Privacy Policy

1. Who we are and what this covers

ClearStars Inc. is a Delaware corporation operating in Texas as ClearStars.AI Inc. This policy covers the clearstars.ai website: the pages you read, the forms you submit, the newsletter, the free Star Ratings dashboard, and the chat widget.

This policy does not cover data we process on behalf of a customer under a signed agreement. When a health plan or provider group engages us, that engagement governs how their data is handled, and where protected health information is in scope it is governed by a Business Associate Agreement rather than by this page. Nothing you read here changes those terms.

No protected health information is collected on this website. If you are about to paste member-level or patient-level detail into a form on this site, stop, and contact us instead so we can route it somewhere appropriate.

2. Information you give us

Our forms ask for a name, a work email address, and optionally an organization, a role, a message, and a mobile phone number. The investor form asks for a firm and an investor type instead of an organization. The newsletter asks only for an email address.

Only the name and the work email are required on any form. Everything else, including the phone number, is optional, and a form submits without it.

3. Information we collect automatically

We run first-party, cookieless analytics that we built and host ourselves.

• We set no cookies on this site. Not for analytics, not for advertising.
• We record which pages are read, how far down them people scroll, and which links are followed.
• We record the country a request came from, taken from a network-level header. We never resolve it finer than a country.
• We store one value in your browser’s local storage, under the key cs_analytics, and it holds only whether you have opted out. It is not an identifier and it does not travel with you to other sites.
• There are no third-party trackers, no advertising pixels, and no analytics vendor receiving your visit.

Analytics runs on our legitimate interest in understanding whether the site works. It is a notice with an opt-out rather than a consent gate, and you can opt out at any time from the banner or from our Cookie Policy.

IP addresses

As a rule we do not store IP addresses anywhere. Country-level attribution is deliberately as precise as our analytics gets.

There is exactly one exception. If you tick a box consenting to receive text messages, we store the address and browser user agent that submitted that consent, attached to the consent record and to nothing else. Messaging carriers and the law governing text messages both require us to be able to evidence who agreed to what and when, and a country cannot do that. If you do not tick either box, no address is stored. See section 5.

4. How we use information

• To answer what you asked us, which is the reason most people are here.
• To send the newsletter, if you asked for it.
• To evaluate and administer applications to the pilot cohort.
• To operate, secure, and improve the site, including detecting abuse of forms.
• To meet legal, tax, and regulatory obligations.

Where the GDPR or UK GDPR applies, our bases are: performance of steps taken at your request before entering a contract, our legitimate interests in running and securing the site and in business development, your consent where you gave it (the newsletter and text messages), and compliance with legal obligations.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

5. Text messages

This section is written to be read by carriers as well as by you.

We collect consent for text messages through two separate, optional checkboxes on our forms: one for transactional messages such as alerts, reminders, and notifications about a request you made, and one for marketing and promotional messages. Neither box is ticked for you, neither is required, and neither blocks the form from submitting. Providing a phone number on its own does not authorize us to text you.

We do not sell, rent, or share text message consent or opt-in information with third parties or affiliates for their own marketing purposes. The only third party that ever receives it is the messaging provider that delivers messages on our behalf, and only for that purpose.

You can stop messages at any time by replying STOP, and get help by replying HELP. Message frequency varies. Message and data rates may apply. Full terms are in our SMS Terms.

We keep the record of your consent, including the exact wording you agreed to, for as long as the opt-in is live and afterwards for as long as we may need to evidence that it existed. The address and user agent attached to that record are kept for four years and then removed from it, which does not delete the consent record itself.

6. Who receives information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have no advertising relationships on this site.

We use a small number of vendors to run the business, each bound to use what they receive only to provide their service to us. They are listed, with what each one receives, on our Subprocessors page.

One of them is worth naming here because it is visible to you: the chat bubble in the corner of every page is operated by a third party. If you use it, the name, phone number, email address, and message you type go to that provider directly, and are handled under this policy and theirs. If you would rather not use a third party, every form on this site reaches us without one.

We also disclose information when the law requires it, to protect our rights or someone’s safety, and to a successor in the event of a merger, acquisition, or sale of assets, in which case this policy travels with the data.

7. How long we keep things

• Leads and applications: the active pipeline plus two years, then reviewed and removed.
• Newsletter subscribers: until you unsubscribe. Unsubscribe links do not expire.
• Text message consent records: as described in section 5.
• Analytics events: aggregate and not linked to an identity.

Ask us to delete something sooner and we will, subject to anything we are required to keep.

8. Security

We are HIPAA compliant today. SOC 2 Type II and HITRUST are on our roadmap and we will not describe them as anything else until they are done. Our current posture, including subprocessor detail and control documentation, is published in our Trust Center, linked at the end of this policy.

No system is perfect. If you believe you have found a vulnerability, our disclosure process is published at /.well-known/security.txt.

9. Your rights

Everyone, wherever you are, may ask us to give you a copy of what we hold, correct it, delete it, or stop using it. Use the contact details at the end of this page. We do not charge for this and we will not treat you differently for asking.

California (CCPA and CPRA). You have the right to know, to delete, to correct, to opt out of sale or sharing, and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for any purpose that would trigger the limitation right. You may use an authorized agent.

Colorado, Connecticut, Virginia, Utah, and other states with comparable laws: you have equivalent rights of access, correction, deletion, portability, and opt-out, and where a state provides an appeal route we will tell you how to use it if we decline a request.

Global Privacy Control. We honour GPC signals. Because we do not sell or share personal information and set no advertising cookies, a GPC signal has nothing to withdraw here, but it is also treated as an analytics opt-out.

GDPR and UK GDPR. You additionally have rights of restriction, objection, and portability, the right to withdraw consent at any time without affecting what came before, and the right to complain to your supervisory authority.

We will verify a request before acting on it, usually by replying to the address we already hold, and we respond inside the time the applicable law allows.

10. International transfers

We are based in the United States and our vendors process data in the United States. If you contact us from outside it, you are sending your information to the United States, which may not offer the same protections as your home jurisdiction. Where a transfer mechanism is required we rely on the appropriate standard contractual clauses.

11. Children

This site is for people doing their jobs. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, tell us and we will remove it.

12. Changes

When this policy changes materially we will update the effective date at the top and, where the change affects something you already agreed to, tell you directly. Superseded versions are available on request.