WaitWise Privacy Policy

Independent service. Not operated by the Government of Ontario or any hospital. Wait times are estimates. Community reports are crowd-reported, not verified by hospitals.

Effective date: October 22, 2026

WaitWise helps people find nearby Ontario hospitals and clinics and view historical and community-reported wait information. WaitWise is not an emergency service or medical advice. In an emergency, call 911.

Information we collect

• Account information: If you register, we store your email address, a bcrypt-hashed password, verification status, account role, and organization where applicable. Email confirmation and requested password-reset codes are sent through Resend when configured. Reset records contain a hashed code, random request identifier, attempt count and 15-minute expiry, not a plaintext code. Resending replaces the earlier request; successful reset consumes it and invalidates existing sessions without bypassing email verification. Expired records are removed opportunistically on later recovery requests. Network-address rate limits also apply.
• Location: With your permission, WaitWise uses precise device location to order nearby facilities, estimate traffic-aware drive times, enforce the on-site report/check-in area (350 m for hospitals; 200 m for clinics), and monitor departure from that area for a visit you chose to track. Coordinates are sent to the WaitWise server for nearby facilities and route estimates. Cloudflare-hosted routes send a geographic tile centre, rather than your exact device position, to TomTom; the separate Node backend sends the requested routing origin. Cloudflare shares area-based route estimates across users through edge caching, KV and D1, with 5–15 minute freshness and recent observations retained for learning. Cache keys include the tile identifier and public destination coordinates, not an account ID. Exact device coordinates are not stored in traffic-cache rows or attached to crowd reports. On the web, checkout monitoring works only while the page is open; native background monitoring requires the appropriate OS permissions.
• Anonymous wait reports: We store the facility identifier/name and public facility coordinates, the selected crowd level or wait duration (from 0.5 to 24 hours), a timestamp, and a random one-time checkout token until checkout. These rows do not contain your account ID or your device coordinates. Checkout replaces the original estimate with the total visit duration and consumes the token.
• Optional facility service ratings: After entering your checkout time, a separate checkout screen lets you choose 1 star (very poor service) through 5 stars (excellent service), or skip rating. Hospitals and clinics are supported. We store this rating on your anonymous wait report, without an account ID. Each check-in report can be rated only once at checkout. Public facility cards show only the average stars and rating count after at least five rated visits. Ratings describe personal service experience, not clinical quality.
• Alternative-care directions: Directions taps for recommended alternatives contribute to monthly destination counts. Ordinary route-choice tracking is retired. These counts do not establish who travelled or arrived.
• Visit streaks: If signed in, a visit session stores your account ID, start/completion/cancellation timestamps, and a broad duration band. Facility name and coordinates are kept on your device, not in the visit-session row. The exact checkout minutes are written to the anonymous wait report described above.
• Optional public leaderboard: If you opt in, your chosen display name and aggregate contribution counts may be shown publicly. Your email and facility-level report records are not shown on the leaderboard.
• Optional device wait alerts: Signed-in users can store facility names/identifiers, wait thresholds, last check time, thresholded live wait and notification state on their device. The Alerts tab displays these saved alerts and why each is waiting. The app periodically sends selected facility identifiers with the saved account session to WaitWise hosting to check community waits, including when the operating system allows background work, and then shows a local notification. Only a live community estimate with at least five qualifying reports, or a wait the hospital publishes live when there are fewer reports, can trigger an alert, never historical averages; the notification says which one it used. A manual test notification checks notification permissions without fabricating a facility wait. So alerts arrive even when the app is closed, a signed-in phone with notifications allowed registers an anonymous Expo push token with your account. Every few minutes WaitWise checks your saved alerts against live community waits and sends a push notification through Expo and Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iPhone). The notification contains only the facility name and wait estimate. We store the token, your account ID, your app language and when each alert last notified you; tokens are deleted when you sign out, delete your account, or uninstall the app. On the website, if you turn notifications on while signed in, your browser gives WaitWise a push subscription: an address at your browser maker's push service (Google, Mozilla, Apple or Microsoft) and encryption keys. We store it with your account ID and language and send the same alerts to it, encrypted so the push service cannot read them. It is deleted when you sign out in that browser, when you delete your account, or when the push service reports it is no longer valid; you can also block notifications in your browser settings at any time. If you ask the website to remind you when to leave for a place, we store that reminder (the place, the message and the time) with your account only until it is sent, then delete it; reminders more than an hour overdue are deleted without being sent. Checks may be delayed or missed and are not emergency notifications. Zero turns an alert off; Cancel or Android back closes the threshold dialog without saving. Best-time predictions for hospitals and clinics also require sign-in.

How location and reports are used

On-device request learning: A small in-memory statistical model learns traffic-request latency and failure rate to reduce retries on poor connections. Refresh timing follows the server's traffic expiry; it does not extend that expiry. The model contains no GPS history, account identifiers or clinical information, is not uploaded and resets when the app restarts. Shared server traffic learning uses aggregate public-area travel times, not individual journeys.

Official health resources: The Health information screen links to Health811 and official Canadian and Ontario influenza/respiratory-virus guidance. WaitWise hosting checks the fixed English/French links and caches reachability results for seven days, refreshing on use after expiry. These checks do not send your location, account data or symptoms to the linked providers. Link-check timestamps are not medical reviews or the providers' publication dates. Opening an official link connects your device to that provider, which applies its own privacy policy; calling 811 uses your phone service. Failed checks are labelled unverified rather than treated as updated guidance.

Arrival confirmation: After sign-in and location consent, the foreground app checks device location services and obtains a fresh fix to find an unambiguous hospital within 350 m or clinic within 200 m, allowing for GPS uncertainty. It asks you to confirm the facility; it does not automatically report a wait. Denied permission, disabled services, stale or imprecise fixes and ambiguous sites can prevent detection. Oakville uses an approximate ER-side arrival point derived from the official hospital map and public entrance geometry, not a surveyed door coordinate. Other hospital pins may still represent campus centres rather than verified emergency entrances. Corporate and hospital aliases for the same identified campus are consolidated without deleting their anonymous reports or ratings. No new background tracking is used for this arrival prompt.

Private testing: App data and submissions require an invited, email-verified account while private testing is enabled. Approved email addresses are stored in a server-side allowlist; each tester uses their own password and session. Sessions authorize requests, but anonymous feedback/report rows do not store account IDs. Revoking an invitation blocks subsequent API access. Verified administrators retain access. Account deletion remains available to revoked accounts with a valid session and also removes their invitation. Android sessions use encrypted device storage; web sessions use browser storage. The website also retains its separate private testing login. Public health/status and policy pages do not expose app data.

Language preference: Without a saved choice, the app reads your device/browser language locally: French uses French; English and unsupported languages use English. No language-selection onboarding is required and this detection is not sent to the backend. Your explicit English or French choice is saved only on your device, without signing in. It applies to the interface and new local notifications, remains after sign-out or account deletion, and can be changed before the initial disclosures or in Account settings. Official facility names are retained. This privacy policy and the linked deletion page are currently available in English.

Nearby wait feedback: While the app is open, new hospital/clinic reports from others can trigger a popup after a fresh device-location check within 350 m for hospitals or 200 m for clinics, including GPS uncertainty, and at least five raw reports. Existing estimates on initial load, your own newly submitted report, and supporting votes alone do not trigger it. Updates are checked periodically, not delivered instantly; multiple reports between checks may appear as one updated aggregate. This does not use background tracking or push notifications. “Still accurate” adds limited support, capped at 25% of raw-report weight, without becoming another report or bypassing the five-report threshold. “Not accurate” asks for a corrected wait from 0.5 to 24 hours and saves it as a new anonymous report. Feedback fields include facility, estimate minutes, report count, latest report timestamp, verdict and corrected minutes when applicable, never device coordinates. A session header authorizes private-testing access, but feedback rows contain no account ID. We store timestamps, snapshot minutes and a random receipt separately from reports. Positive counts appear only after five actions; these are not unique-person counts or proof of accuracy. Device location checks can be spoofed. Feedback older than seven days is removed when new feedback is accepted. Corrected reports follow the existing report retention policy.

Private milestones: Successful report and confirmation counts, UTC monthly counts and recent random submission receipts are stored only on this device. These counts do not measure people helped, do not sync to an account and are not public. Users sharing a device share the counts. Checkout does not count twice. Clear them in Account settings; account deletion also clears them on that device. Signing out does not clear these device-level counts.

On-device models: To reduce network requests, the app runs small models on your device. One learns how often community wait times change by hour of day; it contains no facility you viewed or personal data. When you are signed in, another records which facility details you open and at what hour, so likely wait forecasts can be loaded in advance. It is stored only on this device, never sent to WaitWise, and is cleared when you sign out or delete your account. The app also checks request rates and location-fix quality on the device to pause runaway requests and ignore implausible GPS jumps; these checks are kept in memory only and are not sent anywhere.

Confirmation abuse limits use network addresses, as do other API rate limits. Shared networks may share a limit. No hidden reliability scoring or automatic filtering based on account reputation is used. The public leaderboard is disabled in the current app; legacy opted-in records and older-client API access are retained.

Location is used to find nearby facilities and support the on-site and checkout features. It is not attached to submitted crowd reports. Crowd reports are combined for wait estimates and are only exposed in public summaries when at least five reports are available. Authorized clinic and health-authority dashboards receive thresholded aggregates, not account-linked report rows.

Map tiles are requested from OpenStreetMap. Their tile requests may reveal your IP address and the map area being viewed to the tile provider. WaitWise also uses Ontario Health monthly emergency-department averages and facility-directory information from Statistics Canada and OpenStreetMap; these are not live wait feeds.

Visit features, reminders and offline use

• Arrival reminders (optional): If you turn them on, your phone watches the nearest 15 facilities using the operating system's geofencing. If you stay at one for about 10 minutes, a local notification asks whether you want to report the wait. Geofencing runs on your device; your location is not sent to WaitWise for this feature. Reminders are cancelled when you leave, are limited to one per facility every 12 hours, and can be turned off at any time.
• ER visit steps: If you tap "Triage" or "Called back" during a visit, the minutes since your check-in are added to your anonymous wait report. They are used, combined with other reports, to estimate typical times to triage and to be seen. They carry no account ID or location.
• Visit progress on your lock screen and reminders: During a tracked visit, your phone shows a silent notification with your check-in, triage and call-back times, and may remind you to update your progress after 45 minutes. These are created on your device and removed when the visit ends. Anyone who can see your lock screen may see them.
• Family share links (optional): If you choose "Share with family", WaitWise stores the facility name and your visit step times behind a random, unguessable link. It does not store your name, account, location or wait report with it. Anyone with the link can view it. The edit key that lets your phone update it is stored only as a one-way hash. Links stop working and their records expire 24 hours after check-in, or 6 hours after the visit ends, whichever is sooner. You can stop sharing at any time.
• Amenities and parking: Yes/no taps about amenities (for example Wi-Fi or charging) are added to running totals for each facility. No record of who tapped is kept. Some amenity information and parking rates come from OpenStreetMap and public facility websites.
• Listing problem reports: If you use "Report a problem" on a place, we store the place, the problem you chose, your optional note and the time. If you are signed in, your account ID is stored with it so repeat reports count once; it is removed if you delete your account. Reports are emailed to the WaitWise team through Resend for review and are never shown publicly. Do not include health or personal information in the note.
• Incident reports: Visitors on site can report what is happening at a place (for example a full parking lot or a long line) and answer "Still there" or "Not there". We store the place, the type of incident, the time and running counts. No account or location is stored; a one-way hash of the reporting network is kept only so a report that an ER is closed needs two different networks before it is shown. Reports expire within hours and are deleted soon after.
• Human check: When you create an account, or when one network sends several wait or problem reports in a short time, WaitWise may show a Cloudflare Turnstile check. Cloudflare looks at signals from your browser or device to tell people from automated scripts and gives WaitWise only a pass or fail. WaitWise does not store the check. Cloudflare's privacy policy applies to the data it processes.
• Weather: Area weather summaries used in forecasts are fetched by WaitWise for an area of about 50 km, not your exact location.
• Online booking links: Some clinics show a "Book online" link. Opening it takes you to that clinic's or booking provider's website, which applies its own privacy policy. WaitWise does not receive anything you enter there.
• Offline use: Your phone keeps the last loaded facility listings and averages for up to 7 days so the app can show them without a connection. Wait reports made while offline are kept on your phone and sent automatically when you reconnect. Reports older than 3 hours are discarded rather than sent, because they would no longer describe the current wait.
• Terms acceptance: When you accept the Terms of Use, your phone saves the terms version, the time, and your emergency acknowledgement. This record stays on your device and is not sent to WaitWise.

Sharing and service providers

We do not sell personal information or use advertising analytics SDKs. Data is processed by WaitWise hosting providers. TomTom processes route coordinates to return traffic-aware drive estimates. Resend processes account-confirmation emails when enabled. Expo, Google Firebase Cloud Messaging and Apple Push Notification service deliver wait-alert notifications to the app; your browser maker's push service (Google, Mozilla, Apple or Microsoft) delivers them on the website. OpenStreetMap provides map data. Environment and Climate Change Canada provides area weather data used in forecasts. Sentry (Functional Software, Inc., EU data region) receives anonymous crash and error reports so we can fix problems; before a report leaves your device, WaitWise removes locations, email addresses, phone numbers, sign-in tokens and search details, and it never includes screen recordings, screenshots or your account. A small share of anonymous performance timings is sent too. Cloudflare Web Analytics counts page views, where visitors came from (the referring site), their country and type of device or browser, and how fast pages load; it uses no cookies, does not track you across sites, and does not collect your location, account or health information. Opted-in leaderboard names are public; thresholded facility aggregates may be shown to authorized clinic or health-authority accounts.

Retention and deletion

Alternative-care selections: When you select directions to a recommended walk-in clinic or urgent care centre, the app sends the destination facility identifier for a monthly aggregate counter. Calls, Health811 links and ordinary directions from the main facility list are not counted. Counts measure selections, not unique users, arrivals or confirmed diversions. Repeated selections are throttled; optional daily budgets can cause undercounting. No individual route history, user coordinates or account identifier is saved in these aggregates. Rate limiting uses a daily secret-salted hash of your network address in separate rate-limit records; hosting providers may still process network addresses. Monthly counts and thresholded wait aggregates have no automatic expiry. General route-choice collection is retired; legacy records are retained for migration compatibility.

Monthly wait metrics: Facility/month check-in and checkout aggregates are stored separately, without account identifiers or individual submission timestamps. Optional collection caps can make these counts incomplete. Admin dashboards show groups only once their minimum sample threshold is reached. These measures are not a guarantee of legal anonymization or regulatory compliance. A private Grafana data source displays these aggregate wait metrics through a dedicated read-only API. No raw reports, account records or clinical records are supplied to Grafana by this API.

Anonymous service ratings remain with anonymous reports and cannot be identified for deletion by account.

Watchlist facility identifiers and alert thresholds are saved to your signed-in account in Cloudflare D1 and synced across devices. No GPS coordinates or notification push tokens are stored with these preferences. Signing out pauses device notifications but preserves cloud preferences. Account deletion removes cloud preferences. Device notification state is isolated by account, and each phone needs notification permission. Sync occurs on sign-in, foreground resume, explicit refresh and periodic active/background checks; it is not instantaneous. Older shared device preferences are imported only when you explicitly choose to import them. Appearance remains device-specific. Push tokens and browser push subscriptions for wait alerts are deleted on sign-out and account deletion.

Account-linked information is retained while your account is active. You can delete your account from Account settings in the app. This deletes your account, verification and password-recovery records, alerts, leaderboard profile/events, and linked visit sessions. Anonymous reports, legacy route records, monthly wait aggregates and alternative-care counts are not linked to accounts and may remain; they cannot be located by account for individual deletion.

If you cannot access the app, use the account and data deletion page or email [email protected] from the address on your account.

Accessibility and privacy

WaitWise is committed to accessible design and protecting your privacy. Formal AODA and PHIPA compliance has not been independently verified.

Ontario Health readiness: WaitWise is not connected to ONE ID, WTIS or ConnectingOntario ClinicalViewer and does not access patient records from these systems. Staff/admin readiness work does not replace professional identity verification, Ontario Health authorization, privacy/security assessments or legal agreements. Community-reported waits are not official provincial clinical measurements. Any future connection or change to personal-information processing requires review and an updated disclosure before activation.

Experimental forecasts: The backend collects compact facility/hour check-in wait totals and counts without account identifiers, tokens or individual event timestamps in those aggregates. It uses bounded hourly slots and daily collection caps; old inactive slots can remain but are excluded from training. Signed-in, verified approved users can request experimental hourly wait forecasts; administrators and the private Grafana data source can view the same aggregate projections. Insufficient, stale or unvalidated history does not produce predictions. Forecasts are not live clinical data, patient counts, flu surveillance or advice to postpone care. Existing Alternative Care remains accessible to approved users without forecast access.

Security and contact

Passwords are stored as bcrypt hashes, and production connections should use HTTPS. You are responsible for protecting your sign-in credentials. For privacy questions or deletion requests, contact [email protected].

WaitWise
Website: www.wait-wise.ca