Create and maintain a written privacy policy that (14.1) sets out in detail the provider's processes and procedures for collecting, using and disclosing personal data, including how it will comply, and (14.2) is published on the provider's website and given to users when they contract for services. (The 2021 text also required a privacy notice with marketing opt-out and prior notice of fundamental changes.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.