Waves Privacy Policy
Theorian LLC ("Theorian," "we," "us") makes Waves, an app for timing contractions and sharing them with the people you choose. This policy explains what information Waves collects, how we use it, and the choices you have. We collect as little as possible, and we do not sell personal information. The Theorian company website has its own policy at theorian.com/privacy-policy.
1. A note for clinicians and their clients
Doulas, midwives and other clinicians use Waves to follow clients in labor. Two things are different from most software a practice uses:
- The client is in charge of her own data. A client uses her own copy of Waves. She decides whether to share her contractions with a clinician, and she can end that access herself at any time. She does not need to go through the practice to see, stop sharing, or delete her data.
- We do not know who clients are. Waves does not ask a client or a clinician for a name, email address or phone number. Names and notes a clinician keeps about a client stay on the clinician's device.
Clinicians agree to the Clinical Terms, which limit how they may use what a client shares. Where HIPAA applies to a practice, the practice and Theorian have a Business Associate Agreement, available on every plan. Under it we handle client health information on the practice's behalf, and that agreement applies wherever it and this policy disagree about that information. If a client asks us for something only her practice can answer, such as a copy of its own records, we pass the request to the practice.
2. Information we collect and why
| What | Details | Why |
|---|---|---|
| Contractions and labor entries | Start and end times, and entries you add such as water breaking, intensity or a note. Kept on your device, with a copy on our servers under your anonymous identifier so it can be restored and delivered to the people you connect with. | To run the app and deliver what you share to the people you chose. |
| Names, labels and client notes | Kept on your device. If you create a recovery code, an encrypted copy is stored on our servers, locked with your code. We cannot read it. | So you can recognize the people you are connected with, and restore them on a new device. |
| An anonymous account | A random identifier created on first launch. Optionally a recovery code, a random code that is not linked to your identity. A lost code cannot be recovered by anyone, including us. | To keep your data yours without knowing who you are. |
| Notification token | If you allow notifications, a token that lets Apple or Google deliver alerts to your device. The names you give people are added on your device. | So the people you are connected with can alert you. |
| Location, only when you share it | Your precise location, only when you tap to share it with specific people on Waves, for 1 or 3 hours. It is encrypted on your device with a key only you and those people can read, it is deleted when you stop or when the time runs out (whichever comes first), and it is never sent in a notification. Waves only asks for location while the app is open, never in the background. | So the people you choose can get directions to you. It is used for nothing else, never sold and never used for advertising. You can stop sharing at any time, and you can turn off location permission in your phone's settings. |
| Purchases and access | Which plan, add-on or complimentary code an anonymous identifier holds. We never receive your payment card. | To unlock what you paid for or were given. |
| Agreement records | For clinicians: which version of the Clinical Terms your anonymous account agreed to, and when. For a practice that signs an agreement with us on our website: the practice's name, and the signer's name, title and email. A signed agreement is not linked to any app account. | To have a record of what was agreed. |
| Messages you send us | A help or feedback message is stored so we can respond, without anything that links it to your account. A reply email address, if you add one, is used only to answer you and is not kept in our database. | To help you. |
| Clinician enquiries | The name, email address, practice, role and phone number you enter on our clinician page. | To contact you about Waves for your practice. |
| Diagnostics | App version, platform and technical logs from our servers. | To keep Waves reliable and prevent abuse. |
The app does not ask for your contacts or a government identifier, and it asks for your location only when you choose to share it (see above). We ask for your agreement before your first share. We do not buy information about you from anyone, and we do not build advertising profiles.
3. Health information
Contraction timing and the entries you add alongside it are health-related information, and we treat them that way. They are sent only to the people you invite. They are never sold, never used for advertising, and never shared with data brokers. You choose who is invited, and you can remove someone at any time.
We do not use your data to make automated medical decisions. Waves is not a medical device and does not replace medical advice. Always consult your doctor or midwife during labor.
4. How we share information
We do not sell personal information, and we do not share it with anyone for their marketing. We share it only as follows:
- With people you choose to invite to a Waves session.
- With service providers that run parts of Waves for us, under contracts that require them to protect the data and use it only to provide their service: Google (Firebase and Google Cloud, for storage, sign-in and notification delivery), Apple (notification delivery and purchases), RevenueCat (purchase records) and Resend (delivering notices to our own inbox).
- With Google AdMob, only in the free version. To show an ad, it receives basic device and network information such as your IP address and device type. It does not receive your contraction data, and we do not give it an advertising identifier.
- When the law requires it, such as a valid court order, or when it is needed to protect someone's safety or to investigate abuse of the service. Because we do not know who our users are, there is very little we could hand over. Where a request concerns a practice's clients, we tell the practice first whenever the law allows.
- If the business changes hands. If Theorian is involved in a merger, sale or similar transaction, information may transfer to the new owner, who must keep honoring this policy for the information it receives.
- With your consent, for anything else.
5. Advertising, tracking and cookies
Waves does not track you across apps or websites owned by other companies, and does not ask for permission to do so. The free version of the app shows ads that are not personalized and are not based on your activity elsewhere. Paid plans and complimentary clinical access remove ads.
Our web pages do not use advertising cookies or third-party analytics. Because we do not track you, there is nothing for a browser's "Do Not Track" or Global Privacy Control signal to switch off.
6. Purchases and subscriptions
In-app purchases and subscriptions are processed by the Apple App Store or Google Play, with RevenueCat keeping track of what an anonymous app identifier has purchased. We never receive or store your payment card information.
7. Your choices
- Stop sharing. Remove a connection in the app and that person's access ends immediately. Either side can end a connection.
- Clear your device. You can clear the data held on your device at any time in Settings.
- Delete everything. Settings → Account → Delete my account and data erases what our servers hold about you (how deletion works). Because your account is anonymous, we cannot find or delete it for you by email. Deleting does not cancel a store subscription.
- Notifications. Turn them off in the app or in your device settings.
- Enquiries. If you gave us your details on our clinician page, email us to have them corrected or removed.
8. Retention and security
We keep information only as long as it is needed for the purposes above. Shared contraction data is kept while the connection exists and is deleted when the person who shared it removes the connection or deletes their account. Help messages are deleted once handled. Signed agreements are kept as business records.
Data is encrypted in transit and at rest, and access rules on our servers limit each timeline to the person who owns it and the people she invited. Names never leave your device unencrypted. No method of storage or transmission is perfectly secure. If we learn of a breach affecting your information, we will tell the people affected without unreasonable delay, and practices within the time their Business Associate Agreement sets. Our security page explains how to report a vulnerability.
9. Your rights, including in California and other states
Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to not be treated differently for using these rights. Some states give additional rights over health-related information, including the right to withdraw consent to its collection or sharing.
- In the last 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not use sensitive information for anything other than providing Waves.
- The categories we collect, their sources and purposes are in section 2; who we disclose them to is in section 4.
- Most rights are available directly in the app (section 7), which is also the only way we can act on an anonymous account. For anything else, or to appeal a decision, email hello@theorian.com. An authorized agent may write on your behalf with proof of authorization.
- If your clinician or practice holds information about you, please ask them directly; we will pass along any such request we receive.
10. Children
Waves is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will delete it.
11. International users
We operate from the United States. If you use Waves from outside the United States, your information may be transferred to and processed in the United States and other countries with different data protection laws.
12. Other sites and changes to this policy
Links in Waves or on our pages may lead to sites run by others; their own policies apply there. We may update this policy from time to time. Material changes will be reflected in the effective date above and announced in the app or on this page before or when they take effect.
13. Contact
Theorian LLC, Honolulu, Hawai‘i, USA. hello@theorian.com · dev@theorian.com