Legal

Privacy Policy

Effective October 12, 2026 · Last updated October 12, 2026

Care Roster is a shared contact directory and staff alerting service for care agencies: hospice, home health, senior care, and assisted living teams. This policy explains, in plain language, what information passes through the service, why, and what happens to it.

The short version

Your agency’s data belongs to your agency. You can export your directory, users, and alert history anytime, ask us for a copy of the rest, and ask us to delete it. A few records are kept after deletion, as described under How long we keep data.
We never sell data, never run ads, and never use customer data to train AI models, other than as our AI provider’s terms may allow for safety-flagged content (see Who else touches the data). We may occasionally email agency admins about our products; every such email has an unsubscribe link.

Who we are

Care Roster is operated by MortonApps LLC (“we,” “us”; after a transfer under section 14 of our Terms of Service, the party that then holds those terms) and lives at careroster.org. If anything in this policy is unclear, or you want to exercise any of the rights described below, email us at [email protected].

What we collect

Contact directory records your agency enters. Agencies use Care Roster to maintain their operational contact directory. Depending on what your agency chooses to enter, a contact record can include: organization name, category, tags, and for each individual contact: name, role, phone number, email address, after-hours or on-call flags, who they report to (for a contact synced from Microsoft 365, including their manager’s Microsoft 365 object ID), and any alert groups the agency puts them in.

Staff accounts. When an agency staff member is invited to the service, we store their name, email address, and a hashed password (we never store the password itself).

The Care Roster app. When a staff member signs in to the Care Roster app on a phone or tablet, we store a record of that device, tied to their account and directory contact: its notification address (issued by Google or Apple), its type and name (such as “Pixel 8”), the app version, its notification settings, and when the app last checked in. Signing out, or removing the device in the app, ends its sign-in and we stop sending notifications to it; changing your password signs out every other device. So the directory works without a connection, the app keeps an encrypted copy on the device of the directory, on-call schedule and escalation information that person can see, their favorites and recently viewed entries, and their own account settings; we never receive it. It is erased when they sign out, when the app next connects after their sign-in is ended (for example, the device is removed, their access is turned off, or their password is changed), when the app is reinstalled, or when a different person or agency signs in. If a sign-in only expires, the copy stays on the device, and can be opened from the sign-in screen, until one of those things happens, so sign out on any device you give up or share.

Usage and log data. Like virtually every web service, we keep basic technical logs (such as IP address, browser type, and request timestamps) for security and troubleshooting, and each contact record keeps an audit trail of who created or changed it. When someone creates a workspace, or an admin accepts updated terms, starts a checkout, starts or changes a subscription, or gives the staff emergency escalation acknowledgment in Settings, we record who did it, when, how, and the IP address and browser they used, to show the agreement or confirmation was made.

How you found us. Our public website keeps a small note in your browser about how you first arrived in the last 30 days: the first page you visited, the website that sent you (if any), and any campaign tags in the link you followed. When you start a free trial, that note is sent to us with your signup, along with the page you signed up on. We keep it with your new account and include it in the internal email that tells us about each new signup. We use it to learn which pages, websites, and campaigns bring us customers, to follow up about your trial, to credit anyone who referred you, and to spot fake or abusive signups. We never sell it or share it with advertisers. It is not shown in the app; to see it or have it removed, email [email protected]. Accounts created before October 4, 2026 have no such record.

Messages you send us. When you use the contact form on our website, we receive what you enter (your name, organization, email address, and message), the page you sent it from, a similar note of how you arrived, your approximate location (country and state), your browser type, and a scrambled form of your IP address that helps us block spam. We use these to reply to you, follow up, and learn which pages bring us inquiries. The form also runs Cloudflare Turnstile, a bot check that receives your IP address and technical details about your browser under Cloudflare’s own privacy terms.

Bug reports. Bug reports and feature requests you file in the app, and any screenshot attached, go to our internal feedback service and are kept as business records, even after an account is deleted; ask us and we will delete them, as How long we keep data describes.

Our role: your agency controls its data

For the contact directory information described above, your agency is the data controller and we are the data processor. The agency decides what contact information to enter and why; we process it only on its instructions, solely to provide, support, and improve the service. The lawful basis for our processing is the agency’s instructions under our agreement with them; agencies are responsible for having an appropriate basis for the records they keep. Our processor commitments are set out in our Data Processing Addendum.

The note of how a new account found us, messages people send us through our website, the texting and acceptance records we keep after deletion (see How long we keep data), the list of addresses our products no longer email, the aggregated and de-identified data described under How we use data, and our emails to admins about our products are different: we hold them for our own business, as controller, not on your agency’s behalf, and they are not part of the Data Processing Addendum.

How we use data

Apart from the note of how a new account found us, the occasional email to admins about our products, the texting records, and aggregated and de-identified data (each described elsewhere in this policy), we use your account data only to provide, support, and improve the service for your agency: storing your directory, sending your agency’s alerts, keeping your account secure, sending account notifications and billing and trial messages, and finding and fixing problems. Specifically:

We never sell personal information, to anyone, for any reason.
We never show ads and never share data with advertisers.
We never use customer data to train AI models, other than as our AI provider’s terms may allow for safety-flagged content (see Who else touches the data).
We do not mine or profile the records your agency enters. We use information about how the service is used to run, secure, support, and improve Care Roster and to set and enforce fair use. We also create data that we aggregate or de-identify so that it identifies no agency or person, and we may use that data for any purpose, including improving our other products and publishing statistics, as section 14 of our Terms of Service describes.

We may also use data where needed to comply with the law, enforce our terms, or bring or defend legal claims. If MortonApps, Care Roster, or part of either is reorganized, merged, sold, or transferred, data may move to the successor, which will be bound by this policy for that data. That is not a sale of personal information.

Emails about our products. We may occasionally email an agency’s admins about Care Roster plans and MortonApps’ other products, as section 14 of our Terms of Service describes, including who is eligible, how to unsubscribe, and which emails are not promotional. We use only the name and email address on each admin’s own Care Roster account, their agency’s name, and which of our products and plans the agency uses; nothing from the directory, the alert lists, or any other user’s account. We never give these addresses to advertising platforms. Our basis is our legitimate interest in telling the people who use our products about them. Every such email has an unsubscribe link and our postal address, and we keep a record of each unsubscribe, even after an account is deleted, so that it stays in effect.

Who else touches the data (subprocessors)

We use a small number of providers to run and support the service:

Cloudflare: hosting and data storage (United States). The live service and its data run on Cloudflare. Apart from what the providers below handle, the encrypted backups, and anything you choose to email us, we do not keep copies of your agency’s records elsewhere, except short-lived working copies we make to operate, support, or fix the service, which we delete when we are done.
Amazon Web Services (AWS): email delivery via Amazon SES (for messages the service sends, such as invitations, notifications, your agency’s email alerts, and our occasional product emails), text-message delivery via AWS End User Messaging for staff text alerts, and encrypted, off-site database backups via Amazon S3 for disaster recovery (United States).
Telnyx LLC (not yet in use): backup text-message delivery, used only when our primary provider, AWS, cannot send (primarily the United States). When it is used, Telnyx receives each recipient’s mobile number, the full text of each message (which begins with “Care Roster” and, where it can, the sending agency’s name, and includes the agency’s own message or our standard wording, such as welcome texts and, in staff emergency escalation notices, the names and phone numbers of staff who asked for help), delivery results, and any replies to our backup number, including STOP and HELP. Telnyx’s data processing addendum applies to this service. Under it, Telnyx also uses phone numbers and message records for its own billing, fraud and spam prevention, service improvement, and to meet its legal and telecommunications obligations, and may use message text in de-identified form to improve its services, but not for marketing.
Microsoft: our business email (Microsoft 365), which holds the emails you send us, our internal alert about each new signup (which names your agency and the person who signed up), our internal service alerts (which can name your agency and the staff member involved), and messages from our website’s contact form (United States). If your agency connects its own Microsoft 365, we also use Microsoft’s sign-in and Microsoft Graph services to sign your staff in with their Microsoft accounts and to read the directory contacts your agency chooses to sync, including who each person’s manager is; those services act under your agency’s own agreement with Microsoft.
Google LLC: Firebase Cloud Messaging, under Google’s own Firebase terms, delivers Care Roster app notifications to Android phones and tablets (United States and other countries). Google receives each device’s notification address, the device’s IP address, an installation ID and basic details about the device and the app (the app contacts Google for these when it first starts, before anyone signs in), basic delivery information, and each notification, which names your agency and may identify the alert but does not include the alert’s text or anyone’s name. Google’s Firebase Data Processing and Security Terms apply to this service.
Apple Inc.: once the Care Roster app is available for iPhone and iPad, the Apple Push Notification service, under Apple’s own developer terms, will deliver its notifications to those devices (United States and other countries). Apple will receive each device’s notification address and each notification, which names your agency and may identify the alert but does not include the alert’s text or anyone’s name. We have no separate data processing agreement with Apple for this service.
Anthropic, PBC: AI tools we use to operate, support, and maintain the service, including reviewing problem reports and support emails and helping us fix problems (United States and other countries). While helping us, they may process data in the service, such as names, contact details, alert records and responses, and account and usage information. We use them on Anthropic’s consumer Claude Max plan, under Anthropic’s consumer terms, not a business agreement, and we have no data processing agreement with Anthropic. The setting that lets Anthropic train its models on our sessions (“Help improve Claude”) is turned off. Its consumer terms still let it use what we send for its own purposes, including improving its services, safety review, and legal compliance, and let it use content its systems flag for safety review, including for model training even when the training setting is off. For flagged content, Anthropic’s published policy is to keep inputs and outputs for up to 2 years and safety classification scores for up to 7 years. It keeps feedback we submit, together with the data attached to it, for up to 5 years. Otherwise, with training off, it states that deleted conversations are removed from its systems within 30 days. These periods are Anthropic’s and may change. We never send Anthropic feedback (such as a rating or a feedback report) on work that includes an agency’s data.

Cal.com: if someone at your agency opens the setup-call booking form inside Care Roster (“Book a 30-minute walkthrough”), that form is Cal.com’s. Cal.com receives what the person enters (such as name and email address), their browser’s IP address and details, and an identifier for their agency, under its own privacy terms, and tells us about the booking. It receives none of your agency’s directory or alert data, so it is not a subprocessor.

We will update this policy if the list changes.

Payments

Paid plans are sold and processed by Lemon Squeezy, our merchant of record. They are listed separately from the providers above because they never receive your directory: no contacts, no organizations, no key numbers. What they do receive is the billing contact’s name and email address and the subscription itself, and they hold the card details, which we never see or store. As merchant of record, Lemon Squeezy handles that payment information under its own privacy terms and for its own tax and fraud-prevention obligations, rather than on our instructions.

How we protect it

Passwords are hashed with PBKDF2; we cannot see or recover them.
Session tokens are stored hashed.
If your agency configures custom SMTP credentials, they are encrypted at rest.
Role-based access controls (Admin, Editor, and Viewer) limit who in your agency can see and change what, except that staff emergency escalation shows the name and phone number of a person who asks for help to others at the agency, as described under Alerts below.
Each agency’s data is isolated to its own workspace (tenant isolation).
All traffic to the service is encrypted in transit over HTTPS.

No internet service can promise perfect security, and we will notify affected agencies promptly if we ever discover a breach involving their data. Our Security page covers these safeguards in more detail.

How long we keep data

Active subscriptions and trials: data is retained for as long as your account is active.
Alerts: we keep each alert, with each person’s response (the choice, when it arrived, and any “addressed” mark), its reminders and staff emergency escalation notices, and their delivery results, with the account until the account’s data is deleted, apart from the texting records described below. Alert history keeps each person’s name, the number or address used, and their response as they were when the alert went out, even after the person is removed from the directory. To remove a person from alert history, the agency can email [email protected].
Alert templates and groups: Care Roster no longer offers alert templates; templates your agency saved before then are kept with the account, unused, until the account’s data is deleted. The name and description of a custom group your agency deletes are removed from use but kept the same way, so past alerts can still name them. A deleted group’s member list is deleted at once.
Lapsed accounts: if a trial or subscription lapses, the account becomes read-only. The data stays intact, most of it stays viewable (alert history is only in the export), and admins can export it as described under Your rights. After 12 months read-only, counted as section 3 of our Terms of Service describes, and after at least 30 days’ email notice to the agency’s admins and any billing contact, we delete the account and its data, except the texting and acceptance records described below and the records and copies described under Deletion on request and Backups. We keep an account longer only while the law, a legal hold, or a claim or investigation (including one we reasonably expect) requires it.
Deletion on request: an agency can request deletion of its data anytime by emailing [email protected]. We delete all of it from the live service except:
- the texting and acceptance records described below;
- bug reports and messages you send us (see How you found us, and messages you send us, below);
- anything the law, a legal hold, or a claim or investigation (including one we reasonably expect) requires us to keep;
- our security and operating logs and the internal alerts our systems send us, kept and used only as long as needed to run and secure the service and to handle legal claims;
- a temporary encrypted copy we may keep for up to 30 days so a mistaken deletion can be undone;
- message content our sending service keeps for up to 30 days after sending;
- a record of any unsubscribe from our product emails (the email address and when), kept only so we never send that person one again; and
- a record of any email address that bounced or reported our email as spam (the address, when, and why), kept until it is removed from the list of addresses our products no longer email.
Copies in backups are handled as described under Backups.
Acceptance records: if an account or its data is deleted, we keep the record of each acceptance of our terms and each staff emergency escalation acknowledgment (see Usage and log data) until four years after the account or its data is deleted, and longer while a claim or investigation (including one we reasonably expect) or a legal hold requires it. We keep them only for the purposes section 6 of our Terms of Service states, and we may disclose them for those purposes or when the law requires.
Texting records: if an account or its data is deleted, we keep records of text-message consent and sends (who was texted, by which agency, when, and the result, but not what the messages said), and of each opt-out, as section 6 of our Terms of Service describes: for four years after the later of the last text to that number for the agency and the consent itself (longer while a claim or investigation, including one we reasonably expect, or a legal hold requires it), and, for an opt-out, until the person opts back in. We use them only for the purposes stated there, and we may disclose them for those purposes or when the law requires.
Backups: for disaster recovery we keep encrypted, access-controlled backups of the database in Amazon Web Services (Amazon S3) and Cloudflare: daily backups for 90 days, plus monthly archival copies for up to 12 months, some of them in storage that cannot be changed or deleted, even by us, for 90 days, unless a legal hold requires keeping one longer. Deleted data can remain in these backups until they are deleted. We use backups only to recover from a failure, to undo a deletion we made by mistake or without the notice our terms require, and, where needed, to comply with the law or a legal hold or to bring or defend legal claims. If we restore a backup, we take reasonable steps to re-apply deletions made since it was taken.
App devices: a device’s record, including its notification address, stays with the account after it is signed out, until the staff member’s account or the account’s data is deleted.
Abandoned signups: trial workspaces that are created but never activated are purged after about 7 days.
How you found us, and messages you send us: the signup note is kept with your account and deleted with it. Our internal new-signup emails, contact-form messages, and bug reports are kept as business records. If you ask, we will delete or anonymize them, unless we need to keep them for a legal, tax, or security reason; copies in backups expire on their normal schedule.

Your rights and choices

Agencies can export their directory, user list, and alert history in the app (and their on-call schedule while the account is not read-only), ask us for a copy of anything else, correct any record, and request deletion of their account and data by emailing us (see Delete your account).

Individual contacts and staff who want to access, correct, export, or delete information about themselves should contact their agency first; the agency controls its records and can handle most requests directly in the app (removing a person from alert history is done by us at the agency’s request). You can also email [email protected] and we will help route the request to the right place. We respond to requests under this policy and never penalize anyone for making one.

Cookies

Inside the signed-in application we set one essential session cookie so you stay signed in: no tracking cookies, no advertising cookies, and no analytics of any kind. The Care Roster app has no tracking, advertising, or analytics of its own either. The setup-call booking form, if you open it, is Cal.com’s and follows Cal.com’s own cookie and privacy terms. On our public marketing pages we use Cloudflare Web Analytics, which Cloudflare says counts visits without cookies and without identifying or following individual visitors. Our own small script on those pages keeps the note of how you found us in your browser (in local storage, not a cookie) and ignores it after 30 days. The note leaves your browser only if you start a trial, send us anything through a form on our site, or tap a phone number or email link on our site; for a tap, we record the page, the note, and your approximate location (country and state), without your name or contact details. Our site does not respond to browser Do Not Track signals or similar browser signals. We do not track you across other websites, and we do not use advertising networks. Cloudflare, and Cal.com if you open the booking form, provide services to many websites, so they may receive your IP address and browser details on other sites too, and they handle that information under their own privacy terms.

Children

Care Roster is a business tool for care agencies and is not directed at children. We do not knowingly collect information from children, and agency staff accounts are intended for adults.

Changes to this policy

If we change this policy, we will update the date at the top of this page, and for any meaningful change we will let your agency’s admins know in Care Roster, and we may also email them. We won’t reduce your rights under this policy without telling you first.

Alerts: text messaging and email

Care Roster’s Alerts feature lets an agency send urgent and routine operational, non-marketing messages (such as an emergency closure or a severe-weather delay) to its own staff, by text, email, and Care Roster app notifications today, and by other means as we add them, such as voice calls. Alerts are not an emergency service: messages sent any way can be delayed or fail, no channel is guaranteed, and no one at MortonApps reads replies (see section 13 of our Terms of Service). When an agency uses Alerts:

What we process:
- the work and personal mobile numbers held in the agency’s directory; each number’s texting status, including when and how a person opted in or out; the agency’s confirmation about its work mobile numbers; and whether a number has already received its one-time welcome text;
- each alert’s message, who sent it, and who it went to (names and departments as they were when it was sent), and, for an alert scheduled for later, the time it is due and who scheduled it;
- delivery results, and for an alert sent by email, each email address it went to and the email’s delivery result, and for an app notification, each device it went to and the result;
- for a message that asks recipients to respond, whether and when each person responded, by text or with an email’s answer button, whether a reply was an opt-out or opt-in or asked for help, and, if the alert offered numbered choices (for example, 1 for “I’m OK” or 2 for “I need help”), which choice they picked or that a reply picked none; and
- when someone at the agency marks a person who asked for help as addressed, or undoes that, who did and when.
We never store any other words in a reply: a text reply is read once to find an opt-out or opt-in word, a request for help, or a choice number, and is then discarded. We use these so the agency can send its messages and see who responded, so we can honor opt-outs, and to keep the texting records described under How long we keep data.
Email alerts. An agency can send an alert by email to the email addresses of its staff in its directory. The email comes from the agency through Care Roster, and replying to it reaches the agency, not us; we do not keep replies. If the alert asks for a response, the email carries answer buttons that work without signing in and only for that person and that alert, until the alert stops taking responses, the feature is paused, or the account becomes read-only; anyone who has the email can use them, so a forwarded email answers as that person. Pressing one records which answer was chosen and when, and the person can change it until then. Opening the email or the link records nothing. We do not record your IP address, a cookie, or anything about your device with an answer; to stop abuse, the answer page keeps a scrambled form of the IP address for up to a day, separate from any answer. We keep each email’s delivery result (for example, delivered or bounced) with the alert, and an address that bounces or reports our email as spam is added to the list of addresses MortonApps’ products no longer email, which also stops alert emails to it. Email addresses are used only to deliver the agency’s alerts and to keep that list.
Delivery, follow-ups, and staff emergency escalation. Unless the sender chooses to send everything at once, an alert sent from the website or the Care Roster app goes out in stages: a Care Roster app notification to people who have the app and a text to people who do not, then, about 90 seconds later, a text to app users who have not opened or answered it, then, about 3 minutes after it was sent, an email to people who have not answered by any method. To do this, the app tells Care Roster when a person opens an alert, and we keep that time with the alert. The sender can also send a follow-up text to the people who have not responded. If staff emergency escalation is on for the agency, when someone chooses an urgent option (such as “I need help”) or asks for help on any alert, Care Roster sends a notice to everyone on the agency’s escalation list together, by text, email, and Care Roster app notification: whoever is on call for an on-call rotation on the list, the person’s supervisor if the list includes the supervisor, and the staff the list names. It adds the agency’s admins when an entry reaches no one Care Roster can find, or no one it can send to on any channel. Admin accounts that we have marked as held by MortonApps or its members are not added as the agency’s admins, are not emailed about staff emergency escalation, cannot give its acknowledgment or mark anyone as addressed, and do not see the Needs help list. To find a person’s supervisor, Care Roster uses who the directory says they report to and, for a contact synced from Microsoft 365, their manager’s Microsoft 365 object ID. Each notice names the person who asked for help (or, when several people asked on the same alert at about the same time, up to five of them and how many more), says which alert and when, and gives the phone number Care Roster has for each person it names (a mobile number first, which can be a personal number), even to people who could not otherwise see that number in Care Roster; an app notification says only the agency’s name and that someone needs help. The Emergency page’s Needs help list shows people who asked for help in the last 8 days (up to a limit), with the same phone number, to the agency’s admins, the staff the list names, the current members of, and anyone covering, an on-call rotation on the list, and a supervisor (for the people who report to them only). We keep, with the alert, when each follow-up and notice went out, who it went to, who it was about, and who marked a person as addressed and when; each mark and each undo is also kept in the agency’s activity log. Care Roster never texts, calls, or otherwise contacts a name or number typed by hand, or a contact outside the agency. If we add other ways of sending, such as voice calls, we will update this policy with any new information they need before they launch. The escalation paths on the Escalation tab are a reference list for the agency’s staff. Staff emergency escalation never uses them, and an alert to a path cannot be scheduled, so it goes out only when someone at the agency sends it. A person on a path can still get automated messages through a group, rotation, or escalation list they are also on.
App notifications. If an agency’s plan includes Alerts, a sender can also choose “App”, which notifies staff who are signed in to the Care Roster app. The notification shows only your agency’s name and that there is a new alert (or, for a staff emergency escalation notice, that someone needs help); the alert itself is read in the app. An answer given in the app is recorded the same way as an answer by text. App notifications need no texting consent, and a person can stop them at any time by turning off notifications for Care Roster on their device or signing out of the app. They are not metered against texting.
Whose consent covers which number. Work numbers are texted on the agency’s confirmation, and a personal number only after the person opts in themselves, in Care Roster or on our text opt-in page, as section 13 of our Terms of Service describes. An agency cannot opt a personal number in.
We never sell them or share them for marketing. We do not sell or rent mobile phone numbers or SMS opt-in or consent information, share them with anyone for marketing, or use them for our own marketing. We use them only to deliver the agency’s own messages on its behalf, to honor opt-outs, to keep the records that show consent and opt-outs, and to operate, support, and maintain the service. Our primary messaging provider (AWS) transmits each message for the agency, through us, on our instructions and under contract, and may not use the number for anything of its own; the same applies to our encrypted backups. If our backup carrier, Telnyx, carries a message, it may also use the number as described under Who else touches the data. Our other providers listed under subprocessors may see them only while helping us operate, support, or maintain the service, except that our AI provider may also keep and use what we send it under its own terms, as described under Who else touches the data. We may also show consent and opt-out records, and records of what was sent and when, to carriers, our messaging providers, or regulators when needed for compliance or to answer a complaint, including while an agency is active, and to a court or in a legal claim, or when the law requires.
Opting out. Reply STOP to any text to opt out at any time. The other opt-out words listed in section 13 of our Terms of Service count the same way. We keep a record of the opt-out so that number is not texted again by any agency on Care Roster until the person texts START or YES (or another opt-in word a carrier or our messaging providers recognize) to receive texts again. We text from our main toll-free number and, once our backup number is in use, from the backup number if the main one cannot send. A STOP sent to any of our numbers, including our other services’ numbers, stops texts from all of them, and the person texts START or YES to each number they opted out at. Reply HELP for our support contact. Standard message and data rates may apply.

Contact

Questions, requests, or concerns: [email protected]. We answer during business hours. This inbox is not for emergencies: if anyone is in danger, call 911. Please don’t email us confidential or sensitive information, such as staff or patient records, ID or license numbers, or health results. If you send it anyway, we’ll keep it confidential and delete it when we no longer need it.