Introduction

MORO is a care coordination app made by Moro Technologies Inc., based in Toronto, Canada. It helps families, caregivers, and care organizations share what they know about the people they support.

We handle sensitive information, often about people who cannot speak for themselves. This policy explains what we collect, why, where it is stored, who can see it, and the choices you have.

Who This Policy Covers

Families and personal caregivers who use the MORO app
Care organizations (day programs, group homes, care centres, and similar) and their staff who use the MORO app and dashboard
The people receiving care, whose information is recorded in MORO by their family or care team

Consent for Children and People Who Cannot Consent

MORO is built for people of all ages, including children and adults who cannot give consent themselves.

Information about a child, or about an adult who cannot consent, is added by a parent, legal guardian, or substitute decision maker, or by a care organization that has the proper authority to record it.
The person adding the information is responsible for having that consent or authority.
A parent, guardian, or substitute decision maker can ask to see, correct, or delete that information at any time by contacting us.

Care Organizations and Their Records

When a care organization uses MORO, the organization decides what is recorded about the people in its care, and we store and process that information on its behalf.

Staff only see the people and records their organization gives them access to.
A family's own profile belongs to the family. It stays with them when they leave a program. The organization's own records stay with the organization.
If an organization finishes a free pilot and decides not to continue, we delete the organization's records at the end of the pilot, unless it asks us in writing to keep them.

Information We Collect

Account information: name, email address, phone number, role, and login details
Organization information: organization name, team size, and staff accounts
Care information: profiles, communication cues, routines, triggers, dictionary entries, observations, tasks, schedules, incident reports, progress notes, daily summaries, and mood or wellness entries
Documents: intake forms, consents, reports, and other files you upload, including PDFs
Messages and media: messages, voice recordings, photos, and other content you create or share in the app
Device information: push notification tokens, so we can send you updates (with your permission)

How We Use Your Information

We use your information only to:

Provide, maintain, and improve MORO
Share care information with the people you, or your organization, have chosen to share it with
Send you important updates, notifications, and support messages
Protect against fraud, unauthorized access, and other security threats
Meet our legal obligations

We never sell your personal information.

We may use aggregated, de-identified data to improve MORO and to support research that improves care and accessibility for non-speaking people. This data never identifies you, your family, or the person you care for.

Where Your Data Is Stored

All MORO app data is stored in Canada.

Our servers and databases run on Amazon Web Services (AWS) in its Canada (Central) region.
Our real time and notification features run on Firebase, also configured to store data in Canada.
These data centres meet international security standards, including ISO 27001 and SOC 2.

Remote support access. Some members of our team work outside Canada. When needed for support or troubleshooting, an authorized team member may securely access our Canadian systems remotely. Your data is not copied to or stored on servers outside Canada. Access is limited to the people who need it for that task, and everyone with access is bound by confidentiality obligations.

How We Protect Your Data

Encryption in transit: all data sent between your device and our servers is encrypted using TLS
Encryption at rest: personal information in our databases is encrypted using AES-256
Secure sign in: accounts are protected by AWS Cognito
Access controls: only authorized personnel can access your data, and only when necessary
Monitoring and reviews: our systems are monitored for suspicious activity and reviewed regularly for security weaknesses

Who We Share Information With

We use a small number of service providers to run MORO:

Amazon Web Services (AWS): cloud hosting and data storage, in Canada
AWS Cognito: secure sign in and identity management, in Canada
Firebase: real time features and push notifications, in Canada

Each provider only gets the information it needs for its job, is bound by a data protection agreement, and may not use your information for its own purposes.

We only share your information otherwise:

With your consent, or your organization's, for example with a new care program you choose to share a profile with
When required by law, such as a court order
To protect safety, when there is a risk of serious harm to someone
If our business changes hands, in which case this policy continues to protect your information

Our Website

This policy also covers moroapp.ca.

When you send us a message or request a pilot through our website, your details go to HubSpot, the system we use to manage enquiries. HubSpot may store this information outside Canada. It does not include any information from the MORO app.
Our website uses Google Analytics to understand how people use the site. We never send names, email addresses, or organization names to Google Analytics.
The app and website use cookies to keep you signed in, remember your preferences, and improve security. You can control cookies in your browser or device settings, although some features may not work without them.

How Long We Keep Your Data

We keep your information only as long as we need it to provide MORO, or as long as the law requires.
You can ask us to delete your account and data at any time.
After an account is deleted, its data is removed from our active systems within 30 days, and from our backups within 90 days.

Deleting Your Account

You can delete your account in the app, or by contacting us at info@moroapp.ca. We will confirm your identity first, to keep your account safe.

When an account is deleted:

The account is removed from our sign in system and our database.
Everything linked to it is deleted, including profiles, messages, care information, routines, tasks, schedules, and documents.
Dictionary entries are passed to another member of the care circle (such as the Care Captain) where that makes sense, and deleted otherwise.

If you are a Care Captain: deleting your account also permanently deletes the accounts and information of the people (Speakseekers) assigned to you. This cannot be undone, so please export or hand over anything important first.

Your Rights

You, or someone legally acting for you, can:

Access: ask for a copy of the personal information we hold about you
Correct: fix information that is wrong or out of date
Delete: ask us to permanently delete your account and data
Take your data with you: receive your data in a common, structured format
Withdraw consent: stop optional uses of your information at any time

To make a request, email info@moroapp.ca. We aim to respond within 48 hours and will complete requests within 30 days.

If you are not satisfied with how we handle your information, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If There Is a Data Breach

If a breach puts your personal information at real risk of significant harm, we will:

Tell you as soon as possible, and within 72 hours of confirming it
Explain what information was affected and what we are doing about it
Tell you what you can do to protect yourself
Report it to the Office of the Privacy Commissioner of Canada and, where required, to other regulators

Changes to This Policy

We may update this policy as MORO grows or as the law changes. When we make a significant change, we will tell you by email or in the app, and update the date at the top of this page.

Contact Us

Questions about privacy, or a request about your data? Contact our Privacy Officer:

Email: info@moroapp.ca
Phone: (416) 886-6306
Address: Moro Technologies Inc., Toronto, Ontario, Canada