Privacy Policy

1. Introduction

The Waiver Academy ("we," "us," or "our") is committed to protecting the privacy and security of the healthcare agencies, staff members, and individual learners who use our workforce training and compliance platform. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have.

This policy applies to all services offered through our platform, including compliance training, staff management, reporting tools, consulting services, and our public website.

2. Information We Collect

We collect the following categories of information:

• Agency information — agency name, address, NPI number, agency type, waiver programs, state licensure details, and billing contact information provided during onboarding.
• Staff and learner information — names, work email addresses, job roles, training assignments, course progress, assessment scores, certificates, and CEU records.
• Account information — login credentials (passwords are stored in hashed form and never visible to us), account preferences, and support communications.
• Usage information — pages visited, features used, device and browser type, and log data used to maintain security and improve the platform.
• Payment information — billing details processed through our PCI-compliant payment providers. We do not store full payment card numbers on our servers.

3. How We Use Your Information

• To deliver training, track compliance status, and generate audit-ready reports for your agency.
• To issue and verify certificates of completion and CEU credits.
• To send service notifications such as training reminders, deadline alerts, and account communications.
• To provide customer support and respond to inquiries.
• To maintain the security, reliability, and performance of the platform.
• To comply with legal, regulatory, and contractual obligations.

4. Health Information & HIPAA

The Waiver Academy is a workforce training platform and is not designed to collect, store, or process Protected Health Information (PHI) about the individuals your agency serves. We instruct all users not to enter client or patient PHI into training records, notes, or support requests.

Where our services involve access to information covered by the Health Insurance Portability and Accountability Act (HIPAA), we will enter into a Business Associate Agreement (BAA) with your agency and handle such information in accordance with applicable law.

5. How We Protect Your Data

• Encryption in transit (TLS) and at rest for all agency and staff records.
• Role-based access controls — agency administrators see only their own agency's data, and staff members see only their own training records.
• Regular security reviews, monitoring, and audit logging of administrative actions.
• Vendor due diligence for all subprocessors that support our infrastructure.
• Staff training records are retained for the periods required by state regulations so your agency remains audit-ready.

6. Sharing of Information

We do not sell your data. We share information only in the following limited circumstances:

• With your agency — training progress, scores, and compliance data of staff members are visible to their agency administrators.
• With service providers — infrastructure, email delivery, and payment processors who are contractually bound to protect your information.
• For legal reasons — when required by law, regulation, subpoena, or to protect the rights and safety of our users.
• With your consent — for example, when you share a certificate for verification purposes.

7. Data Retention & Deletion

We retain agency and training records for as long as your account is active and thereafter as required by state training documentation requirements (typically 3–7 years depending on jurisdiction). Agencies may request export or deletion of their data by contacting support; we will honor deletion requests except where retention is legally required.

8. Your Rights & Choices

• Access and update your account information at any time through your portal settings.
• Request a copy of the personal information we hold about you.
• Request correction or deletion of inaccurate information.
• Opt out of non-essential email communications using the unsubscribe link in any marketing email.

9. Cookies & Analytics

We use essential cookies to keep you signed in and operate the platform, and limited analytics to understand how the platform is used so we can improve it. We do not use advertising cookies or cross-site tracking.

10. Children's Privacy

Our services are intended for use by healthcare professionals and organizations. We do not knowingly collect information from anyone under the age of 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or by email before they take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

12. Contact Us

If you have questions about this Privacy Policy or how your data is handled, please contact our team through the Support page or reach out to your account representative.