In their terms [0], Cloudflare says 2.2.1 Restrictions Unless otherwise expressly permitted in writing by Cloudflare, you will not and you have no right to:

In their terms [0], Cloudflare says 2.2.1 Restrictions Unless otherwise expressly permitted in writing by Cloudflare, you will not and you have no right to: (i) use the Services to store or transmit any “protected health information” as that term is defined in 45 C.F.R. 160.103 without Cloudflare’s written consent; We plan to process PHI data, so I need written permission. It turns out that I need an enterprise license (it took a long time to get to that realisation, because it is not documented, and ticket lead times even with a business account are weeks). The catch is, you cannot just upgrade to enterprise, you need to talk to someone. [0]: https://www.cloudflare.com/en-gb/terms/ https://www.cloudflare.com/en-gb/terms/