responsible for your patients’ data; Section 7 explains what that means in practice.

1. Who we are and how to contact us

ClearPass.health is operated by ClearPass.health ("ClearPass.health," "we," "us," "our"), an unincorporated business. ClearPass.health is the operator of the Service and the party responsible for it under this policy. Contact: support@clearpass.health.

For privacy questions, data subject requests, or to exercise any of your rights under this policy, contact us at support@clearpass.health. This address serves both general privacy enquiries and Data Protection Officer functions (see Section 15). A postal address is available on written request.

We aim to respond to privacy enquiries within 14 working days.

You also have the right to lodge a complaint with the data-protection authority of the country where you live or practise.

2. Who this policy applies to

ClearPass.health is a B2B tool intended for use by licensed healthcare professionals. Account holders must be 18 years of age or older. ClearPass.health does not knowingly create user accounts for individuals under 18.

However, in the course of providing the Service, ClearPass.health may indirectly process clinical information about paediatric patients entered by the treating clinician. Section 10 of this policy explains how we handle data relating to minors.

3. What information we collect

We collect the following categories of personal data:

Sign in with Google (optional). If you choose to sign in with Google, Google tells us your name, your email address and that the address is verified. We use that only to find or create your ClearPass.health account. We do not receive your Google password, contacts, files or anything else, and we send nothing about your patients or your notes to Google.

Account information. When you create a ClearPass.health account, we collect: your full name, email address, professional specialty, and the access code we issue to you. ClearPass.health has no passwords: you sign in with your access code, with your email address during a free trial, or with Google. We do not ask for, store, or have access to your medical licence number, national ID, passport, or any other identity document.

Subscription and billing data. Subscription tier, subscription status, renewal date, and a customer reference token issued by our payment processor, Paddle. We do not collect, store, or have access to your credit card number, CVV, billing address, or other payment card details — these are handled directly by Paddle as the Merchant of Record (see Section 6).

Clinical text input. When you generate a note using ClearPass.health, the clinical description you enter is processed transiently to produce the structured EMR note and pre-authorisation justification. The handling of this text is described in detail in Sections 4 and 5.

Consultation audio (Transcribe). If you use the optional Transcribe feature, the audio of the consultation is captured in your browser and processed transiently to produce a transcript and an English consultation summary. Audio is never written to disk on our servers and is not retained after the transcript is returned — Section 4A describes the full path. Transcribing a visit requires you to confirm, for every visit, that the patient (or their guardian) has given informed consent. We meter transcription minutes used per account for quota purposes.

Template emails (optional). On some guide pages you can ask us to email you the page's template. If you do, we keep your email address, the page you asked from and which of the emails we have sent. You get the template at once and three short follow-up emails over about 10 days (a writing tip, what to check in an AI-written draft, and the free trial), then nothing more. Every email has a one-click unsubscribe link. We use the address only for these emails and to see whether you later started a free trial; we do not share it or add it to any other list. It is sent through Resend, our email provider (Section 6).

Usage data. Number of notes generated, date of last activity, specialty preferences, feature use, and similar aggregate metrics. This data is used to operate, secure, and improve the Service.

Technical logs. Standard server logs collected by our hosting provider Railway, including IP address, browser user-agent, timestamp, request path, and HTTP status code. These logs are used for service reliability, fraud prevention, and security monitoring.

Cookies and local storage. ClearPass.health uses essential browser local storage to retain your note history (generated notes, transcribed notes, and any optional patient label you type, such as a file number) on your device only . This includes the most recent notes in local storage, older notes in an on-device archive (the browser's IndexedDB), any letters written for a visit, unfinished text kept for 24 hours, your letterhead and signature images, a random device identifier, and, if you choose "remember me", your access code. None of it is uploaded for storage, and ClearPass.health cannot read or recover it, with one exception: the random device identifier is sent with your requests and kept on our server for 14 days, linked to the access code, so we can see when one code is used on many devices. It identifies a browser, not a person. The one exception is a short note of the first ClearPass.health page you opened and the website that sent you there (for example a search engine): if you start a free trial, it is sent with the sign-up and kept on your trial account, so we can tell which pages bring new users. It contains no clinical content. When you reopen a saved note and ask ClearPass.health to change it, check it or write a letter from it, that text is sent for processing exactly as a new note would be, and is not retained. This browser storage is not encrypted by ClearPass.health: anyone who can use your browser profile can read it, so use the auto-delete setting on shared computers. We do not use third-party tracking cookies, behavioural advertising cookies, or analytics tools that identify individual users.

4. How we handle clinical text — the core privacy commitment

ClearPass.health is designed around the principle that clinical content is not retained on our servers. Specifically:

1. When you enter clinical text and request a generation, the text is submitted to our backend over an encrypted HTTPS connection.
2. Our backend applies an automated identifier-redaction step (see Section 5) before transmitting the redacted text to our AI processing provider.
3. The redacted text is transmitted to Anthropic PBC's API (United States) for real-time generation.
4. Anthropic returns the generated note and justification.
5. Our backend returns the response to your browser.
6. Our backend discards both your original input and the generated response after the response is returned. ClearPass.health does not write clinical text to disk and does not maintain a server-side history of your notes.
7. Your generated note is stored only in your browser's local storage on your own device, where you can copy, edit, or delete it at will.
8. Follow-up visits: when you choose "Link previous visit" and pick an earlier note from your History, the text of that earlier note is sent with the new one, through the same redaction, so the new note can refer to it. Nothing is sent unless you pick one. The patient label itself is not sent.

Anthropic's handling of the redacted text: Anthropic operates under its Commercial Terms of Service and Data Processing Addendum, which apply automatically to commercial API usage. Under these terms:

• Anthropic does not use commercial API inputs or outputs to train AI models.
• Anthropic automatically deletes API inputs and outputs from its backend within 30 days of receipt, except where required by law or to enforce its Usage Policy.
• Anthropic's full data retention practices for commercial customers are documented at privacy.claude.com.

This means that for any given note you generate, the upper-bound persistence of the redacted content at any layer is approximately 30 days, according to that provider's published practice. We cannot verify a third party's deletion ourselves. The text is never stored on ClearPass.health servers at any point.

4A. Consultation audio — Transcribe

The optional Transcribe feature follows the same transient-processing design as clinical text:

1. Audio is captured in your browser after you grant microphone permission and confirm patient (or guardian) consent. It uploads to our backend over encrypted HTTPS in segments while the visit is being transcribed.
2. On your own device: so that a crash, a closed tab or a phone that puts the browser to sleep does not lose the visit, the audio of the visit is also held in your browser's storage on your device. Each piece is deleted from your device as soon as it has been transcribed, and anything left is deleted when the note is written, when you choose Discard, when you sign out and choose to remove your data from the device, or after 24 hours. It is never uploaded anywhere except for transcription as described here, and it is not encrypted by ClearPass.health while it sits in your browser.
3. Finding a line in the transcript: the transcript of the visit is kept on your own device with the note (never on our servers), so that you can click a line of the note and see the sentence of the visit it came from, now and when you reopen the visit later. It is deleted when the note is deleted, under the same 7, 30 or 90-day rule you choose. No audio is kept once it has been transcribed.
4. Our backend holds each audio segment in memory only — it is never written to disk and never logged — and forwards it to our speech-to-text provider, ElevenLabs Inc. (United States), for real-time transcription.
5. When the transcript is returned, our backend sends ElevenLabs a request to delete its stored copy of the transcript, and records a failure if that request is refused. ElevenLabs' own retention practices apply to anything it keeps, and we cannot verify a third party's deletion ourselves. Under ElevenLabs' published practices, residual debugging and moderation logs and backups expire within approximately 30 days.
6. The audio is discarded from our server's memory as soon as the transcript is returned.
7. The transcript text is passed through the identifier-redaction pipeline (Section 5) and then submitted to Anthropic to produce the English consultation summary, under exactly the handling described in Section 4.
8. The transcript and summary are returned to your browser and are not stored on ClearPass.health servers.

Dictate is different. Dictate (speaking your own note instead of typing it) uses the speech recognition built into your browser, not ClearPass.health. In Chrome, Edge and Safari the browser's maker (Google, Microsoft or Apple) may send that audio to its own servers to turn it into text, under its own terms. ClearPass.health never receives the Dictate audio, only the text that appears in the note box. If that is not acceptable for your setting, type the note or use Transcribe.

Voice is identifying, and raw audio cannot be auto-redacted. The redaction pipeline applies to the transcript text before AI summarisation; the audio itself is transferred as spoken. For this reason, transcribing a consultation always requires the patient's (or guardian's) informed consent, confirmed by you at the start of every transcribed visit — see the in-app notice and Section 8 of the Terms of Service.

4B. Morning handover and Send to computer

Morning handover (On-call mode). When you ask for a handover, your browser sends the text of the notes you choose from your own History to our backend. Each note is sent as "Patient 1", "Patient 2" and so on; the patient label (for example an MRN) you typed stays in your browser and is put back next to each block on your device. The text goes through the identifier-redaction pipeline (Section 5) and to Anthropic exactly as described in Section 4, and is not stored on ClearPass.health servers. The handover is kept in your browser for 24 hours.

Send to computer. When you send a note from your phone to another computer using a code shown at clearpass.health/receive:

1. The receiving browser window makes a key pair. Its private key cannot be exported from that window and is never sent to us.
2. Your phone encrypts the note in the browser (ECDH key agreement and AES-GCM) with a key that only that window can work out, before the note leaves the phone.
3. Our backend receives only the two public keys and the encrypted note. It cannot decrypt it. It holds them in memory only, never on disk and never in logs, until the receiving window collects the note or 10 minutes pass, whichever comes first, and then deletes them. Each code works once.
4. We log only that a note was sent and its size, for rate limits and abuse protection.
5. The note is shown in the receiving window and is not saved there. Clearing the page or closing the window removes it. On a shared computer, clear the page after you paste.

5. Identifier auto-redaction — what it does and does not do

Before transmitting your clinical text to Anthropic, ClearPass.health applies a multi-layer identifier-redaction pipeline:

1. Client-side (advisory) — your browser runs an initial redaction pass before the text is submitted to our servers, reducing what travels over the network.
2. Server-side — our backend runs the redaction pass again on the text before any API request to Anthropic is made, with at least the patterns the browser uses, so text that did not go through the browser pass is still checked. It removes only the patterns listed below.
3. Response-side (defense in depth) — the same redaction logic is applied, on the insurance-justification route, to Anthropic's response before it is returned to your browser, in case the AI has echoed an identifier back in its output.

The redactor uses deterministic regular-expression patterns — not a machine-learning model. When a pattern matches, the matched text is replaced with a placeholder such as [REDACTED-EMAIL] before transmission. This makes the behaviour auditable, predictable, and reviewable.

What the server-side redactor matches

The following eleven categories are currently detected and replaced:

Category	Example matched
National ID numbers (15 digits starting with 784)	784-1985-1234567-1, 784 1985 1234567 1
Insurance, claim and national ID numbers (when labelled)	Member ID: 12345678, Policy No 5566778899, Claim ID 998877, National ID: ..., Iqama ...
Saudi national ID and Iqama numbers (10 digits starting with 1 or 2, with or without a label)	1023456789
Mobile numbers (+971 and 05X formats)	+971 50 123 4567, 050 123 4567
Labelled phone numbers	Tel: +971 4 ..., Phone: 04 ...
Email addresses	name@example.com
Medical record numbers (when labelled)	MRN: 12345, File No: ABC-7890, Patient ID: ...
Passport numbers	A12345678
Dates of birth (when labelled)	DOB: 15-03-1985, Date of birth: 15/3/1985, born 15 March 1985, DOB 1985-03-15
Names preceded by a title	Mr Ahmed Hassan, Mrs Fatima Al Marri
Names following a label	Patient: John Smith, Pt: A. Hassan

What the redactor does NOT match by design

The patterns are intentionally conservative to avoid corrupting clinical content (vital signs, ages, ICD/CPT codes, anatomic measurements, lab values, and similar). The following categories are not automatically removed:

• First names appearing in free-text narrative without a title or label prefix (e.g., "Ahmed presented with...")
• Dates not labelled as a date of birth (e.g., "seen on 15 March 1985")
• Street addresses, residential locations, or workplace identifiers
• Bare numerical strings that could be MRNs without a recognised label keyword
• Identifiers in non-Latin scripts or unusual formats

Because the auto-redactor cannot catch every conceivable identifier, the content of your submission remains your responsibility.

Your responsibilities as the treating clinician

When using ClearPass.health, you should:

• Enter only the minimum clinical detail necessary to generate useful documentation.
• Avoid entering patient names, national ID or insurance numbers, MRNs, full dates of birth, addresses, phone numbers, or other direct identifiers wherever possible.
• Use initials, age in years, and clinical descriptors instead of identifying details.
• Treat ClearPass.health output as draft documentation that must be reviewed before insertion into any patient record.

These practices are consistent with your existing professional duty of patient confidentiality, whichever regulator you are licensed by and whatever health-data law applies where you practise.

Legal status of the redaction

The redaction step is a privacy-engineering safeguard, not a formal de-identification process. It does not constitute de-identification under HIPAA Safe Harbor, Expert Determination, or any equivalent legal standard. Clinical content remaining after redaction may still indirectly identify individuals when combined with other data (e.g., rare diagnoses in small populations). For this reason, your professional duty of confidentiality continues to apply to all text you submit, regardless of whether redaction is enabled.

6. Subprocessors and data flow

We rely on the following service providers to operate ClearPass.health. Each is contractually bound to protect the data they process on our behalf or, in the case of Paddle, as an independent controller.

Provider	Role	Location	Data accessed
Anthropic PBC	AI processing of redacted clinical text	United States	Redacted clinical text submitted for generation; generated response
ElevenLabs Inc.	Speech-to-text transcription of consultation audio (Transcribe feature)	United States	Consultation audio submitted for transcription; resulting transcript (deletion requested after processing)
Railway	Hosting infrastructure and server logs	United States	Account data, subscription data, server logs (no clinical content)
Resend	Transactional email (access codes, receipts, service notices) and delivery of our own encrypted daily backup to the operator	United States	Your name and email address; the content of emails we send you. No clinical content.
Google (Sign in with Google)	Optional sign-in. Only if you choose it.	United States / global	Your Google account email, name and verification status, received by us from Google. Google learns that you signed in to ClearPass.health.
Google Fonts and Paddle.js	A web font and the checkout script, loaded by your browser from their servers on our pages	United States / global	Your IP address and browser details, as with any file your browser requests. No account or clinical data.
Paddle.com Market Limited	Payment processing as Merchant of Record	United Kingdom / global	Customer name, email, billing country, payment data (collected directly by Paddle; not by ClearPass.health)

Note on Paddle's role. Paddle operates as our Merchant of Record. Under this arrangement, Paddle is the legal seller of ClearPass.health subscriptions and acts as an independent data controller for payment, billing, and tax data — not as our processor. Paddle's own Privacy Policy (paddle.com/legal/privacy) governs its handling of that data. ClearPass.health receives back from Paddle your name, your email address, a customer reference and your subscription status (no card details), and keeps them with your access code to run your account.

Data Processing Addenda. Where the provider acts as our processor, the following terms apply to each provider's processing. Where a provider's standard terms include a Data Processing Addendum with Standard Contractual Clauses, that addendum applies to us as a customer:

• Anthropic: DPA incorporated into the Commercial Terms of Service
• ElevenLabs: ElevenLabs' terms for API customers and its data processing terms; our backend requests deletion of each transcript after processing
• Railway: Self-service DPA executed under Railway's standard terms
• Paddle: Master Services Agreement and Data Sharing Addendum (independent-controller framework)

7. International data transfers

ClearPass.health processes data in the United States (Anthropic, ElevenLabs, Railway). The United States may not be recognised as giving adequate protection under the data-protection law of your country.

We rely on the following safeguards for cross-border transfers:

• Standard Contractual Clauses within each subprocessor's Data Processing Addendum.
• Explicit informed consent at the point of use. When you submit clinical text through the Service, the disclaimer you have accepted, together with this Privacy Policy, constitutes your explicit consent to the cross-border transfer of the (redacted) content for the limited and specified purpose of generating clinical documentation. When you start transcribing with the Transcribe feature, the in-app consent notice you confirm constitutes the point-of-use consent for the transfer of consultation audio to ElevenLabs for transient transcription.
• Data minimisation through automated identifier redaction before any transfer occurs.
• Health-data localisation laws. Some countries restrict storing, processing, or transferring health information outside the country, sometimes with narrow exceptions. ClearPass.health does not claim that any such exception covers your use of the Service. If your country has such a rule, it is your responsibility, with your facility and where needed your health authority, to determine whether and how you may use a service that processes clinical content in the United States, and to obtain the patient's informed consent as set out in Section 8 of the ClearPass.health Terms of Service. Check before you use the Service with patient data. Entering typed text without patient identifiers, rather than transcribing a consultation, reduces what leaves the country.

If you do not consent to international transfer of redacted clinical text to Anthropic in the United States, you should not use the Service.

Your position as the clinician

The Service is available to clinicians anywhere. Wherever you practise, the position is this:

• You are the controller. The patient relationship is yours, the record is yours, and the decision to put a patient's clinical text into this Service is yours. Under your own country's data-protection or health-information law you are the controller of that data, and ClearPass.health acts as your processor.
• Your local law still applies to you. Nothing in this policy relieves you of obligations you owe under it — including any requirement to obtain patient consent, to keep health data inside your country, to notify a local regulator, or to hold a written processing agreement with a vendor. Some countries prohibit sending identifiable health data abroad at all. It is your responsibility to know whether yours does.
• What we do to make that easier. Common identifiers are removed on our server before any text is sent to our AI provider, clinical content is processed and discarded rather than stored, note history stays on your device, and consultation audio is never retained. The less that crosses a border, the less there is for your law to reach.
• If you need a written agreement. Clinicians and clinics who need a data processing agreement, a subprocessor list, or answers to a compliance questionnaire can request them from support@clearpass.health.

If your local law does not permit the processing described in this policy, you should not use the Service.

8. Legal basis for processing

We rely on the following legal bases for each processing activity:

Processing activity	Legal basis
Creating and maintaining your account	Performance of the contract between you and ClearPass.health
Template emails you ask for on a guide page	Your consent, given when you submit the form; withdrawn at any time with the unsubscribe link
Processing clinical text to generate notes	Explicit, informed consent at point of use
Cross-border transfer of redacted text to Anthropic	Explicit consent + appropriate safeguards (SCCs)
Processing consultation audio to produce a transcript and summary (Transcribe feature)	Explicit, informed consent at point of use, confirmed for each transcribed visit
Subscription billing via Paddle	Performance of contract + legal obligation (tax records)
Service security, fraud prevention, abuse detection	Legitimate interest
Service improvement using aggregated, non-identifying usage data	Legitimate interest
Communications about your account, service, or material policy changes	Legitimate interest + legal obligation
Cross-border processing of health-related clinical content for insurance pre-authorisation	Your instruction as the treating clinician and controller, the patient's informed consent obtained by you, and the safeguards listed in Section 7. See Section 7 on health-data localisation laws: we do not claim an exception under any of them on your behalf

You may withdraw your consent at any time by ceasing to use the Service and deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9. How long we keep your data

Data category	Retention
Clinical text input	Not retained by ClearPass.health after the response is returned. Retained by Anthropic for up to 30 days for abuse detection, then automatically deleted.
Consultation audio (Transcribe feature)	Never stored by ClearPass.health (memory-only processing). ElevenLabs' stored transcript: deletion requested after processing; residual provider logs and backups expire within approximately 30 days.
Consultation transcript and summary	Not retained by ClearPass.health after return to your browser. The redacted transcript is retained by Anthropic for up to 30 days, as clinical text above.
Generated note history	Stored in your browser's local storage only, including optional patient labels; not retained by ClearPass.health. Deleted when you delete it in History, when the optional automatic deletion (7, 30 or 90 days) removes it, or when you clear your browser data. A History file you export holds the full notes and is not encrypted; keep it as safely as any patient record.
Account data (name, email, access code)	Retained while your account is active and for 7 years after closure, to meet tax record-keeping and audit obligations.
Subscription and billing records	Retained for 7 years after the relevant transaction, for tax and accounting records.
Server logs	The application keeps its most recent events (a fixed number, not a fixed period) and the hosting provider keeps its own server logs for its own retention period.
Usage metrics	Retained with your account. We do not yet run an automatic anonymisation step; ask us and we will delete or anonymise your usage records.
Template email address	Deleted at once when you unsubscribe; otherwise deleted 30 days after the last email of the series (about 40 days after you asked). Only counts with no address are kept, such as how many people asked from each page.
Feedback you send us	The rating and any comment you write, with your IP address and browser type, are stored on our server and emailed to the operator. Common identifiers are removed from the comment first. Please do not put patient details in feedback. Kept until you ask us to delete it.
Records related to data subject requests	Retained for 3 years after the request is closed, for audit purposes.

10. Children's data

ClearPass.health is provided to licensed healthcare professionals; the user must be 18 or older. However, the clinical text you enter may relate to paediatric patients, including infants and adolescents in the paediatric subspecialties listed on our website.

We process information about paediatric patients only:

• Indirectly, through clinical text submitted by you in the course of your professional duties;
• Subject to the same auto-redaction safeguards as adult patient data; and
• Under the legal framework that you, as the treating clinician, hold appropriate parental or guardian consent for the use of clinical documentation tools as part of routine care.

Where paediatric data is processed, you remain responsible, under the professional standards of your own regulator and the law where you practise, for ensuring that parental authority covers your use of AI-assisted documentation tools. We recommend you consider this in your routine patient/parental information practices.

11. Security measures

We protect personal data using:

• Encryption in transit: All communication with ClearPass.health uses HTTPS/TLS.
• Encryption at rest: Account and subscription data are encrypted at rest by our hosting provider.
• Access controls: Only the ClearPass.health operator has administrative access to backend systems. Access requires the operator's administrative password, repeated failed attempts are blocked, and failed attempts are logged. Multi-factor authentication is not yet in place.
• Multi-layer redaction pipeline: Server-side redaction of common identifiers before any text is sent to our AI provider, on every route; an additional in-browser pass and a response-side pass on the insurance-justification route (see Section 5). Photos, and the audio of a visit, cannot be redacted.
• Logging hygiene: Server logs record event counts, types, and aggregate metrics only — not raw clinical content. Where redaction events are logged, identifier samples are masked to the first three characters before being recorded.
• No long-term clinical storage: Clinical text exists in server memory only for the duration of the request that produced it. The absence of server-side clinical data storage materially reduces the impact of any security incident.
• Subprocessor selection: Subprocessors are selected for documented security postures, including SOC 2 Type II certification (Railway) and equivalent enterprise security controls (Anthropic, Paddle).

No system is perfectly secure. We continuously review and improve our controls based on the evolving threat landscape.

12. Breach notification

In the event of a personal data breach affecting your rights, ClearPass.health will:

1. Investigate and contain the breach as a matter of priority.
2. Notify the relevant data-protection authority within 72 hours of becoming aware of the breach, where the law that applies requires it.
3. Notify affected data subjects without undue delay where the breach is likely to result in high risk to their rights and freedoms.
4. Document the breach, our response, and lessons learned, and retain those records for at least 3 years.

If you become aware of any actual or suspected security breach affecting your ClearPass.health data, please contact us immediately at support@clearpass.health.

13. Your rights

Subject to the law that applies to you, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your account and associated data.
• Restriction of processing — request that we limit how we use your data while a dispute is resolved.
• Data portability — request that we provide your data in a structured, machine-readable format.
• Withdraw consent — withdraw any consent you previously gave; this does not affect lawfulness of prior processing.
• Object to automated processing — note that ClearPass.health does not make decisions about you based solely on automated processing.
• Lodge a complaint with the data-protection authority of the country where you live or practise.

To exercise any of these rights, contact support@clearpass.health. We will respond within 14 working days and will not charge a fee except where requests are manifestly unfounded or excessive.

14. Automated decision-making

ClearPass.health uses AI to generate draft clinical documentation based on your input. This does not constitute automated decision-making about a data subject: the output is draft documentation that must be reviewed and approved by you (the treating clinician) before it is used in any patient record or insurance submission. ClearPass.health does not make decisions that produce legal or similarly significant effects on individuals.

15. Data Protection Officer

For an organisation of ClearPass.health's current size and processing scope, the ClearPass.health operator serves as the designated Data Protection Officer. The DPO can be contacted at support@clearpass.health — the same address used for general privacy enquiries. This consolidated contact is appropriate at our current operational scale.

This designation, and the consolidated contact arrangement, will be reviewed as ClearPass.health scales. If processing volume or complexity requires, a dedicated DPO mailbox and/or external DPO will be appointed and this policy updated accordingly.

16. Changes to this policy

We will update this policy from time to time as our practices, services, or applicable law evolve.

• Material changes (e.g., new subprocessors, new processing purposes, expansion of data categories): we will notify registered users by email at least 14 days before the change takes effect, where reasonably practicable.
• Non-material changes (clarifications, formatting, typo correction): we will update the "Last updated" date at the top of this policy and the version number.

A change history is maintained internally and is available on request.

17. Disputes

If you have a concern or dispute about how we handle your data, contact us first at support@clearpass.health. We will try to resolve it in good faith. This does not limit any right you have under the law that applies to you, including the right to complain to a data-protection authority.

This Privacy Policy is provided in English. In case of any conflict with translations into other languages, the English version prevails.