Trust, safety and privacy
Waterway builds tools that handle different kinds of information, so they are protected differently. A play therapy course and a clinical documentation tool do not warrant the same controls, and pretending otherwise would be dishonest.
Protections are designed around the information each product actually handles. Every product page says which category it falls into and links to its own privacy and security details.
Products that handle protected health information
Tributary and Basin work with clinical information. For these, Waterway signs a Business Associate Agreement with your practice before any client information is processed. Technical and administrative safeguards are documented product by product, and each maintains its own security page.
Products that do not
Trailhead and Growing Together are educational tools. They do not collect clinical records and are not covered by HIPAA. They collect account information and the ordinary usage data needed to run the service, and nothing is sold.
How we use AI
Some Waterway products use large language models to draft text. Where they do:
- A person reviews and approves everything before it enters a clinical record.
- Client information is not used to train models.
- Drafts are working material, not clinical conclusions, and nothing is presented as a diagnosis or recommendation.
- We say which model providers we use and under what agreements on each product's security page.
Data minimization
We collect the minimum a product needs to work, hold it only as long as it is needed, and delete it on a stated schedule rather than an indefinite one. Retention periods are published per product.
What we do not do
We do not sell personal information. We do not sell or share clinical information under any circumstances. We do not use client data for advertising.
Reporting a security or privacy concern
If you have found a vulnerability or have a privacy concern, write to privacy@waterway.health. We will acknowledge within two business days.