ClearHarbor Privacy Policy

1. Who this policy covers

This Privacy Policy explains how ClearHarbor Technology Inc. (“ClearHarbor,” “we,” “us”), a corporation federally incorporated under the Canada Business Corporations Act (incorporation number to be added once issued), collects, uses, discloses, and retains information in connection with:

• ClearHarbor Desktop (installer/executable name SafeHarborLocal), our downloadable Windows (and macOS, where available) desktop application;
• the ClearHarbor Web application, our browser-based service; and
• the ClearHarbor browser extension and local companion service, where installed.

These three surfaces handle your data very differently. Read Section 3 before assuming either applies to you.

This policy is written primarily against PIPEDA (Canada’s Personal Information Protection and Electronic Documents Act), because ClearHarbor is a Canadian company. If you are located outside Canada, other privacy laws may also apply to you and to us — see Section 9.

This policy does not, and cannot, make ClearHarbor “HIPAA compliant.” HIPAA is a US statute that applies to covered entities and their business associates, not to software vendors as such. See Section 8.

2. Summary — what we collect, per product

Surface	Does document/file content leave your device?	What we do collect
Desktop app	No for your documents — processing happens entirely on your machine. Only if you send a feedback report, and then only what Section 3 describes, including a short note you type and see cleaned first.	Nothing about your document content. Only what’s described in Section 3 (local crash logs; a local encrypted feedback file; and, if you choose to send one, a feedback report with an optional 280-character note).
Web app	Yes. Submitted text/files are transmitted to and processed on ClearHarbor’s servers.	Submitted text/files, temporarily (default 30 min. retention, see Section 4); account/session data; aggregate usage metrics (not content) — Section 5.
Browser extension / local companion service	No — processed locally by the companion service on your machine.	Nothing about clipboard content leaves your device, on the same basis as the desktop app.

3. The Desktop app: local processing

When you use ClearHarbor Desktop to de-identify text or a file, that content is read from your disk (or the clipboard), processed in memory by ClearHarbor’s local, rule-based de-identification engine, and written back to your disk or displayed on your screen — all within the same process, on your machine. There is no network call in the desktop application’s processing path. We do not receive, see, store, or have any access to the text or files you process with the desktop app.

What is stored locally, on your device only, and never sent to us:

• Crash logs. If the app crashes, a plain-text log entry (timestamp, the code location, and the .NET exception detail) is appended to %LOCALAPPDATA%\SafeHarborLocal\logs\app.log on your machine. This file stays on your device. We do not collect it automatically.
• Feedback report files. When you file a feedback report from the desktop app, the app writes a second, separate file on your machine holding the parts of that report that cannot be sent to us. That file may contain: the note you typed, exactly as you typed it and before any cleaning; the identifier you were reporting, if you gave one; the text surrounding it; the file name and full path of the document you were working on; and every finding the de-identification engine produced for that document, including the raw matched text of each finding. Assume this file contains PHI, because it is designed to.
  • It is encrypted at rest using Windows DPAPI, scoped to your own Windows user account, so another user on the same machine cannot read it.
  • It is never transmitted. There is no code in the desktop app that reads this file and sends it anywhere — not on a feedback send, not on a crash, not on an update check. The report we receive is built from a separate, structured record; the two are kept apart deliberately so that this content has no path to the network.
  • It is kept for 30 days, or the 50 most recent reports, whichever limit is reached first — older files are removed automatically. You can view and delete these files yourself at any time from My reports inside the app.

We found no telemetry, analytics, or usage-tracking library anywhere in the desktop application.

The one thing the desktop app can send us, and only when you ask it to, is a feedback report. Feedback is never sent automatically and never in the background. A report is a small, fixed set of structured values — the category of problem, which screen you were on, counts, and similar bounded fields — plus, optionally, a single free-text note of up to 280 characters that you type yourself.

• That note is cleaned twice: once on your machine, by the same de-identification engine the product uses on documents, before it leaves; and again on our servers when it arrives, by an independent second implementation. What we store is always the output of our own cleaning, never the bytes your machine sent.
• You see the cleaned version before it is sent. The app shows you exactly what we will receive, on screen, next to the Send button, and nothing is transmitted unless you then choose to send it.
• Cleaning is best-effort and is not a guarantee. It is automatic, rule-based redaction, and rule-based redaction can miss things. We do not warrant that the cleaned note is free of identifying information — that is precisely why we show it to you first and ask you to read it. Do not type patient details into that box.
• The unscrubbed original of your note is kept only in the local encrypted file described above, and is not sent with the report.

A feedback report is not tied to you as a person. Sending one requires no account, no credential, and no code. To stop one misbehaving install from exhausting the rate limit every other sender shares, the app does attach a random correlation id — 32 random bytes it mints itself on first use, stored only on your machine, and derived from nothing about you, your hardware, or your documents. Our server uses it, in hashed form, only to tell repeat senders apart; it is not stored with your report and never appears in any notification. It does mean that reports sent from the same install could in principle be recognised as coming from the same install. If you want us to follow up about a specific report, you have to tell us yourself — for example by quoting the case number the app shows you back — and only if you choose to.

4. The Web app: what actually happens to your data

The Web app is different, and this section is the one that matters most if you’re deciding whether to paste real patient information into it. When you submit text or a file through the Web app, that content is sent to and processed on ClearHarbor’s servers. Specifically:

• Your submission (pasted text or an uploaded file) is transmitted over HTTPS to our servers.
• It is written to a temporary, encrypted-at-rest file on our server infrastructure while a background job extracts the text, runs it through the same deterministic de-identification engine used in the desktop app, and produces a de-identified result.
• The result (and the original submission’s temp file) is held for a retention window configured per tenant — the default is 30 minutes from submission — after which the temp file is securely deleted and the in-memory job record is purged.
• We log a small audit record per job: tenant ID, actor ID, job ID, timestamps, processing mode/options, counts of findings by entity type (e.g., “3 phone numbers found”) — not the findings’ actual values or the document text itself — and the release-decision status. This audit trail exists so you can verify what was processed and when.
• We record aggregate usage metrics — job counts, durations, OCR usage, rate-limit rejections — tagged by tenant ID and input kind. These are counters and timings, not your content.

We do not use your submitted text or files for any purpose other than producing the de-identified output you requested, and we do not use it to train any model (see Section 7 — there is no model to train; the engine is rule-based).

5. Account, session, and API-key data (Web app)

The Web app, as currently built, does not have public self-service signup. Accounts are provisioned tenants identified by a TenantId and authenticated with either a shared API key (for programmatic/API use) or a session login (for the browser UI). We store:

• Your API key, hashed (SHA-256) — never in plaintext — so we cannot recover it if lost; you would need a new one issued.
• A session cookie (HttpOnly, Secure, SameSite=Strict) that expires after 2 hours of inactivity, used only to keep you logged in to the Web UI.

If a public signup flow is added later, this section will expand materially — email address, password/auth method, billing information, and marketing consent would all need their own treatment.

6. The browser extension and local companion service

If you install the ClearHarbor browser extension, it communicates with a small local HTTP service running on your own machine to inspect clipboard content for PHI. This service processes text the same way the desktop app does — locally, in-process, with no network transmission of your content found in the service’s source. As configured today, this service runs on your local machine only.

7. The deterministic engine, and the optional local recognition model

ClearHarbor’s core de-identification engine — used by both the Desktop app and the Web app — is deterministic and rule-based: purpose-built pattern and rule detectors, not a machine-learning model. The Desktop app also offers an optional local recognition model (downloaded once, with your consent) that you can turn on in Settings to catch additional entities the rule-based detectors miss. When it’s on, that model runs entirely on your own device: it makes no network calls while processing your documents, sends us nothing, and is never trained, fine-tuned, or updated using your documents. The Web app does not offer or use this model at all. Whether or not you turn the optional model on, we do not use your submissions to improve, fine-tune, or build any AI system.

(Separately, the Web app’s UI includes a “Copy for your LLM” convenience feature that lets you copy ClearHarbor’s de-identified output to paste into an AI tool of your own choosing. That is your action, with your chosen third-party tool, governed by that tool’s own privacy terms — not something ClearHarbor does.)

8. HIPAA context — read this if you’re a US covered entity or business associate

ClearHarbor is a Canadian company; HIPAA is a US federal law, and it does not automatically apply to us. It applies to covered entities (health plans, healthcare clearinghouses, most healthcare providers) and their business associates under a signed Business Associate Agreement (“BAA”).

• If you use the Desktop app, your documents and their contents never leave your device (Section 3). The only thing the Desktop app can ever send us is an optional feedback report, and only if and when you choose to send one. A feedback report is structured data about a problem you are reporting — never your documents or their contents — plus, optionally, a single free-text note of up to 280 characters that you type yourself. That note is cleaned on your machine before it leaves and again on our servers when it arrives, and you are shown the cleaned version before anything is sent. That cleaning is best-effort and is not a guarantee, so you should not type patient details into it. So ClearHarbor is not handling PHI on your behalf in any way that would typically require a BAA — but this is a question for your own compliance counsel, not us.
• If you use the Web app and submit real PHI, that content is transmitted to and processed on our servers (Section 4). If you are a HIPAA covered entity or business associate, ClearHarbor has not yet determined whether it is prepared to act as your business associate and sign a BAA. Until that decision is made and reflected here and in the Terms of Use, covered entities/business associates should not submit real PHI to the Web app.

Whether or not a BAA is signed, using ClearHarbor’s de-identification engine — on either surface — does not by itself make your output “HIPAA Safe Harbor compliant.” See the Terms of Use’s de-identification disclaimer: the tool assists; a qualified human reviewer and you remain responsible for the compliance determination.

9. Other privacy regimes that may apply to you

We are naming these because they plausibly apply to some of our users — not because we are claiming compliance with any of them.

• If you are in the European Economic Area or UK, GDPR/UK GDPR may apply to our processing of your personal data, and would require a documented lawful basis, a right to erasure, and potentially a Data Protection Officer depending on scale. We have not yet verified this framing against GDPR/UK GDPR specifically.
• If you are a California resident, the CCPA/CPRA may apply. We have not yet verified whether any data flow described here would count as a “sale” or “share” under CPRA’s definitions.
• If you are a US HIPAA covered entity or business associate, see Section 8.

10. Third parties / subprocessors

Two Microsoft Azure services are used to receive and route desktop feedback reports, and are live:

• Azure Blob Storage — where a received feedback report, including its cleaned note, is stored. See Section 12 for retention.
• Azure Communication Services — used to email us a notification that a report arrived. That notification carries the report’s structured fields and its case number; it does not carry the text of your note, only whether one was written and how much was redacted from it.

The code also conditionally integrates Azure Key Vault for secrets management, implying Azure as the hosting environment for the Web app. The hosting region, whether Key Vault is live in production, and the full list of other subprocessors (log/metrics destination, error tracking, CDN, payment processor) have not yet been finalized for publication here.

11. International data transfers

ClearHarbor is a Canadian company. The specific region(s) in which Web app infrastructure is hosted, and whether data may be transferred outside Canada, have not yet been finalized for publication here — this affects both PIPEDA disclosure obligations and any Canadian-data-residency claim in our marketing.

12. Data retention

Data	Retention
Web app submitted content + de-identified output	Configurable per tenant; default 30 minutes, then securely deleted.
Web app audit log entries (metadata only, not content)	To be confirmed.
Web app aggregate usage metrics	To be confirmed.
Desktop app crash logs	Indefinitely, on your own device, until you delete them. Never transmitted to us.
Desktop app local feedback files (unscrubbed note, findings, file path — Section 3)	30 days, or the 50 most recent reports, whichever is reached first; then deleted automatically. On your own device only, encrypted at rest, never transmitted. Deletable at any time from My reports in the app.
Received feedback reports (structured fields + cleaned note)	Held in Azure Blob Storage and expired by a storage lifecycle rule. The retention period is set as a storage-account policy rather than in the application; we will publish the exact period here once it is confirmed against the live account.
Feedback notification emails	For the life of our own mailbox. Carries the report’s structured fields and case number only — never the text of your note.
API key (hashed) / session data	For the life of the tenant relationship / session, respectively.

13. Your rights

Under PIPEDA, you generally have the right to know what personal information an organization holds about you, to access it, to correct it, and to withdraw consent to its collection, use, or disclosure (subject to legal or contractual restrictions). To exercise these rights, contact us using the details in Section 16.

If GDPR or CCPA/CPRA applies to you (Section 9), you may have additional rights (e.g., erasure, portability, opt-out of sale/share). We have not yet confirmed which of these are operative for our processing.

14. Children’s privacy

ClearHarbor is a professional/business tool not directed at children, and we do not knowingly collect personal information from anyone under 13 (or the relevant age of digital consent in your jurisdiction).

15. Security

We use industry-standard measures appropriate to what each surface handles: HTTPS/TLS for Web app traffic; HttpOnly/Secure/SameSite=Strict session cookies; SHA-256-hashed API keys compared in fixed time to resist timing attacks; encrypted-at-rest temporary storage for in-flight Web app submissions; and secure deletion of temp files after use or on retention expiry. On the desktop, the local feedback files described in Section 3 are encrypted at rest with Windows DPAPI, scoped to your own Windows user account; where that protection is not available, the app does not offer the note box at all rather than storing the content unprotected. No security measure is perfect, and we cannot guarantee absolute security — see the Terms of Use’s disclaimer and liability sections.

16. Contact us

For privacy questions or to exercise your rights under this policy, write to us at: legal@clearharbor.io, or by mail at ClearHarbor Technology Inc., 3 Market St, Toronto, ON M5E 0A3, Canada.

17. Changes to this policy

We will post updates to this policy on this page and update the effective date/version above whenever it changes. Material changes will be flagged with a new effective date.