Privacy Policy

This Privacy Policy explains how Waiversoft (“Waiversoft,” “we,” “us”) collects, uses, protects, and shares information when you use our web application and our iOS application (together, the “Service”). Waiversoft is a compliance and electronic-record tool for Florida Agency for Persons with Disabilities (APD) iBudget home-care agencies. It is used by agencies to manage their own records and is not directed to the general public or to children.

Because the Service is used to manage health-related records, some information you enter may be protected health information (PHI) about the individuals an agency serves and employs. We handle that information as described below and only on behalf of the agency (our customer).

1. Who controls your data

For the records an agency stores in the Service (consumer records, employee records, documents, notes, and related data), the agency is the data controller and Waiversoft acts as a service provider / business associate that processes that data on the agency’s behalf. For account and billing information about the agency and its users, Waiversoft is the controller.

2. Information we collect

Account information

• Your name, email address, and role, and the agency you belong to.
• Authentication data managed by our identity provider, including a hashed password and, if you enable it, two-factor authentication settings.

Agency records you enter (may include PHI)

• Consumer and employee records, APD identifiers, documents you upload, expiration dates, session notes, incident reports, and related compliance data.

Usage, device, and log data

• Standard server logs (such as IP address, timestamps, and requests), audit records of document views and changes, and app diagnostics needed to operate and secure the Service.
• On iOS, the app stores your session securely on the device (Keychain) and, if you enable it, a Face ID / passcode app lock. Optional local reminders about expiring documents are generated on your device.

Voice input (optional)

• If voice-to-text is enabled and you use it, a short audio recording is sent for transcription and the resulting text is placed in your message. See sub-processors below.

Website visits (our public pages only)

When you visit our public website — the home page, Resources articles, About, Security, and the demo request page — we collect the following. None of it applies inside the Service once you sign in.

• Site measurement. Vercel Web Analytics (page views, without cookies) and Google Analytics (page views and clicks on buttons such as “See a demo”), so we can see which pages are useful.
• Ad measurement. The Google Ads tag and the Meta (Facebook) pixel record page views on these pages and, when you submit the demo request form, that a request was made, so we can measure our advertising. When you submit a demo request, we may also send Meta a hashed (one-way scrambled) copy of your email address, phone number, and name, together with your IP address and browser information, so Meta can match the request to an ad. Meta does not receive the rest of what you type in the form.
• How you found us. Two first-party cookies (“ws_src” and “ws_last”) remember, for up to 90 days, the page you first landed on, the website that sent you (for example, google.com), any campaign tags in the link, and the last page you read. If you request a demo or create an account, we save that with your request or account so we know which pages and channels bring agencies to us. These cookies are not shared with anyone.
• Demo requests. The details you enter are stored and emailed to our team so we can contact you.

These tools never receive agency records or PHI. You can block or delete cookies in your browser settings; the website works without them. We do not use agency records or PHI for analytics or advertising, and we do not sell personal information.

3. How we use information

• To provide, secure, and maintain the Service.
• To power features you invoke — including Coworker, our AI assistant, which answers questions and drafts documents from your agency’s data at your direction.
• To keep an audit trail of document access and changes for compliance.
• To process subscription billing.
• To communicate with you about the Service and respond to support requests.
• To meet legal, regulatory, and security obligations.

4. How information is shared (sub-processors)

We share information only with the vendors that help us run the Service, under contracts that require appropriate confidentiality and security, and — where PHI is involved — a Business Associate Agreement (BAA) where applicable:

• Supabase — hosting, database, authentication, and file storage for the Service.
• Vercel — hosts our website and the web application.
• Resend — delivers the Service’s email: sign-in and confirmation links, invitations, notifications, and demo request alerts to our team.
• Google Workspace — our company email, where messages you send to our support and security addresses arrive.
• Amazon Web Services — address lookup for client service locations (address suggestions and map coordinates), and the secure connection to Florida APD’s iConnect system.
• Anthropic — powers the Coworker AI assistant. Content you send to Coworker is processed to generate responses.
• OpenAI — used only for Coworker’s voice features: spoken conversations with Coworker and voice-to-text. When you use them, your audio and the conversation — which can include your agency’s records — are sent to this vendor. If you don’t use voice, nothing is sent to OpenAI.
• Stripe — processes subscription payments. Card details are handled by Stripe, not stored by Waiversoft.
• Google and Meta — website measurement and ad measurement on our public pages only, as described under “Website visits” above. These measurement tools never receive agency records or PHI.

We may also disclose information if required by law, to protect rights and safety, or in connection with a business transfer, subject to the protections in this Policy.

5. Data security

• Data is encrypted in transit using industry-standard TLS/HTTPS.
• Access to agency data is enforced at the database layer with row-level security, so each agency can reach only its own records.
• Document files are served only through an audited, access-checked path that records who viewed each file.
• Optional two-factor authentication and an iOS app lock provide additional account protection.

No method of transmission or storage is completely secure, but we work to protect your information using appropriate technical and organizational measures.

6. Data retention and account deletion

We retain information for as long as your agency’s account is active and as needed to provide the Service. Health and compliance records may be subject to legal retention requirements, so we may retain certain records for the period required by law even after an account closes.

You can request deletion of your account at any time — in the iOS app, open Agency → Account → Delete account, or contact us at privacy@waiversoft.com. When you request deletion, we will delete or de-identify your personal account information and, at the agency’s direction, the agency’s records, generally within 30 days, except where we are legally required to retain specific records. You may cancel a pending deletion request during that window by contacting us.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete personal information, and to object to or restrict certain processing. Because agency records are controlled by the agency, we will refer requests about those records to the agency and assist as its service provider. To exercise a right, contact us at privacy@waiversoft.com.

8. Children’s privacy

The Service is intended for use by agency staff, not by children, and we do not knowingly collect personal information directly from children through the Service. Records an agency maintains about the individuals it serves are entered and controlled by the agency.

9. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice.

10. Contact us

Questions about this Policy or our privacy practices? Contact us at privacy@waiversoft.com.