Waypoint
Privacy Policy
Waypoint is an EMS protocol service built and operated by Strange Harmony (“we”, “us”). Each EMS system, medical direction or agency that uses Waypoint (an “Organization”) has its own Waypoint site, such as nwaems.org or a site at waypointems.com. This policy explains what information Waypoint collects on those sites, how it is used and who it is shared with.
Organizations decide who gets an account on their site and manage those accounts. For information in an Organization’s site, we process it on that Organization’s behalf and under its instructions. If you have questions about how your Organization uses your information, contact your Organization’s administrator.
Waypoint is not for patient information
Waypoint holds protocols and the work of maintaining them. It is not a patient care record and is not designed to store protected health information. Please do not enter patient names or other identifying patient details anywhere in Waypoint, including comments, change requests and messages.
Information we collect
Account information
- Your name, email address, role, and the agencies you belong to.
- If you request an invitation: your name, email address, organization, rank or title, an optional phone number and your message.
- Your password, which is stored only as a secure hash. We cannot see it.
- If you use two-factor sign-in: the authenticator registration needed to check your codes.
Content you create
Protocol edits, change requests, comments, reviews, approvals, signatures on approval letters, meeting minutes, announcements, uploaded files and similar work, along with who did it and when. Waypoint keeps an audit log of these actions so the protocol history can be trusted.
Guest visitors
Where an Organization allows guest viewing, guests give their name and organization and agree to terms before reading the library. We record that agreement, which protocols were viewed and the browser type.
Contact form
Messages sent through a site’s contact form include your name, email address, optional organization and phone number, and the message. To limit spam we keep a one-way hash of your network address, not the address itself.
Usage information
If an Organization turns on usage analytics, Waypoint counts visits, sign-ins, protocol and medication views and searches, with the kind of device (phone, tablet or computer) and whether the installed app was used. These counts are stored with a salted one-way hash in place of your account, so they show how Waypoint is used without showing who viewed what. Waypoint does not use advertising, third-party trackers or cross-site tracking cookies.
Technical information
Our hosting and security providers process network addresses, browser details and request logs to deliver pages, protect the service against attacks and fix problems.
Information stored on your device
Waypoint stores a few things in your browser so it works properly: your signed-in session, your light or dark theme choice, a copy of protocols for offline use, and usage counts waiting to be sent. These are needed for the service to work and are not used for advertising. Signing out or clearing your browser data removes them.
How we use information
- To run Waypoint: signing you in, showing the protocols you are allowed to see and recording protocol changes and approvals.
- To send emails you need, such as invitations, sign-in codes, password resets, approval requests and reminders.
- To keep Waypoint secure, prevent misuse and investigate problems.
- To understand how Waypoint is used and improve it, using the counts described above.
- To meet legal obligations.
We do not sell personal information, and we do not use it for advertising.
Who we share information with
- Your Organization. Administrators of your Waypoint site can see accounts, activity and content in that site.
- Service providers that run parts of Waypoint for us, under contracts that limit how they use the information: Supabase (database, sign-in and file storage), Cloudflare (hosting, network delivery and security), Resend (email delivery) and Google Fonts (the typeface used on Waypoint sites, which receives your network address when it loads). If an Organization turns on AI-assisted review features, protocol text is sent to Anthropic for that review.
- Legal reasons. When required by law, or to protect the rights, safety or property of users, the public or us.
- Business changes. If Strange Harmony is involved in a merger, sale or similar change, information may transfer as part of it, subject to this policy.
Our providers may process information in the United States and other countries.
How long we keep information
We keep information for as long as the Organization’s site is active and as needed to keep an accurate history of protocol changes and approvals. Organizations can remove user accounts. Backups are kept for a limited time and then deleted. When an Organization stops using Waypoint, its data is deleted or returned as agreed with that Organization.
Security
Waypoint uses encrypted connections, access rules that keep each Organization’s data separate, two-factor sign-in for people who can edit or approve protocols, and audit logging. No system is perfectly secure, so please use a strong, unique password and keep your authenticator safe.
Your choices and rights
You can review and update your profile in Waypoint. To access, correct or delete your information, contact your Organization’s administrator, or contact us and we will work with your Organization. Depending on where you live, you may have additional rights under local law, and we will honor them as required.
Children
Waypoint is for EMS professionals and is not directed to children under 13. We do not knowingly collect information from children.
Changes to this policy
We may update this policy. When we do, we will change the date at the top, and for significant changes we will give notice in Waypoint or by email.
Contact
Questions about this policy can be sent to Strange Harmony through strangeharmony.com.