Legal
Waypoint holds the medical records you upload, and the chronologies built from them, for as long as you choose to keep them. This policy explains what we do with that data, what we never do, and how it is protected while it is in our care.
Last updated October 2026
The medical records you upload, the chronologies and evidence findings Waypoint produces from them, and the matter details you enter all remain your property. We claim no ownership of them and take no license beyond what we need to provide the service to you.
Your records are processed only to build and serve your chronologies. They are never used to train, fine-tune or improve any AI model, never shared with other clients, and never used for analytics or benchmarking.
Waypoint stores your records and chronologies so your team can return to a matter, review findings and export again. Records are retained for one year by default. You can choose a shorter period, or extend retention beyond one year for an additional charge, and you can delete a matter, or all of your data, at any time.
When the retention period ends or you delete data, the records, chronologies and everything derived from them are permanently removed. You can request written confirmation of deletion. Any chronology you export is yours to keep and store wherever you choose.
To invoice you accurately, we keep page counts, matter counts and processing timestamps. This usage data contains no record content and no patient information.
Waypoint is built to HIPAA's administrative, technical and physical safeguards, and we sign a Business Associate Agreement with every client whose records contain protected health information. The systems that store and process your records are within the scope of our independently audited SOC 2 Type II report, which is available to clients on request.
All storage and processing takes place on infrastructure located in the United States. Your data is never transferred to or handled by servers outside US jurisdiction.
Traffic between your browser and Waypoint is encrypted with TLS 1.2 or higher. Unencrypted connections are refused.
Stored medical records, chronologies and evidence findings are encrypted with AES-256 for as long as they are retained.
Access to the infrastructure that stores and processes your data is limited to authorized Verbotics personnel through role-based permissions. Every access is logged and auditable.
Retention is one year by default, shorter on request, and can be extended beyond one year for an additional charge. At the end of that period, or when you delete a matter, its records, chronologies and derived data are permanently removed.
Page counts, matter counts and timestamps are kept for the length of your contract and deleted when it ends.
In the event of a security incident affecting your data, we notify you promptly in accordance with HIPAA breach notification requirements.
All infrastructure that stores or processes your data is located in the United States.
We will notify active clients before any material change to this policy takes effect.
Contact our data and privacy team. We can also provide our Business Associate Agreement, our SOC 2 Type II report and written deletion confirmations on request.