Security & data

No — there is nothing to sign, because CRC Run Sheet is not designed to receive protected health information.

A HIPAA Business Associate Agreement governs a vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity. CRC Run Sheet is built to hold the coded subject identifiers your site already assigns, and nothing that identifies a patient. With no PHI received, there is no business-associate relationship to paper.

This is a faster procurement path, not a gap in one.

• Site-assigned, de-identified subject IDs — the code your site already uses
• Visit dates and windows — target dates, window open/close, computed from your protocol’s own day numbers
• Visit status — scheduled, completed, missed, skipped, and the reason
• Site-authored operational notes — free text your coordinators write about logistics
• Study configuration — visits, procedures, schedule-of-assessments cells, delegation records mirroring your signed DOA log, and staff names of your own team
• Your account — the email and identity of the people who log in, and billing status

No patient names. No dates of birth. No addresses, phone numbers, or email addresses for patients. No medical record numbers. No insurance or payment identifiers. No clinical findings, lab values, or diagnoses. No treatment assignments.

There are no database fields for any of these. They are absent from the schema, not merely discouraged.

Free-text notes are free text. The application asks coordinators not to enter identifying information, shows that instruction at every free-text field, and confirms before printing a patient hand-out — but software cannot prevent someone typing a name into a notes box.

So the accurate statement is: CRC Run Sheet is not intended to receive PHI, and the no-BAA position depends on your site following that instruction. We would rather say that plainly than publish a guarantee we cannot technically enforce.

If your site needs to store patient identifiers or contact details, that is a different product tier — one that would run in a separate environment under a signed BAA. It does not exist today. Tell us if you need it.

The application runs on Vercel with a Neon PostgreSQL database, both in US regions. A nightly copy of the database is kept in Cloudflare R2 object storage (Eastern North America), purged on a rolling 30-day cycle; protocol PDFs you attach to a study live in the same service, behind links that expire within an hour, and go when you remove them. Authentication is Clerk; payments are Stripe. Data is encrypted in transit (TLS) and at rest by the hosting, database and storage providers. Passwords are handled by Clerk and never reach us. Access to production data is limited to the operator.

The full subprocessor list, with what each one receives:

• Vercel — Application hosting and delivery (US region)
• Neon — PostgreSQL database (US region)
• Cloudflare — Object storage (R2, Eastern North America) for the nightly encrypted database backup and for the protocol documents you upload
• GitHub — Runs the nightly backup job on a GitHub-hosted runner
• Clerk — Authentication and account identity
• Stripe — Payment processing and subscription billing
• Anthropic — AI parsing of protocol schedules you choose to paste or upload
• Resend — Transactional email (account and notification messages)
• Google Analytics — Aggregate usage measurement on the marketing site and app
• Sentry — Error monitoring — diagnostics when something in the app fails
• PostHog — Product analytics — which features get used

Detail on each, including the AI protocol parser, is in the Privacy Policy.

• Not entering names or other identifying information into the application
• Maintaining your own source documentation and system of record
• Your own GCP, ICH E6(R3), IRB, and sponsor obligations
• Recording protocol deviations in your CTMS or EDC — this tool surfaces them, it does not record them for regulatory purposes

• Receive PHI, or accept it if sent
• Act as a HIPAA Business Associate under the current product
• Serve as an EDC, eSource, eRegulatory system, or system of record
• Hold electronic signatures or make 21 CFR Part 11 claims

Email support@crcrunsheet.com. If your IT team has a security questionnaire, send it — a straight answer is faster than a sales call.