In short
- This website has no analytics, no ads and no trackers. It sets no cookies.
- Fostr holds child-welfare case records for agencies. The agency decides what goes in and who can see it. We handle the records only on the agency's instructions.
- Case records stay in the United States, and only people in the United States can get into the systems that hold them.
- We never sell personal information, and we never train AI models on case records.
- If your information is in a case record, the agency is the right place to ask about it.
1.Who we are
Fostr Technologies Inc. is a Delaware corporation. We build Fostr, a system that child-welfare and foster-care agencies use to record visits and keep case records.
Our role depends on the information. For this website and our own business contacts, we decide how information is used. For case records, the agency decides, and we act only on its instructions. Privacy laws call the agency the "controller" and us its "processor" or "service provider".
Some agencies are covered by HIPAA, the federal health privacy law. For them, we are a "business associate", and we sign a business associate agreement with the agency before we handle any of its health information.
Postal address: Fostr Technologies Inc., 131 Cornwell Drive, Bear, DE 19701, United States. Privacy contact: privacy@fostrtech.com.
2.Visitors to this website
What we collect
Very little. fostrtech.com loads everything from its own address: no analytics, no ad trackers, no session recording and no outside scripts or fonts. It has no forms.
Cookies
This website sets no cookies and stores nothing about you in your browser. Our Cookie Policy covers the few cookies the Fostr app needs to keep people signed in.
Hosting
The site is hosted on Amazon Web Services (AWS). Like any web host, AWS sees your internet (IP) address, your browser type and the page you asked for, so it can deliver the page and block abuse. It serves the site from AWS locations in North America and Europe. We do not keep visitor logs for this site.
Booking a call or emailing us
"Book with Jaden" is a link to Cal.com, a separate company. Nothing from Cal.com loads here until you click. If you book, what you enter goes to Cal.com and to us, and the call runs on Google Meet. If you email us, Google Workspace delivers and stores the message. We keep your message so we can reply.
Please do not send case details or a child's information by email or through the booking page.
Why we may use it
To run this website, answer people who contact us and talk with agencies about Fostr. We do not build profiles of visitors or make automated decisions about them.
3.Agency staff who use Fostr
These are the caseworkers, supervisors and administrators who sign in to do their work. We hold the following about them:
- Account details: name, work email, agency, role and an optional profile photo. Passwords and authenticator-app settings are held by Amazon Cognito, the sign-in service that checks them behind Fostr's own sign-in page, not by Fostr.
- Activity records: sign-ins, the IP address and device used, and which records each person viewed, created, changed or shared, and when. Every look at a child's record can be traced to a person. This is required and cannot be turned off.
- A yearly confidentiality promise: a record that the person accepted the confidentiality notice for case records.
- Their work: notes, form answers, uploads and documents, and when each was made. Section 4 covers this as case information.
- Support messages they send us.
Activity records cannot be deleted by the person they describe. A record of who read a child's file only protects anyone if it cannot be erased.
Our own staff use a separate support console. It shows each agency's list of user accounts and a limited view of its activity records, so we can run and support the service. It shows no case records, and everything our staff do in it is recorded.
4.Children, families and others in a case record
These are the people with the least say in how their information got into the system, so we are careful to be clear.
Where it comes from
Case information comes from the agency, acting under its legal authority. We do not collect it for ourselves, we do not decide what the agency records, and we make no decision about a child, a family or a placement. The agency owns the record.
What a record can hold
Whatever the agency's forms and legal duties require. That usually means names, dates of birth, contact details, Social Security numbers where needed, placement and case history, visit notes, uploaded documents and drafts made from them. It can include health, education and other sensitive information. Fostr uses the agency's own forms, so the agency decides what they ask.
People asked to sign a document
An agency can ask a parent, caregiver, guardian or young person to sign a document, in person or by an emailed link. Fostr then records their name, the email address the agency entered, their signature, and each step (such as opening and signing) with the time, IP address and browser. This proves who signed and when, and it becomes part of the agency's record. Questions about a document you were asked to sign should go to the agency.
The law that protects it
Case records are confidential under state law, and in some states sharing them without permission is a crime. In Massachusetts, for example, the state child-welfare department's records are protected by 110 CMR 12.00 and M.G.L. c.66A, and releasing abuse or neglect reports without authority is a crime (M.G.L. c.119 §51E). In New Hampshire, knowingly disclosing case records unlawfully is a misdemeanor (RSA 170-G:8-a).
Fostr is built around these rules. Each agency's records are walled off from every other agency's. Access depends on each person's role. Every user accepts the confidentiality notice. Every change, and every view of sensitive information, goes into an activity log that shows if anything was altered. When information leaves Fostr, through an export, a download, a court packet or a document sent for signature, Fostr records who released it, to whom, why and under what authority. From those records an agency can list every release of one child's information, which a HIPAA-covered agency can use to answer a request for an "accounting of disclosures" (45 CFR 164.528).
What we never do with it
- Sell it, use it for advertising, or give it to anyone the agency has not authorized.
- Train AI models on it. When Fostr drafts text from a record, it uses Amazon Bedrock, an AWS service, in the United States, for that one request. Case information is never sent to a consumer AI product.
- Make automatic decisions about a child or a family. Fostr helps fill in documents from what the agency has recorded. Before a record is filed, the worker confirms it is complete and accurate, and Fostr records their name as the signer.
5.Why we may hold case records
We do not rely on a child's or a family's consent. The agency keeps case records under its own legal authority, and we handle them for the agency under a written agreement. That agreement limits us to the agency's instructions, binds us to confidentiality, and requires us to return or delete the information when the relationship ends. Where HIPAA applies, it includes a business associate agreement.
Real case records come into Fostr only after the agency has signed that agreement, along with any data-sharing agreement its state requires. If this notice and an agency's agreement ever differ, the agreement wins.
6.Companies that help us
These companies handle information for us so that Fostr and this website can run. Agencies are told in advance about any new company that would handle case information, as their agreement sets out.
| Company | What it does | What it can see |
|---|---|---|
| Amazon Web Services (AWS) | Runs Fostr in Northern Virginia: servers, database, file storage, encryption keys, firewall, backups, logs and monitoring. Also sends Fostr's emails, such as signing requests and sign-in invitations. | Case records, account details, activity records and the emails Fostr sends |
| Amazon Cognito (AWS) | Checks each person's password and authenticator-app code behind Fostr's own sign-in page, and connects agencies that sign in with their own identity provider. | Names, work emails, passwords and sign-in settings |
| Amazon Bedrock (AWS) | Runs the AI model that drafts text from a record. The model is Anthropic's Claude, run by AWS in its U.S. data centers. AWS says the model's maker cannot see the data. | The case information sent with each drafting request |
| Amazon Textract (AWS) | Reads the text, including handwriting, on forms an agency uploads. | The uploaded forms and the text read from them |
| Amazon Transcribe (AWS) | Turns a worker's spoken notes into text in the web app when their browser cannot do it on the device. Fostr does not keep the audio. | The spoken notes, the text, and names from the agency's records so it can spell them |
| Apple | Delivers the Fostr iPad app and confirms each copy of the app is genuine. Handwriting and speech on the iPad are turned into text on the iPad itself. | App delivery and basic device information. No case content |
| Google Workspace | Runs our company email. | What you send to an @fostrtech.com address |
| Cal.com | Runs our booking page. | What you enter when you book a call |
Fostr only uses AWS services that AWS lists as eligible for HIPAA work. The software checks its own settings when it starts, and it refuses to run if it is set to send files, email, sign-ins or AI requests to a service that no business associate agreement covers.
7.Where information is kept
Fostr runs on AWS in Northern Virginia. Backups are also copied to AWS in Oregon. AI drafting requests may be handled in any of three U.S. AWS regions: Virginia, Ohio and Oregon. Case records never leave the United States.
Only people in the United States have administrative or support access to Fostr's systems. We do not use support staff abroad. If that ever changes, agencies will be told before it happens.
This website, our company email and our booking page are run by AWS, Google and Cal.com, which may handle your request or message in other countries.
8.How long we keep it
Case records
The agency decides, based on its own records schedule, and the periods are set in its agreement with us. A period can count from when a record was made, when a case closed, or a birthday the agency chooses, such as a child's 18th or 21st. Until the agency sets a period, we keep the record. Child-welfare records often have long legal retention periods, so we never delete them on our own.
Our own records
| Record | How long we keep it |
|---|---|
| Activity and disclosure records | At least 6 years. Deleting a case record does not delete them |
| Staff account details | As long as the activity records that refer to them |
| System logs | 13 months |
| Database backups | Daily for 35 days, weekly for 12 weeks, and a copy in a second U.S. region for 1 year |
| Contracts and data agreements | 7 years after they end |
| Security records, such as access reviews and incident reports | 7 years |
| Emails to our company | 3 years, unless the law requires us to keep them longer |
| Website analytics | None. We do not use analytics |
When an agency leaves
The agency can get a copy of its records during the period its agreement sets. After that, we delete its records, except the activity records and the staff account details they refer to. Deleted information stays in encrypted backups until those backups expire on the schedule above.
To finish the job, we destroy the agency's encryption keys and have AWS delete the key that protects them. Once that key is gone and the older backups have expired, the information those keys protected cannot be read anywhere. The agency gets a certificate of destruction that says exactly what was destroyed and how. Uploaded documents are protected by a separate key, so the certificate lists them on their own.
9.How we protect it
Our Security page has the detail. In short:
- Everything sent over the internet is encrypted, and a firewall sits in front of the service.
- Everything stored, including backups, is encrypted with keys we control in AWS. The most sensitive fields, such as Social Security numbers and dates of birth, are encrypted a second time with a key that belongs to each agency.
- Every user signs in with a password and a code from an authenticator app. Each person's role decides what they can do, and an agency can limit caseworkers to the children they work with.
- Each agency's records are walled off inside the database itself.
- An activity log that shows if any entry was changed, plus a record of every release of a child's information.
- Daily and weekly backups that no one can delete early, with a copy in a second U.S. region.
- On the iPad, recent case information is protected by the iPad's built-in encryption and erased when the worker signs out.
No system is perfectly secure, and we will not claim otherwise.
10.Your rights
If your information is in a case record
Please ask the agency. It holds the record and decides what can be shared, corrected or withheld under child-welfare law. We cannot lawfully give a case record to anyone the agency has not authorized, even the person it is about. If you contact us anyway, we will pass your request to the agency and tell you we have done so.
If you are agency staff
Ask your agency administrator to see or correct your account. Activity records about your use of Fostr cannot be erased, for the reason in section 3.
If you contacted us
Email privacy@fostrtech.com to see, correct or delete what we hold about you. We reply within 30 days. We may ask you to confirm who you are first.
State law
If a breach exposes a Massachusetts resident's name together with a number such as a Social Security number, the resident must be told, including their right to a police report and a free credit freeze (M.G.L. c.93H). Massachusetts also requires records like these to be destroyed securely when they are thrown away (M.G.L. c.93I). Residents of states with consumer privacy laws may have more rights. We do not sell personal information or use it for targeted ads, so there is nothing to opt out of.
11.Children
Fostr is not a consumer service and is not aimed at children. No child can sign up. An agency can choose to give a young person a limited account to see some of their own information, such as the status of an application, and can turn it off at any time. A young person may also be asked to sign a document. In both cases Fostr keeps the same sign-in and activity records it keeps for everyone else.
Any other information about a child is in Fostr only because a child-welfare agency put it there as part of its legal duties. That agency's confidentiality law governs it (see section 4).
12.If something goes wrong
If we discover a security breach involving personal information, we investigate, contain it, and tell the affected agency without delay, and no later than 48 hours after we find it. If a law or the agency's agreement requires faster notice, we follow it. We tell the agency what happened, what information was involved and what we are doing about it.
The agency owns the records, so it sends the notices the law requires, such as those under Massachusetts law (M.G.L. c.93H) or, where HIPAA applies, the HIPAA breach rule (45 CFR 164.410). We give the agency the facts and evidence it needs to do that.
To report a security problem you have found, please use the process on our Security page. We aim to reply within 3 business days.
13.Changes to this notice
When we change what we collect, who handles it or how long we keep it, we update this page and the date at the top. Agencies are told about important changes as their agreement sets out. A change never applies backward to information collected under an earlier version.
14.Contact us
Privacy questions, requests and complaints: privacy@fostrtech.com, or by mail to Fostr Technologies Inc., 131 Cornwell Drive, Bear, DE 19701, United States.
If you are unhappy with how we handled a privacy matter, you can complain to your state's attorney general. For health information protected by HIPAA, you can also complain to the U.S. Department of Health and Human Services, Office for Civil Rights.