jsreportonline, by design, doesn't store any instance data, not even in the logs. The only data we store are templates and samples you use to design reports, but these typically never include sensitive information. The output reports are persisted just in the temp files for maximum 3 minutes in the isolated container until streaming it to you.

We have "data processing agreement" for EU GDPR here.
If you need BAA for HIPPA, would this form work for you? I would send you signed version then.