Introduction
Wayfinder Clinic, Co ("Wayfinder," "we," "us") is a healthcare technology company improving access to high-quality supports and services for people with disabilities in Colorado. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to our website, joinwayfinder.com, and the Wayfinder platform, including accounts used by case managers, provider agency staff, and members and families.
How this policy applies to you
Case managers and case management agencies. Wayfinder provides its platform to case management agencies and other healthcare organizations ("Customers"). When we receive, create, or maintain protected health information ("PHI") on behalf of a Customer, we do so as a business associate under the Health Insurance Portability and Accountability Act (HIPAA) and our Business Associate Agreement with that Customer. Our handling of that PHI is governed by HIPAA and that agreement. Where this Privacy Policy and a Customer's agreement differ, the agreement controls.
Provider agencies. We collect information about your organization and your staff accounts to list your agency and let you respond to RFPs. Member information you receive through Wayfinder is shared with you by case managers to coordinate services. You must protect it as required by law and our Terms of Service.
Members and families. You create your own Wayfinder account. Information you give us directly is not received on behalf of a case management agency, so it is governed by this Privacy Policy rather than a Business Associate Agreement. We protect it with the same safeguards we use for PHI, and we never sell it. If your case management agency also uses Wayfinder, information your case manager enters about you is PHI governed by HIPAA and that agency's agreement with us. For questions about that information, contact your case management agency.
Information we collect
- Account and contact information: name, email address, phone number, and organization name.
- Organization information: for provider agencies, services, service areas, capacity, licenses, and enrollment details you provide.
- Member and family information: for member and family accounts, the services you are looking for, and any other information you choose to share through Wayfinder.
- Platform information: requests for proposals ("RFPs"), responses, messages, member records, notes, and other content created or received in Wayfinder, which may include PHI handled as described above.
- Information from third parties: details about your organization or industry from public sources, such as Medicaid provider enrollment data, or services such as LinkedIn.
- Usage information: IP address, general location, browser type, operating system, and pages viewed, collected automatically in log files, error reports, and privacy-focused analytics.
How we use information
We use information to provide, secure, and improve our services; communicate with you about your account, products, and events; diagnose technical problems; and comply with legal obligations. We use PHI only as our Business Associate Agreements permit. We do not use information members and families share about health or disability for marketing.
We do not sell personal information or PHI
Wayfinder does not sell, rent, or trade personal information or PHI, and does not use it for third-party advertising.
How we share information
We share information only:
- with case managers and provider agencies, as needed to coordinate services through the platform;
- when you direct us to, such as when a member or family chooses to share information with a case manager or provider;
- with service providers that help us operate the platform, described below; and
- as described under Other disclosures.
Aggregated and de-identified data
We may create aggregated or de-identified data from information processed on our platform, for example statewide or county-level counts of referrals, placements, and service availability. We use this data to improve our services and to publish reports on access to care in Colorado. We may share these reports with Customers, state agencies such as the Colorado Department of Health Care Policy and Financing, and community partners to support improvements in care.
We create de-identified data from PHI only where the relevant Customer's agreement permits it, and only in accordance with HIPAA (45 C.F.R. §164.514). We do not publish figures small enough to identify an individual, and we do not attempt to re-identify de-identified data.
Service providers and sub-processors
We use third-party service providers for hosting, databases, background processing, address validation and maps, email, error monitoring, customer support, and artificial intelligence features. These providers process information only on our instructions and for the purpose of providing services to us. Where a provider may process PHI, it is bound by a Business Associate Agreement. See our current list of sub-processors.
Other disclosures
We may also disclose information (1) when you request or authorize it; (2) to comply with law, such as a subpoena or court order; (3) to enforce our agreements or protect the rights, property, or safety of Wayfinder, our users, or others; (4) in an emergency; or (5) in connection with a merger, acquisition, or sale of assets, subject to the same protections. Any disclosure of PHI is made only as HIPAA and our Business Associate Agreements permit.
Artificial intelligence
Some Wayfinder features use AI models. For example, AI checks RFP text for spelling and removes personal identifiers before an RFP is shared with providers, summarizes RFPs, gives case managers a fit score for each response, gives provider agencies coaching reports on their responses, and helps case managers draft notes, including from notes they dictate. These features do not decide, filter, or hide anything. Wayfinder does not record calls or meetings. Our AI providers are bound by Business Associate Agreements where PHI is involved and are not permitted to use your data to train their models. See our AI & Media Policy for details.
Cookies
Our website uses a small number of cookies and similar technologies:
- Sign-in (Supabase): keeps you signed in to your account. These are required for the platform to work.
- Customer support (Intercom): powers the support chat and remembers your conversations.
- Embedded videos (YouTube): provider profiles may include YouTube videos, and YouTube may set cookies when they load.
Our website analytics (Vercel Web Analytics) do not use cookies. You can block or delete cookies in your browser settings; some features, such as signing in, will not work without them.
Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, and audit logging. No system is perfectly secure.
Breach notification
If we discover a security incident affecting PHI, we notify the affected Customer within the time our agreement with that Customer requires. The Customer is responsible for notifying affected individuals. If an incident affects other personal information, including information members and families give us directly, we notify affected individuals as required by Colorado law (C.R.S. §6-1-716) and other applicable law.
Data retention
PHI. We retain PHI only as our Business Associate Agreement with the Customer permits, for up to seven (7) years while that agreement is in effect. We delete or return it sooner if the Customer's agreement requires or the Customer requests. When a Customer's agreement ends, we return or destroy that Customer's PHI as required by our Business Associate Agreement with that Customer.
Member and family accounts. We keep information you give us while your account is active. If you delete your account, we delete that information within a reasonable time, except where we must keep it for legal or security purposes.
Account and contact information. We keep account and contact information while an account is active and for a reasonable period afterward for legal, tax, and security purposes.
Your rights
You may ask to access, correct, or delete personal information you or your organization gave us, or to stop receiving marketing emails, by contacting us below. Members and families may also ask us to delete their account and the information they shared. We will respond within a reasonable time and explain if we cannot fulfill a request.
Requests about PHI that a case manager entered should go to your case management agency. If we receive one, we forward it to that agency.
Children's information
Wayfinder accounts are for adults. You must be 18 or older to create an account. A parent, legal guardian, or authorized representative may create an account to act for a member under 18. We do not knowingly collect personal information directly from children under 13. We process information about members of all ages, including minors, that is provided by case managers, families, or guardians, solely to coordinate services on their behalf and subject to applicable law.
Location of processing
Wayfinder is based in the United States, and our platform data is stored in the United States.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify account holders by email or in-app notice before the changes take effect. Updates do not change a Customer's written agreement with us.
Contact us
Privacy Officer: Anthony Verducci
Questions about this policy: hello@joinwayfinder.com
Wayfinder Clinic, Co
7754 E 9th Ave
Denver, CO 80230
hello@joinwayfinder.com