Privacy Policy
Waterway LLC builds Tributary, a documentation tool used by behavioral health clinicians to draft clinical notes. This page explains what information we handle, why, and what we do not do with it.
Two different relationships
Tributary involves two groups of people, and our obligations differ for each.
Clinicians and practices are our customers. We hold their account information directly, and this policy governs it.
Clients in therapy are not our customers. We never deal with them. Their information reaches us only because their clinician uses Tributary, and we handle it as a business associate under HIPAA, on the practice's instructions and under a Business Associate Agreement with that practice. A client with a question about their own record should speak to their therapist, who holds it.
Signing in with Google
When you sign in with Google, Tributary receives your name, email address and profile picture from your Google account. It uses them only to identify you and match you to your practice's seat.
Tributary does not access your Gmail, Drive, Calendar, Contacts, or any other Google data. We do not share Google account data with anyone, we do not use it for advertising, and we do not use it to train AI models.
What we hold about clinicians
- Name, email address and profile picture, from Google sign-in
- Professional credentials and documentation preferences, if entered
- Which organization a seat belongs to, and whether it is active
- A record of each note generated — who, which client record by coded identifier, which note type, and when. No clinical content.
What we process on a practice's behalf
This is protected health information. We process it to produce documentation, and for no other purpose.
- Session audio, when a clinician records a session. Sent for transcription and never stored by us.
- Transcripts, held only while a session is in progress or saved as an unfinished draft.
- Generated notes, and the structured session summaries used to give the next session its context.
- Client names, diagnoses and treatment goals, synced from the practice's electronic health record or entered by the clinician.
Where it is kept, and who can reach it
Clinical material is stored in Google Cloud Storage, in infrastructure Waterway operates, encrypted at rest and in transit.
Access is strictly individual. Each clinician's material is reachable only by that clinician. There is no second path to it — not for their clinical supervisor, not for the practice owner, not for another clinician at the same practice, and not for Waterway staff through the application. Supervision and practice oversight happen in the practice's own health record system, where they belong.
Every read and write is logged with the identity that performed it.
Tributary is not the clinical record
The practice's electronic health record holds the clinical record. Tributary holds a working copy: treatment plan information synced from the record system, and drafting material produced along the way. The finished note is placed into the health record by the clinician.
This matters for what follows. Nothing we hold is the only copy of something a practice is obliged to keep.
Subprocessors
We engage a small number of vendors, each under a Business Associate Agreement where protected health information is involved. The current list is published on our disclosures page, and practices under an active agreement are notified before a subprocessor is added or changed.
How long we keep things
| What | Kept for |
|---|---|
| Session audio | Not stored. Transcribed and discarded. |
| Unfinished drafts, including their transcripts | About 14 days from the last save, then deleted |
| Notes, session summaries, goals, diagnoses | While the clinician's seat is active |
| Everything for a clinician | Destroyed 30 days after their seat is terminated |
A suspended seat is not a terminated one. Suspension destroys nothing.
Nothing is returned at termination. Because the practice's health record system holds the clinical record, there is nothing in Tributary a practice needs back. Thirty days after a seat ends, that clinician's material is deleted, including all stored versions.
What we do not do
- We do not sell information, and we do not use it for advertising.
- We do not use client information to train AI models. This is confirmed opted out with every vendor we use.
- We do not read clinical content for our own purposes. Our audit records contain no clinical content.
- We do not write to a practice's health record system. Tributary reads from it; a human puts the note in.
Security
- Sign-in is through Google. Being signed in is not sufficient — a seat must also be granted.
- Storage is reachable only through our own authenticated services, never directly by a browser.
- Access is logged with the identity that performed it.
- No credential that reaches client material is held on a clinician's device.
If you believe you have found a security problem, write to privacy@waterway.health. We would rather hear it early and awkwardly than late.
Requests about a client's information
A client's rights of access, amendment and accounting run to the covered entity — their therapist's practice — not to us. If you are a client, ask your therapist. If you are a practice and need us to act on such a request, write to us and we will respond as your Business Associate Agreement requires.
Changes
If this policy changes in a way that affects how information is handled, practices under an active agreement are notified before it takes effect. The date at the top of this page always reflects the current version.