Waypoint Privacy Policy

Smokepit Syndicate LLP

Effective Date: 7/23/2026

What We Do

At Smokepit Syndicate LLP ("Smokepit," "we," "us," or "our"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you access or use the Waypoint mobile application, the Waypoint web pages, and any related services that link to this Privacy Policy (collectively, "Waypoint" or the "Platform").

Waypoint helps veterans, service members, and their families and caregivers ("Members") navigate the VA system and connect with healthcare providers, service organizations, and nonprofits with experience serving the veteran community ("Providers"). This Privacy Policy applies to both Members and Providers. Sections 1 through 13 apply to everyone; Section 14 contains additional information for Providers.

By using or accessing Waypoint, you acknowledge that you accept the practices described in this Privacy Policy and consent to the collection, use, and sharing of your information as described here. If you do not agree with this Privacy Policy, do not use the Platform. Waypoint is intended for users located in the United States.

Smokepit Syndicate LLP is not affiliated with the U.S. Department of Veterans Affairs or any other government agency. Information you share on Waypoint is not shared with the VA by us except as described in this Policy or required by law.

1. Information We Collect

"Personal data" means information that can identify or be linked to a specific individual, including what is commonly called "personally identifiable information" under applicable privacy laws. We collect the following categories of personal data:

Personal identifiers: Name, email address, username, ZIP code, and, if you choose to provide it, phone number.

Account and profile information: Information you add to your account, such as your affiliation with the veteran community (for example, veteran, family member, or caregiver), preferences, and settings.

Messages and communications: The content of messages you send to Providers through the Platform, and communications you send to us by email or through support channels. Messages may include information you choose to share about your circumstances, including health-related or benefits-related information (see Section 5).

Online identifiers: IP address, device type and identifiers, browser type and version, operating system and version.

Internet activity: Interactions with the Platform, pages and profiles viewed, referring source, and analytics data.

Approximate location data: General location inferred from your IP address or ZIP code, used to show you nearby Providers and resources. We do not collect precise GPS location unless you enable a location feature on your device and grant permission.

We do not require you to provide details about your medical history, disability rating, or claims to use Waypoint. Anything you choose to include in a message or free-text field is provided voluntarily.

2. Sources of Personal Data

Directly from you — when you create an account; when you browse Providers, guides, and resources; when you send a message to a Provider; when you contact us by email or through support channels; and when you submit information through forms, surveys, or feedback tools.

Automatically via the Platform — through cookies and similar technologies (described in Section 6); through log data generated when you use the Platform; and, if you enable location features, through your device's location services.

From third parties — from service providers that help us operate the Platform, analyze how it is used, or provide customer support; and from Providers, to the extent they share information with us in the course of managing their profiles or responding to concerns.

3. How We Use Your Information

We use personal data for the following purposes:

Providing the Platform: Creating and managing accounts; displaying Provider profiles and resources; delivering messages between Members and Providers; and responding to your requests and support inquiries.

Improving the Platform: Analyzing usage to improve features, content, and navigation resources; testing and developing new features; and personalizing content, such as showing Providers and resources relevant to your general location.

Communicating with you: Sending service communications, such as account notices, message notifications, and updates to our terms and policies; and, where permitted, sending you information about Platform features and resources. You may opt out of non-essential communications at any time.

Safety, security, and legal compliance: Detecting and preventing fraud, abuse, and security incidents; enforcing our Terms of Use; complying with legal obligations; and responding to lawful requests from public authorities.

De-identified and aggregated data: Creating anonymized, aggregated reports and statistics — such as usage patterns and resource demand — for analysis, research, and Platform improvement. Aggregated data does not identify individual users.

4. How We Disclose Your Personal Data

We may share personal data in the following situations:

With Providers you contact. When you send a message to a Provider through Waypoint, the contents of your message and the identifying information you include (such as your name and contact details) are shared with that Provider. Providers are independent of Smokepit; once you share information with a Provider, their handling of it is governed by their own privacy practices and professional obligations, not this Policy. Share only what you are comfortable sharing.

With service providers. We share personal data with third-party providers that perform services on our behalf, such as data hosting and storage, customer support tools, communications and email delivery, analytics, and security and fraud prevention. Service providers are permitted to use personal data only to perform services for us.

For legal reasons. We may disclose personal data in response to legal process such as subpoenas, court orders, or regulatory demands, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Smokepit, our users, or the public.

In business transfers. Personal data may be transferred as part of a merger, acquisition, financing, or sale of assets. You will be notified of any material change in how your data is handled.

De-identified data. We may share de-identified, aggregated data — which cannot reasonably identify you — with third parties for research, statistical analysis, or service improvement, including research that benefits the veteran community.

With your consent. We may share personal data with third parties for other purposes with your explicit consent.

We do not sell your personal data, and we do not share personal data with third parties for their own marketing purposes. We do not share your personal data with the U.S. Department of Veterans Affairs except at your direction or as required by law.

5. Health-Related and Sensitive Information

Because of what Waypoint is for, information you share on the Platform — particularly in messages to Providers — may reveal sensitive details, such as information about your health, mental health, disability, benefits, or military service history.

Please understand the following:

Smokepit is not a healthcare provider and is not a "covered entity" under the Health Insurance Portability and Accountability Act (HIPAA). Information you share through Waypoint is protected by this Privacy Policy and applicable privacy laws, but it is not protected health information under HIPAA while held by Smokepit, and messages sent through the Platform are not part of any medical record.

Waypoint messaging is intended for initial outreach and coordination. Do not send detailed medical records, Social Security numbers, claim files, or financial account information through the Platform.

We treat health-related information you share with heightened care, use it only to provide the Platform (for example, delivering your message to the Provider you chose), and do not use it for marketing.

6. Cookies, Analytics, and Your Options

Waypoint uses cookies and similar technologies (such as pixels, mobile identifiers, and local storage — collectively, "Cookies") to operate the Platform, keep you signed in, remember your preferences, and understand how the Platform is used.

Essential Cookies are necessary for the Platform to function, such as maintaining secure login sessions. Disabling them may prevent features from working.

Functional Cookies remember your settings and preferences.

Performance and analytics Cookies help us understand which pages and resources are used most, so we can improve the Platform.

We do not use advertising or retargeting Cookies, and we do not permit third-party ad networks to track users on Waypoint. If that ever changes, we will update this Policy and provide the choices required by law.

You can manage or disable Cookies through your browser or device settings. Where required by applicable U.S. state privacy laws, we honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information; as stated above, we do not sell or share personal data for cross-context behavioral advertising.

7. Data Security

We take the security of your data seriously and use physical, technical, organizational, and administrative measures appropriate to the type of data we handle — including encryption of data in transit using Transport Layer Security. Our data is stored and processed on servers located in the United States.

Security also depends on you: choose a strong password, keep your login credentials confidential, and sign out on shared devices. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security; you acknowledge that you transmit personal data at your own risk. Except as required by law, we are not responsible for unauthorized access, loss, theft, or disclosure of personal data.

In the event of a data breach involving your personal data, we will notify you as required by applicable law, which may include email notification or a prominent notice on the Platform.

8. Data Retention

We retain personal data for as long as necessary to provide the Platform and for the purposes described in this Policy, considering the type of data, why it was collected, and its sensitivity. We retain account information while your account is active; message content for as long as needed to provide the messaging feature and address disputes or abuse; and log and diagnostic data for the period necessary to maintain the security and functionality of our systems. We may retain data longer where required to comply with legal obligations, resolve disputes, or enforce agreements, and we may retain anonymized or aggregated data that does not identify you.

When you delete your account, we will delete or de-identify your personal data within a reasonable period, except where retention is required or permitted by law. Note that messages you sent to Providers may remain in those Providers' possession.

9. Children's Privacy

Waypoint is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal data from children under 13. If we learn that we have received personal data from a child under 13 without verified parental consent, we will promptly delete it. If you believe a child under 13 may have provided us personal data, contact us at [email protected].

10. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), gives you specific rights regarding your personal data:

Access: You may request details about the categories of personal data we have collected about you, the sources, the purposes for collection, the categories of third parties with whom we have shared it, and the specific pieces of personal data we hold about you.

Deletion: You may request that we delete personal data we have collected from you, subject to exceptions under the CCPA (for example, where we need the data to provide the Platform or comply with law).

Correction: You may request that we correct inaccurate personal data.

Limit use of sensitive personal information: You may request that we limit the use of sensitive personal information to the purposes permitted by the CCPA. We already limit our use of sensitive information as described in Section 5.

Opt out of sale or sharing: We do not sell personal data or share it for cross-context behavioral advertising. If that ever changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism as required.

Non-discrimination: We will not deny you services or provide a different level of service because you exercised your CCPA rights.

To exercise these rights, email us at [email protected] with "California Rights" in the subject line.

11. Other U.S. State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Texas, Oregon, Washington State (including under the My Health My Data Act with respect to consumer health data), or another state with a comprehensive consumer privacy law, you may have rights to: confirm whether we process your personal data and access it; correct inaccuracies; obtain a portable copy; delete your personal data; and opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. As described above, we do not sell personal data or engage in targeted advertising.

These rights are subject to conditions and exceptions under applicable law, and we may decline requests where the law permits or requires. If we deny your request, you may appeal by emailing [email protected] with "Consumer Appeal" in the subject line, including information sufficient to verify your identity and a reference to your original request. We will respond to appeals within the time required by the applicable state law. If we deny your appeal, you may be able to contact your state's attorney general or regulator.

12. Exercising Your Rights

To exercise any of the rights described in Sections 10 and 11, submit a request that (a) provides enough information for us to verify that you are the person whose data we have collected, and (b) describes your request in enough detail for us to understand and respond to it. Information you provide to verify your identity will be used only for verification and to fulfill your request.

Submit requests by emailing [email protected] with "Access/Delete/Correct Data Request" (or the relevant request type) in the subject line. We will respond within the timeframe required by applicable law and will not charge a fee unless the request is excessive, repetitive, or unfounded, in which case we will explain the fee before completing the request.

You can also review and update your account information at any time by logging into your account. Deleting your personal data may require deletion of your account. If you remove content you posted, copies may remain in cached or archived form or in the possession of Providers or other users who received it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, legal requirements, or our privacy practices. We will communicate significant changes in advance through a notice on the Platform or by email. For minor updates, we may revise the Policy without prior notice; the Effective Date at the top will indicate when the latest revisions were made. By continuing to use Waypoint after an updated Privacy Policy takes effect, you agree to the revised Policy.

14. Additional Information for Providers

This section applies to Providers — the healthcare providers, service organizations, nonprofits, and their representatives who maintain profiles on Waypoint. It supplements the sections above.

Information we collect from Providers:

Personal and organizational identifiers: Name, organization name, email address, phone number, and mailing address.

Professional information: Credentials, licensure, accreditations, specialties, services offered, experience serving the veteran community, and other information you include in your profile.

Profile content: Descriptions, photos, links, and other materials you submit for your public profile. Your profile is public and visible to Members and visitors to the Platform.

Communications: Messages exchanged with Members through the Platform and communications with us.

Online identifiers and internet activity: As described in Section 1.

How we use and share Provider data: We use Provider data to create, display, and maintain your public profile; to deliver messages from Members; to verify information where we choose to do so; to communicate with you about your account; and for the safety, security, analytics, and legal purposes described in Section 3. Provider profile information is, by design, publicly visible. We share Provider data with service providers as described in Section 4, and may publish information by or about Providers as part of operating the directory.

Your responsibilities: Providers are independent controllers of any personal data Members share with them through the Platform. You are responsible for handling Member information in accordance with the laws and professional obligations that apply to you, including, where applicable, HIPAA and state health privacy laws.

Managing your profile: You can review and update your profile by logging into your account. To unpublish your profile or delete your account, contact us at [email protected].

15. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, contact us at:

Smokepit Syndicate LLP, 7106 NC Highway 42 S, Ramseur NC 27316, Email: [email protected]