Privacy Policy

Who is responsible for your data

Waypoint Care is operated by Lodestone Consulting Ltd, a company registered in Ireland (CRO No. 354809, VAT No. IE6374809T), registered office Harbour St., Mullingar, Co. Westmeath, Ireland N91 H962. We are the data controller for the personal data described here.

Questions or requests: privacy@waypointcare.app.

The short version

Waypoint Care exists to help a family or care team keep someone safe. We only collect what that job needs, we never sell it, and the person being cared for can see and withdraw consent at any time.

What we collect and why

Account details — name, email address, login credentials and (if you turn on text alerts) your mobile number — to create and secure your account and to contact you about the service. Legal basis: performance of our contract with you.

Care records you create: safe zones, incident notes, medication schedules and doses, calendar events, and messages to your care team — to provide the service. Legal basis: performance of our contract.

Location data from the device the cared-for person carries — a phone, GPS watch, pendant or tracker — but only while consent is recorded as active. Legal basis: consent, recorded by the person or their legal decision-maker.

Technical and usage data: device type, IP address, and which pages are opened — for security, fraud prevention and improving the product. Legal basis: our legitimate interests in running a safe, working service.

Support messages you send us, to answer them. Legal basis: legitimate interests and contract performance.

Consent comes first

Location tracking only runs when a consent record exists for the cared-for person. It is shown in Settings, dated, and can be withdrawn in one tap. When consent is withdrawn, live location stops immediately and historical points stop being displayed.

Where the person cannot give informed consent themselves, the legal decision-maker (an attorney, deputy, guardian or equivalent under your local law) records it on their behalf and remains responsible for it.

Who can see the data

Only the carers you invite to that person's care circle. Every record is locked to the household or facility it belongs to, enforced at the database level, not just in the app.

Care facility accounts: staff carers see only the residents they are assigned to.

We do not sell data, share it with advertisers, or use it to train third-party AI models.

Who we share it with

Service providers and subprocessors: hosting and database providers (encryption in transit and at rest), text-message delivery for alerts, and support tooling. Each only receives the minimum needed to do its job.

Paddle.com, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing and tax compliance. Paddle handles card details; we never see them.

Professional advisers (legal and accounting) and public authorities where we are required by law.

International transfers

We are based in Ireland and store data in the EEA where possible. Where a provider processes data outside the EEA/UK, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls at the database, and least-privilege access for staff.

Cookies

We use essential cookies to keep you signed in and to keep the service secure, plus limited analytics cookies to see which pages need improving. We don't use advertising cookies. You can clear or block cookies in your browser, though essential ones are needed for sign-in to work.

How long we keep it

Care records stay for as long as the subscription is active. If you close the account, we delete or anonymise personal data within 30 days, other than what we must keep for tax and accounting records.

You can export everything to CSV or PDF from the Reports page before you leave.

Your rights

Under EU/UK data protection law you can request access to your data, rectification, erasure, restriction of processing, portability, and you can object to processing or withdraw consent at any time.

To make a request, email privacy@waypointcare.app; we respond within one month. You can also complain to the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

Children

Waypoint Care is not designed for, or directed at, anyone under 18.

Changes

If we change anything meaningful, we will email account holders before it takes effect rather than quietly updating this page.