ClearHarbor Terms of Use

1. Acceptance of these Terms

These Terms of Use (“Terms”) are a legal agreement between you (either an individual or the entity you represent, “you”) and ClearHarbor Technology Inc. (“ClearHarbor,” “we,” “us”), a corporation to be incorporated under the Canada Business Corporations Act (incorporation number to be added once issued). They govern your access to and use of:

• ClearHarbor Desktop (installer/executable SafeHarborLocal), our downloadable desktop application;
• the ClearHarbor Web application; and
• the ClearHarbor browser extension and local companion service, where installed,

(together, the “Service”). By downloading, installing, accessing, or using any part of the Service, you agree to these Terms. If you do not agree, do not use the Service. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization, and “you” refers to that organization.

2. Not legal or compliance advice, and not a lawyer talking

Nothing in the Service, this document, or any output the Service produces is legal, medical, or compliance advice. ClearHarbor is a software company, not a law firm, and does not practice law. If de-identification output needs to satisfy a specific regulatory standard for your specific use case, get that assessed by your own qualified counsel.

3. What the Service is

ClearHarbor provides software that assists with the de-identification of text and documents, including content that may contain Protected Health Information (“PHI”). The core of the Service — used by the Desktop app and the Web app alike — is a deterministic, rules-based engine, not a machine-learning or AI model. The Desktop app additionally offers an optional, locally-run recognition model that you may enable in Settings; it runs entirely on your device and is never trained on your content (see Privacy Policy, Section 7). The Service is designed to help identify and transform categories of information relevant to the HIPAA Safe Harbor method and similar de-identification standards.

The Desktop app and the Web app handle your content differently, and that difference matters to your compliance posture — read both before choosing which to use for real patient data:

• Desktop app: processing happens entirely on your device. ClearHarbor does not receive, transmit, or store your document content. The only thing the Desktop app can ever send us is a feedback report, and only when you choose to send one — it may include a short free-text note you type and are shown in cleaned form beforehand. (See the Privacy Policy, Section 3, for exactly what a report contains and what stays on your machine.)
• Web app: your submitted text or files are transmitted to and processed on ClearHarbor’s servers, held temporarily (a configurable retention window, default 30 minutes in the current build), and then deleted. This is not a local-only tool. See Sections 6 and 7 before submitting real PHI here.

4. Eligibility and account responsibility

The Service is intended for business and professional use, not consumer use, and is not directed at children. You must be able to form a binding contract to use the Service. If you are issued an API key, tenant credentials, or a login, you are responsible for keeping them confidential and for all activity under your account. Notify us promptly of any suspected unauthorized use.

5. License and fees

Subject to these Terms and payment of any applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable license to install and use ClearHarbor Desktop, and to access and use the Web application and browser extension, solely for your own internal business purposes. Fee terms (subscription tier, usage limits, billing cycle, refund policy) will be set out at signup or in an order form and are incorporated by reference here once a commercial model exists. This license does not include any right to reverse-engineer, resell, sublicense, or redistribute the Service, except as the applicable open-source component licenses separately permit (Section 11).

6. De-identification disclaimer — read this before you rely on the output

This is the most important section in this document.

• The Service assists with de-identification. It does not guarantee it. At its core, the engine applies deterministic rules to detect and transform categories of identifying information. In the Desktop app, you can optionally turn on Deep Detection, an additional recognition model that runs entirely on your device alongside the rule-based engine to help catch identifiers the rules alone might miss. Whether Deep Detection is on or off, detection can miss things — unusual formatting, novel identifiers, context-dependent PHI, or information the engine (rules alone, or rules plus the on-device model) wasn’t built to catch.
• Output requires human review before release or disclosure. You (and your organization) are responsible for reviewing de-identified output before treating it as safe to share, publish, or use in a downstream system — including before pasting it into any third-party tool, AI or otherwise (see the “Copy for your LLM” feature; ClearHarbor’s involvement ends when you copy the output — what you do with it next is on you).
• “MAY CONTAIN PHI.” Treat any output the Service has not been confirmed (by your own review) to be fully de-identified as if it may still contain PHI. The Service surfaces a release-decision status and residual-risk assessment to help you make that call — it is a decision aid, not a certification.
• No guarantee of HIPAA Safe Harbor compliance, or compliance with any other standard. Achieving HIPAA Safe Harbor de-identification (or GDPR anonymization, or any other regulatory standard) depends on facts about your specific dataset, your specific use case, and judgment calls the Service cannot make for you. ClearHarbor does not warrant that output from the Service meets the Safe Harbor standard or any other legal or regulatory de-identification standard.
• You remain responsible. If you are a HIPAA covered entity, business associate, or otherwise subject to a data protection or health privacy law, you — not ClearHarbor — remain responsible for your own compliance determination and for whatever you do with the Service’s output.

7. Compliance responsibility — PHI and the Web app specifically

Until ClearHarbor’s position on Business Associate Agreements is decided:

• If you are a HIPAA covered entity or business associate, do not submit real PHI to the Web application unless ClearHarbor has executed a Business Associate Agreement with you. The Desktop app’s local-only processing does not require a BAA to the same degree, but that determination is yours to make with your own counsel — ClearHarbor is not offering that determination here.
• You represent that you have all rights and consents necessary to submit whatever content you submit to the Service, under applicable privacy, health information, and data protection law.

8. Acceptable use

You will not use the Service to: violate any law; infringe anyone’s intellectual property or privacy rights; attempt to bypass rate limits, authentication, or file/size restrictions built into the Web app; reverse engineer the Desktop app or browser extension except as permitted by law; use the Service to build a competing de-identification product by systematically probing or extracting the detection rules; or introduce malware or attempt to disrupt the Service’s infrastructure.

9. Your content

As between you and ClearHarbor, you own the content you submit and the de-identified output produced from it. We claim no ownership over your submitted text, files, or output. Our processing rights are limited to what’s needed to run the Service, per the Privacy Policy (temporary transmission and processing for Web app submissions; for Desktop app use, none, other than a feedback report you choose to send). We do not use your content to train, fine-tune, or improve any model, including the optional local recognition model described in the Privacy Policy, Section 7 — that model runs unmodified on your device and never learns from your documents.

Feedback reports are treated separately. A report you send from the Desktop app is retained and used by us to diagnose and improve the Service, on the terms in Section 10 and the retention in the Privacy Policy, Section 12. The unscrubbed original of any note you write stays on your own machine and is never sent to us.

10. Intellectual property

Excluding your content (Section 9), the Service — including the detection rules, the deterministic transformation engine, the software, and all related documentation and branding — is owned by ClearHarbor or its licensors and protected by intellectual property law. Nothing in these Terms transfers any of that to you beyond the limited license in Section 5. If you submit feedback or suggestions, you grant us a perpetual, royalty-free license to use them without obligation to you — limited to what you actually submit.

That license never extends to Protected Health Information or other health data, whether or not it reaches us. Our feedback tools are built to make submitting it difficult: the report is almost entirely structured values, the one free-text field is short, and anything you type there is automatically redacted on your device and again on ours before it is stored. That redaction is best-effort and is not a guarantee, and this carve-out therefore does not depend on it working. If PHI reaches us through a feedback submission anyway, no license of any kind attaches to it, we acquire no rights in it, and we will delete it on becoming aware of it. You agree not to submit PHI through the feedback tools, and to tell us if you think you have.

11. Third-party and open-source components

The Service incorporates third-party and open-source software. Tesseract OCR (Apache License 2.0) provides local optical character recognition. Deep Detection — the optional local recognition add-on in the Desktop app — is built on the GLiNER large v2.1 model (Apache License 2.0) running on the DeBERTa v3 large encoder (MIT License), using Microsoft’s ML.OnnxRuntime and ML.Tokenizers libraries (each MIT License) to run locally on your machine. Apache 2.0 and MIT are both permissive open-source licenses: they let us use, modify, and redistribute this software at no cost, provided we preserve the required copyright and license notices; neither imposes any additional obligation on you or grants you any right beyond what these Terms already give you. The required notice and license files for each component are included with the software itself — in the installer payload, alongside the component it covers — rather than gathered into a single site-wide notices page at this time. Third-party components are governed by their own license terms, which may grant you rights in addition to these Terms.

12. Disclaimer of warranties

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. Without limiting the foregoing, ClearHarbor does not warrant that: the Service will be uninterrupted, error-free, or secure; any de-identification result will be complete, accurate, or sufficient for any regulatory, legal, or business purpose; or defects will be corrected. This disclaimer applies to the fullest extent permitted by applicable law, and does not affect any statutory rights you have that cannot lawfully be excluded.

13. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW: (A) CLEARHARBOR WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO THE SERVICE, EVEN IF CLEARHARBOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES; AND (B) CLEARHARBOR’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THE SERVICE WILL NOT EXCEED THE GREATER OF (I) THE FEES YOU PAID CLEARHARBOR IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (II) ONE HUNDRED CANADIAN DOLLARS (CAD $100).

Some jurisdictions do not allow the exclusion of certain damages or limitation of liability for gross negligence or willful misconduct — in those jurisdictions, the above limitations apply only to the extent permitted.

14. Indemnification

You agree to indemnify, defend, and hold harmless ClearHarbor and its officers, directors, employees, and agents from any claim, demand, loss, or expense (including reasonable legal fees) arising out of: your use of the Service in violation of these Terms; your violation of any law or third-party right; or content you submit to the Service, including any failure to have the rights or consents needed to submit it.

15. Termination

You may stop using the Service at any time. We may suspend or terminate your access if you breach these Terms, if required by law, or on reasonable notice for Web app tenants where the commercial relationship ends. Sections that by their nature should survive termination (including Sections 6, 7, 9, 10, 12, 13, 14, and 17) will survive.

16. Changes to the Service and these Terms

We may modify the Service or these Terms from time to time. We will post updates on this page and update the effective date/version above; the app, installer, and website will reference this page. Material changes will be flagged, and continued use after an update constitutes acceptance.

17. Governing law and disputes

These Terms, and any dispute arising out of or relating to them or the Service, are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-law principles. You and ClearHarbor irrevocably submit to the exclusive jurisdiction of the courts located in Ontario, Canada for any dispute arising out of or relating to these Terms or the Service.

18. Export control and sanctions

You represent that you are not located in, and will not use the Service from, a country or region subject to Canadian or applicable international trade sanctions, and are not a person prohibited from receiving the Service under such laws.

19. General

Entire agreement: these Terms, together with the Privacy Policy and any order form or enterprise agreement that expressly incorporates or supersedes them, are the entire agreement between you and ClearHarbor regarding the Service. Severability: if any provision is found unenforceable, the rest remains in effect. No waiver: failure to enforce a provision is not a waiver of it. Assignment: you may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets.

20. Contact us

For questions about these Terms, write to us at: legal@clearharbor.io, or by mail at ClearHarbor Technology Inc., 3 Market St, Toronto, ON M5E 0A3, Canada.