Privacy Policy

Information we collect

We collect information you provide to use the organizer, including account email, onboarding answers, applicant nickname, state, checklist progress, call logs, reminder details, document labels, and document metadata. Paid users may upload files to a private document vault. Do not upload Social Security numbers in v1.

How we use information

We use information to operate WaiverPath, save checklist progress, provide reminders (including reminder emails about upcoming or past-due deadlines, which you can opt out of using the unsubscribe link in any reminder email), create document indexes, generate packets, process billing, prevent abuse, support users, improve the product, and maintain required business records.

Documents and sensitive information

WaiverPath may hold disability, health, agency, or benefits-related records that you choose to upload or enter. This includes waiver program eligibility data, household composition, and disability-related context — information we treat as sensitive personal informationused only to provide WaiverPath's core features and never shared with third parties for advertising or profiling. We are an organizer, not a government agency, law firm, Medicaid provider, insurer, or benefits advisor. Upload only documents you have permission to store.

HIPAA scope

WaiverPath is not a HIPAA covered entity and is not a business associate of any HIPAA covered entity. Information you enter into WaiverPath is not protected health information (PHI) as defined by HIPAA — it is protected under this Privacy Policy and applicable state law. Do not enter clinical records, diagnoses, or physician notes into WaiverPath.

Payments

Payments are processed by Stripe. WaiverPath does not store full card numbers. Stripe may collect payment, billing, fraud-prevention, and tax information under Stripe's own terms and privacy policy.

Service providers

WaiverPath uses the following third-party service providers that receive some of your information to operate the product:

• Stripe — payment processing; receives billing and payment data. Stripe Privacy Policy.
• Transactional email — cPanel SMTP on WaiverPath mailboxes; processes your email address and the content of emails we send you (reminders, account notifications).

We do not use third-party analytics, session-recording, or behavioral advertising tools. If that changes, this section will be updated before deployment.

Cookies

We use essential cookies for app sessions and preferences. Optional cookies may be used for referral attribution and basic site improvement after consent. See the Cookie Policy for details and choices.

Sharing

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We share information only with service providers needed to run the app (listed above), for legal compliance, security, or in a business transfer.

Retention and deletion

We retain your information for as long as your account is active. After you request account deletion, your personal data is removed within 90 days (retained briefly for dispute resolution), then purged except as required by law. Stripe retains billing records per its legal obligations (typically 7 years for tax and financial records); WaiverPath does not store full card numbers. Anonymized or aggregated data may be retained indefinitely. You may request deletion through the Data Deletion page.

Children's privacy

WaiverPath is intended for use by adults (18 or older) or legal guardians managing Medicaid waiver information on behalf of family members, including minor children. We do not knowingly collect personal information directly from children under 13. The parent or guardian is the account holder and enters household data — including any information about a minor child — on the child's behalf. If you believe a child under 13 has submitted personal information without parental consent, contact us at support@waiverpath.com and we will delete it promptly.

Security

We use reasonable administrative, technical, and organizational safeguards, including private storage for uploaded documents and time-limited signed URLs where configured. No internet service can guarantee absolute security.

Your choices

You can request access, correction, export, or deletion by visiting Data Deletion or emailing support@waiverpath.com.

California Privacy Rights (CCPA / CPRA)

This section applies to California residents and supplements the rest of this Privacy Policy. It is provided in compliance with the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA).

Categories of Personal Information We Collect

In the past 12 months, WaiverPath has collected the following categories of personal information from California residents:

• Identifiers — email address, account name
• Personal records — household composition, state of residence, disability-related waiver eligibility data you provide
• Commercial information — subscription billing data processed via Stripe
• Internet activity — pages visited and features used within WaiverPath
• Sensitive personal information — government program eligibility data you voluntarily enter; financial account data held by our payment processor

Does WaiverPath Sell or Share Your Personal Information?

We do not sell your personal information.We also do not share your personal information for cross-context behavioral advertising. Because we do not sell or share personal information as defined under California law, there is no opt-out mechanism to configure at this time. If that practice ever changes, we will update this policy and provide a “Do Not Sell or Share My Personal Information” link on our homepage at least 15 days before any such practice begins.

Your California Privacy Rights

• Right to Know. You may request that we disclose the specific pieces of personal information we have collected about you, the categories, sources, business purpose, and third parties with whom it is shared.
• Right to Delete. You may request that we delete personal information we have collected, subject to exceptions permitted by California law.
• Right to Correct. You may request that we correct inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information.We currently use sensitive personal information only to provide WaiverPath's core services. If we ever use it beyond purposes permitted by California law, you may direct us to limit that use.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.
• Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosures to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing.

How to Submit a California Privacy Request

Email support@waiverpath.com with subject line “California Privacy Request.” We will respond within 45 days (extendable by an additional 45 days with notice). To verify your identity, we will ask for the email address associated with your account. You may designate an authorized agent to submit a request on your behalf with written authorization.

Contact

For privacy questions, email support@waiverpath.com.