Legal

Data Processing Addendum

Effective October 12, 2026 · Last updated October 12, 2026

This Data Processing Addendum (“DPA”) describes how MortonApps LLC (“we,” “us”; after a transfer under section 14 of the Terms of Service, the party that then holds those terms) processes personal data on behalf of agencies that use Care Roster at careroster.org. It supplements and forms part of our Terms of Service, and should be read alongside our Privacy Policy. If this DPA and the Terms of Service conflict, the order of documents in section 14 of the Terms of Service decides which controls.

1. Roles of the parties

For the personal data your agency enters into and processes through Care Roster (“Customer Data”), your agency is the data controller and we are the data processor. Your agency decides what personal data to enter and for what purpose; we process that data only on your documented instructions, which are the instructions set out in our Terms of Service, this DPA, and your configuration and use of the service. If we believe an instruction would violate applicable law, we may tell you and decline to follow it.

2. Categories of personal data and data subjects

The personal data we process on your behalf is limited to what your agency chooses to enter to maintain its contact directory and send alerts to its staff. Depending on your configuration, this includes:

Contact directory records: organization name, category, tags, and for each individual contact: name, role, phone number, email address, after-hours or on-call designation, who they report to (for a contact synced from Microsoft 365, including their manager’s Microsoft 365 object ID), and any alert groups your agency puts them in.
Staff account records: the name, email address, and hashed password of each staff member you invite, plus an audit trail of account activity.
Alert records (if your agency sends alerts): the mobile numbers set up to receive texts, each number’s consent and opt-out status and history, your agency’s confirmation about its work mobile numbers, the email addresses alerts were emailed to and each email’s delivery result, the alerts sent or scheduled (with who scheduled one and when it is due), the custom groups your agency saves (and any alert templates it saved before Care Roster stopped offering them), your agency’s escalation list (who is on it, and who saved it and when), delivery results, whether and when each person responded (by text, with an email’s answer button, or in the Care Roster app), when each person opened the alert in the Care Roster app, whether a reply was an opt-out or opt-in or asked for help, and, if an alert offered numbered choices, which choice or that none was picked, and who at your agency marked a person who asked for help as addressed, or undid that, and when; and automatic follow-up and staff emergency escalation records: when each reminder or follow-up went out and when they stopped, and for each staff emergency escalation, the people it was about (by name) and the phone number its notice gave for each, who was notified and how the escalation list reached them (on-call rotation, supervisor, named staff, or admin), with the times. We never store any other words in a reply.
App device records (if your staff use the Care Roster app): for each phone or tablet a staff member signs in on, tied to their account and directory contact: its notification address, type and name, app version, notification settings, when the app last checked in, and which alert notifications were sent to it, with the result.

The data subjects are the operational contacts your agency stores in the directory (and the managers whose Microsoft 365 object IDs are stored with a contact), the staff members you authorize to use the service, and the staff your agency sends alerts to.

Out of scope: patient data and protected health information (PHI) of any kind. There are no patient fields in the product, free-text fields carry a visible reminder never to enter patient information, and our Terms of Service prohibit it, including in the text of an alert or response. Care Roster is designed to hold no PHI, so we do not sign HIPAA Business Associate Agreements (BAAs) and do not agree to act as anyone’s business associate.

3. Purpose and duration of processing

We process the personal data solely to provide, support, and improve the service for your agency: storing your contact directory records, exporting data on request, sending account emails you trigger, sending the alerts, texts, and emails your agency directs, including the reminders, follow-ups, staff emergency escalation notices, and scheduled sends it sets up, showing and sending the name and phone number of a person who asks for help to the people your escalation list reaches or lets see the Needs help list, as section 13 of the Terms of Service describes, which your agency instructs by using staff emergency escalation, honoring opt-outs, showing consent and opt-out records, and records of what was sent and when, to carriers, our messaging providers, or regulators when needed for compliance or to answer a complaint, keeping the texting records described in Section 8, and keeping your account secure. We do not sell personal data or use it to train AI models, other than as our AI provider’s terms may allow for safety-flagged content (see Section 4), and we do not use it for advertising, except that, as section 14 of the Terms of Service allows, we may occasionally email your admins about our products, using only the data our Privacy Policy describes. We may also use it where needed to comply with the law or a legal hold, enforce our terms, or bring or defend legal claims. For these uses we act on our own behalf. We may also create usage information about how the service is used and performs, which we use only for the purposes above and to set and enforce fair use, and aggregated or de-identified data, as section 14 of the Terms of Service describes. Data that identifies no agency or person is not Customer Data, and we will not try to re-identify it. Processing continues for as long as your account is active and through any wind-down period described in Section 8.

4. Subprocessors

We use a short list of providers (“subprocessors”) to run and support the service. The authoritative, current list is maintained in our Privacy Policy. As of the last-updated date above, it is:

Cloudflare: application hosting and data storage (United States). Apart from what the providers below handle and the encrypted backups, we do not keep copies of Customer Data elsewhere, except short-lived working copies we make to operate, support, or fix the service, which we delete when we are done.
Amazon Web Services (AWS): Amazon SES email delivery, AWS End User Messaging text delivery, and encrypted off-site database backups on Amazon S3 (United States).
Telnyx LLC (not yet in use): backup text-message delivery, used only when AWS cannot send (primarily the United States). Telnyx’s data processing addendum applies; it also lets Telnyx use phone numbers and message records for its own billing, fraud and spam prevention, service improvement, and legal and telecommunications obligations, and message text in de-identified form to improve its services, but not for marketing.
Microsoft: our business email (Microsoft 365), which holds what you email us and our internal service alerts, which can name your agency and the staff member involved (United States); and, if your agency connects its own Microsoft 365, Microsoft’s sign-in and Graph services, under your agency’s own agreement with Microsoft.
Google LLC: Firebase Cloud Messaging, under Google’s own Firebase terms, delivers Care Roster app notifications to Android phones and tablets (United States and other countries). Google receives each device’s notification address, the device’s IP address, an installation ID and basic details about the device and the app (the app contacts Google for these when it first starts, before anyone signs in), basic delivery information, and each notification, which names your agency and may identify the alert but does not include the alert’s text or anyone’s name. Google’s Firebase Data Processing and Security Terms apply to this service.
Apple Inc.: once the Care Roster app is available for iPhone and iPad, the Apple Push Notification service, under Apple’s own developer terms, will deliver its notifications to those devices (United States and other countries). Apple will receive each device’s notification address and each notification, which names your agency and may identify the alert but does not include the alert’s text or anyone’s name. We have no separate data processing agreement with Apple for this service.
Anthropic, PBC: AI tools we use to operate, support, and maintain the service, including reviewing problem reports and support emails and helping us fix problems (United States and other countries). While helping us, they may process data in the service, such as names, contact details, alert records and responses, and account and usage information. We use them on Anthropic’s consumer Claude Max plan, under Anthropic’s consumer terms, not a business agreement, and we have no data processing agreement with Anthropic. The setting that lets Anthropic train its models on our sessions (“Help improve Claude”) is turned off. Its consumer terms still let it use what we send for its own purposes, including improving its services, safety review, and legal compliance, and let it use content its systems flag for safety review, including for model training even when the training setting is off. For flagged content, Anthropic’s published policy is to keep inputs and outputs for up to 2 years and safety classification scores for up to 7 years. It keeps feedback we submit, together with the data attached to it, for up to 5 years. Otherwise, with training off, it states that deleted conversations are removed from its systems within 30 days. These periods are Anthropic’s and may change. We never send Anthropic feedback (such as a rating or a feedback report) on work that includes an agency’s data.

Your agency authorizes us to use the subprocessors on this list, each on the terms the list describes, including Anthropic under its consumer terms, and to add or replace subprocessors under Section 5. This authorization is one of your documented instructions under Section 1. We choose our subprocessors with care. Our responsibility to you for them is limited as section 8 of the Terms of Service provides. Whether messages are delivered is covered by section 13 of the Terms of Service, not by this DPA.

Payments are outside this list. Lemon Squeezy, our merchant of record, sells and processes paid plans in its own name. It receives no Customer Data, only the billing contact’s name and email and the subscription record, and holds the card details, which we never see. It handles that information for its own tax and fraud-prevention obligations, not on our instructions, so it is a payment provider, not a subprocessor. See our Privacy Policy.

5. Notice of subprocessor changes

If we add or replace a subprocessor that processes your personal data, we will update the list in our Privacy Policy and notify active customers in Care Roster or by email before the new subprocessor begins processing, giving you a reasonable opportunity to object. If you reasonably object to a new subprocessor on legitimate data-protection grounds and we cannot accommodate the objection, you may terminate the affected service and we will assist you in retrieving your data as described in Section 8. Terminating under this section is your only remedy for the change; we refund the unused, prepaid part of the current period for that service (a plan paid for once counts as paid for 36 months from its start, as section 10 of the Terms of Service says). If we must change providers urgently to keep alerts going, for example because a carrier blocks our number, we may do so first and tell you promptly afterward.

6. Security measures

We maintain technical and organizational measures appropriate to the risk, including:

Encryption in transit: all traffic to the service is encrypted over HTTPS (TLS).
Encryption at rest: Customer Data is stored on Cloudflare’s managed infrastructure with encryption at rest, and off-site database backups are stored encrypted in Amazon Web Services (Amazon S3); if your agency configures custom email credentials, they are additionally encrypted at rest with AES-GCM.
Password and session protection: passwords are hashed with PBKDF2 (we cannot see or recover them), and session tokens are stored hashed.
Access controls: role-based access (Admin, Editor, and Viewer) limits who within your agency can see and change what, except that staff emergency escalation shows the name and phone number of a person who asks for help as section 13 of the Terms of Service describes.
Tenant isolation: each agency’s data is isolated to its own workspace and queries are scoped per tenant.
Minimized surface: the product runs no third-party tracking or advertising scripts.
Offline copies in the app: the Care Roster app keeps an encrypted copy on a signed-in person’s device of the directory, on-call schedule and escalation information that person can see, their favorites and recently viewed entries, and their own account settings, as our Privacy Policy describes. We never receive these copies. The app erases them on sign-out, when it learns a sign-in was ended, on reinstall, or when a different person or agency signs in. Your agency is responsible for its staff’s devices, for example by requiring a device passcode and having staff sign out of devices they give up.

We restrict access to personal data to the people who build and operate the product and who are bound to confidentiality, and to the subprocessors in Section 4.

7. Personal-data breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay after becoming aware of it. Our notice will describe, to the extent known, the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed to address it. We will reasonably cooperate with you so your agency can meet its own notification obligations. Our notice of a breach is not an admission of fault. Each party bears its own costs of responding to a breach, including notices to people and regulators, except as section 9 of the Terms of Service provides, and our liability for a breach is limited by section 8 of the Terms of Service. We do not notify individuals, regulators, or others for your agency unless the law requires us to.

8. Return and deletion of data on termination

You can export your data as the Terms of Service describe at any time during the term. If you need data the export does not cover, contact us before deletion and we will help where we reasonably can. On termination or expiry of your account, it becomes read-only, and you may continue to export your data until it is deleted (if you need data the export does not cover, contact us before deletion and we will help where we reasonably can), unless section 10 of the Terms of Service allows us to end access sooner. If an account stays read-only for 12 months (counted from the later of the day it became read-only and the day this rule first took effect for your workspace under the Terms of Service), we delete it, after emailing your admins and any billing contact at least 30 days before, unless the law, a legal hold, or a claim or investigation (including one we reasonably expect) requires us to keep it. You may also request deletion of your account and data at any time by emailing [email protected]. When we delete an account, on a verified request or after 12 months read-only, we delete the personal data we hold for your agency within a commercially reasonable period. We keep only:

anything the law, a legal hold, or a claim or investigation (including one we reasonably expect) requires us to keep;
the texting records and acceptance records described below;
our security and operating logs and the internal alerts our systems send us, kept and used only as long as needed to run and secure the service and to handle legal claims;
a temporary encrypted copy we may keep for up to 30 days so a mistaken deletion can be undone;
message content our sending service keeps for up to 30 days after sending;
a record of any unsubscribe from our product emails (the email address and when), kept only so we never send that person one again;
a record of any email address that bounced or reported our email as spam (the address, when, and why), kept until it is removed from the list of addresses our products no longer email;
bug reports your staff file in the app (with any screenshots and details), which we keep, and delete on request, as our Privacy Policy describes; and
copies in our encrypted backups.

We keep backups for up to 12 months, some of them in storage that cannot be changed or deleted, even by us, for 90 days, unless a legal hold requires keeping one longer, so deleted data can remain in them until they are deleted. We use backups only for disaster recovery, to undo a deletion we made by mistake or without the notice the Terms of Service require (never one you asked for), and, where needed, to comply with the law or a legal hold or to bring or defend legal claims. If we restore a backup, we take reasonable steps to re-apply deletions made since it was taken.

Texting records. If your account or data is deleted, we keep the texting records as section 6 of the Terms of Service describes: until four years after the later of the last text to that number for your agency and the consent itself, and longer while a claim or investigation (including one we reasonably expect) or a legal hold requires it, and each opt-out until the person opts back in. For these records we act on our own behalf, as controller, not as your processor.

Acceptance records. If your account or data is deleted, we keep the acceptance and acknowledgment records described in section 6 of the Terms of Service until four years after the account or its data is deleted, and longer while a claim or investigation (including one we reasonably expect) or a legal hold requires it, only for the purposes that section states; we may disclose them for those purposes or when the law requires. For these records, too, we act on our own behalf, as controller.

9. Assistance with data-subject requests

Because your agency controls its records, you can fulfill most data-subject requests (access, correction, export of your directory, user list, and alert history, deletion) directly in the app, and if you need data the export does not cover, we will help where we reasonably can. Removing a person from alert history is done by us at your request. Taking your account-management capabilities into account, we will provide reasonable assistance, at your expense for anything beyond what the service’s features and our ordinary support already provide, to help you respond to requests from contacts or staff to exercise their rights, and to meet your obligations regarding security, breach notification, and data-protection impact assessments. Individuals who contact us directly will be routed to their agency, and we will help where appropriate.

10. Contact

Questions about this DPA, or to make any request described above: [email protected].

See also our Privacy Policy, Terms of Service, and Security overview.