Privacy and security
Waypoint is built so that clients stay in control of their information and providers can run a more careful practice.
Waypoint content is educational and informational. It is not medical advice, diagnosis or treatment and does not replace a licensed professional. Please work with a qualified provider to make sure you are fully supported. If you are in crisis, call or text 988 (US) or your local emergency number.
How we protect information
- Separate provider and client logins with passwords stored as salted hashes.
- Assessment answers and worksheet reflections are encrypted at rest.
- Automatic sign-out after 30 minutes of inactivity, and a 12-hour maximum session.
- Request forgery protection on every action, and temporary lockout after repeated failed sign-ins.
- Role-based access: providers only see their own clients, clients only see themselves.
- An access log records who viewed or changed a client record, and clients can read it.
Consent and sharing
Everything starts private. Clients decide whether to share each completed result, and can switch check-ins, reflections, caregiver summaries and agency visibility on or off at any time.
Your rights (GDPR and similar laws)
Access and portability: download your data from the account page. Erasure: delete your account and data there too. Withdrawal of consent: change sharing switches at any time. Rectification: ask your provider, or redo an assessment.
For practices (HIPAA)
The practice remains the covered entity. Waypoint is designed to support a compliance programme but does not by itself make a practice compliant. Before storing protected health information, put a Business Associate Agreement in place with your hosting provider and with any automation service you connect, and review this tool with your compliance advisor. Optional automation events (task assigned, task completed) contain titles, dates and an email address, and never answers or scores.
Not a substitute for care
All tools, worksheets and assessments are informational. Screening scores are not diagnoses. Please work with a licensed professional to make sure you are fully supported. In a crisis, call or text 988 (US) or your local emergency number.
Retention
Records are kept until you or your provider delete them. Access logs contain actions and timestamps only and are kept for accountability.