Privacy Policy
Last updated: July 15, 2026
This Privacy Policy explains what information Clear Bed Recovery(“we,” “us”) collects through our website and services (the “Service”), how we use and protect it, when we share it, and the choices and rights you have. It works alongside our Terms of Service. By using the Service, you agree to the practices described here.
1. Who we are
Clear Bed Recovery is a referral and directory service (a “connector”)that helps people seeking treatment (“Seekers”) find and reach addiction-treatment programs, including some that list co-occurring mental-health services (“Providers”). We are not a healthcare provider, and we do not deliver treatment, diagnosis, counseling, or crisis care.
2. Information we collect
Information you give us during intake.
Our guided flow asks a few questions so we can narrow addiction-treatment directory options: a directory level, a rough location (stored as the first three ZIP digits), payer type, and a coarse scope. The scope lets us distinguish substance-use or documented co-occurring requests from standalone mental-health requests that are outside this directory. We do not ask which substance, symptoms, diagnoses, or whether insurance is active. If you voluntarily name a supported commercial insurer, we may use that carrier name transiently to require an exact program listing, but we do not save it with the match or route it to programs.
Contact details (only if you choose to connect).
After you see your matches, we ask permission first. You may choose whether the displayed programs may contact you, whether we may email one copy of your matches, both, or neither. Only if you make an affirmative connection or email choice do we ask for your name and email. If you ask the displayed programs to contact you, we also ask for your phone number so their intake teams have complete follow-up details. We do not ask for your home address, date of birth, policy number, member number, group number, subscriber details, or clinical narrative.
Guided-form content.
The directory form processes only the limited choices described above. It does not ask for or save a free-text intake conversation or transcript.
Account information.
If you create an account, we store your email, account and authentication identifiers, full name if provided, and account role. Provider and team accounts also include their facility association.
Partner shortlists.
A professional Partner account may save program identifiers and create a shortlist with a system-generated, non-identifying label. The shortlist does not accept a client name, introduction, clinical note, or per-program free-text note. If the Partner turns on sharing, we store a high-entropy access token until sharing is disabled.
Information collected automatically.
Like most websites, we collect limited technical data such as your device and browser type, IP address, and basic usage information, and we use essential cookies to keep you signed in and to operate the Service.
Information from other sources.
Our directory of programs is built in part from public and licensed sources (including government treatment-locator data such as SAMHSA’s findtreatment.gov) and from information Providers submit about themselves.
3. How we use your information
- To narrow addiction-treatment directory options by listed care level, payment information, and region;
- To route a limited, non-contact match summary to the programs selected and displayed by the matcher;
- To make your name, email, and phone available to those displayed programs only when you consent (see Section 5);
- To create and secure your account;
- To send a transactional message you requested (for example, one email containing your matches);
- To operate, maintain, secure, debug, and improve the Service;
- To comply with law and enforce our Terms.
We do not use the matching process to favor any Provider based on whether they pay us. Matching is need-based. We do not sell your personal information, and we do not use your health information for advertising.
4. Sensitive health information & special protections
Information that you are seeking, or have sought, substance-use or mental-health treatment is especially sensitive. Clear Bed Recovery is a directory and connector, not a treatment provider, and whether a particular privacy law applies depends on the parties and circumstances. We design the Service around strict consent, data minimization, and applicable consumer-health privacy requirements. Your identifying contact details are not disclosed to a treatment program without your explicit, recorded consent.
Treatment providers may have separate duties under HIPAA, 42 CFR Part 2, and state law. We do not make a legal determination about those duties for you or the provider. Questions about a provider's handling of treatment records should be directed to that provider or qualified counsel.
Consented contact details are kept in restricted, access-controlled tables that are logically separated from public directory data and reachable only through authorized server-side processes. It is never exposed through public database access.
5. When we share information
How matching works — no direct identifiers by default.
To produce your results, we create a limited, non-contact summary: your ZIP3 region (for example, “787”), directory level, payer type, and coarse scope. We route that summary to the programs selected and displayed by the matcher before we ask whether you want to share contact details. It has no name, contact details, date of birth, street address, member ID, exact carrier, or clinical narrative. Because combinations of otherwise limited facts can still carry privacy risk, we restrict access and do not describe this summary as anonymous. Contact consent applies to your name, email, and phone, as described next; it does not apply retroactively to this non-contact routing.
With treatment programs — your contact details, only with your consent.
We make your name, email, and phone available only to the programs displayed in that match, and only after you explicitly consent, so their intake teams can reach out. We do not send a home address, chat transcript, insurance identifiers, or a clinical intake record. That consent is limited to connecting you with care. You may ask us to revoke future in-app access, although a recipient cannot unlearn information it already viewed. Permission for us to email a copy of your matches is a separate choice. We log each consent decision (granted or declined) with a timestamp. If you decline, we store no contact record and you can still contact programs yourself.
Partner-created shortlist links.
A shared shortlist contains public program-directory information under a generic label; it does not contain a client identity or Partner-entered client note. Anyone who has the active, unguessable link can view or print it. The Partner can disable sharing, which invalidates that link.
With service providers (subprocessors).
We use trusted vendors to run the Service. They may process information only to provide services to us, under contract. These currently include:
- Supabase — database, authentication, and storage;
- Google Workspace or Resend — sending transactional email, depending on configuration;
- Stripe — processing Provider subscription payments (Seekers never pay);
- Vercel — website hosting and delivery.
For legal reasons and business transfers.
We may disclose information if required by law or valid legal process, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets — in which case we will seek to ensure your information remains subject to protections consistent with this Policy.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
6. Your choices and rights
- Use the directory without an account, name, phone, or email — we still process the limited match summary and the technical data described in Section 2;
- Withdraw consent to share your details, or decline it in the first place;
- Access, correct, delete, or receive a copy (portability) of the personal information we hold about you;
- Opt out of any sale or targeted advertising — though we do not sell your personal information or use your health information for targeted advertising;
- Appeal a decision we make about a privacy request;
- Unsubscribe from optional emails at any time.
Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act, other state comprehensive privacy laws, or consumer-health-data laws(such as Washington’s My Health My Data Act) — including rights to know, access, correct, delete, port, and opt out, to withdraw consent for the collection or sharing of your health data, and not to be discriminated against for exercising them. To make any request, contact us using the Contact section below. We will not require you to create an account to exercise these rights.
7. Data retention
We keep personal information only as long as needed to provide the requested connection, maintain an account you separately created, meet legal and recordkeeping obligations (including consent records), resolve disputes, and enforce our agreements. We do not keep raw guided-intake transcripts. After the applicable period, we delete or de-identify information. You can ask us to delete it sooner, subject to limited legal exceptions.
8. How we protect your information
We use technical and organizational safeguards designed to protect your information, including encryption in transit, row-level access controls, role-based access, and access-restricted tables for consented contact records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; we work to protect your information and to respond promptly to any incident.
9. Data breach notification
If we discover a breach of unsecured personal or health information, we will notify affected individuals without unreasonable delay, and we will notify regulators as required by law. Where applicable, this includes the U.S. Federal Trade Commission under the Health Breach Notification Rule, and state authorities under laws such as Georgia’s breach-notification law (O.C.G.A. §§ 10-1-910 et seq.). Our notice will describe what happened, the types of information involved, any third parties that acquired it, and steps you can take to protect yourself.
10. Children’s privacy
The Service is intended for adults (18 and older) and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will take appropriate steps to remove it.
11. Third-party links
The Service links to Provider websites and other third-party resources. Their privacy practices are their own, and this Policy does not cover them. Please review the privacy policies of any site you visit.
12. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated Policy.
13. Contact us
Questions, requests, or privacy concerns? Reach us at hello@clearbedrecovery.com.