[prennert]

In their terms [0], Cloudflare says

2.2.1 Restrictions

Unless otherwise expressly permitted in writing by Cloudflare, you will not and you have no right to:

(i) use the Services to store or transmit any “protected health information” as that term is defined in 45 C.F.R. 160.103 without Cloudflare’s written consent;

We plan to process PHI data, so I need written permission. It turns out that I need an enterprise license (it took a long time to get to that realisation, because it is not documented, and ticket lead times even with a business account are weeks). The catch is, you cannot just upgrade to enterprise, you need to talk to someone.

[0]: https://www.cloudflare.com/en-gb/terms/

[jjtheblunt]

thanks for explaining, and that makes sense!