Last Updated: September 14, 2026
Marthen-Huddle is built on a minimum-necessary principle: the platform holds the small amount of resident information that daily operations genuinely require — a name on an appointment, a discharge on the movement board, a grievance being followed to closure — and no clinical information at all. This policy explains what we collect, why, who processes it, how long it is kept, and the rights you can exercise.
Marthen-Huddle ("we," "us," or "our") operates marthen-huddle.com and the Marthen-Huddle application (together, the "Service"). This Privacy Policy explains how we handle information when a senior living or skilled nursing organization ("Customer") and its staff use the Service, and when a visitor uses our public website.
This policy covers our own practices. It does not govern how a Customer uses the Service internally, nor the privacy practices of any third-party product a Customer chooses to connect.
The Service is designed to hold operational data plus a narrow, defined set of resident-identifying fields. Clinical information — diagnoses, medications, treatment, assessments — must never be entered into any field.
Marthen-Huddle is an operational coordination platform for daily huddles, department check-ins, issue and grievance follow-up, census and staffing visibility, front-desk appointment and movement boards, staff recognition, internal messaging, and operational reporting.
The Service is NOT:
If you are a resident, family member, or employee of a facility that uses Marthen-Huddle and you want to access or delete information about you, contact that facility directly. As processor, we support their request rather than acting on it independently.
For account and website information — registration details, billing, support requests, marketing enquiries, and usage analytics — we act as the controller (a "business" under California law) and this policy describes our own practices.
For operational data entered into the Service by a Customer's staff, including any Limited Resident Information, we act as a processor and service provider on that Customer's behalf. The Customer decides what is entered, who may see it, and how long their organization keeps it. We process it only to provide, secure, and support the Service under the Customer's instructions — never for our own marketing, and never sold or shared for cross-context behavioral advertising.
When an organization and its users are set up we collect:
We automatically collect technical and access records, including:
Staff enter operational content such as huddle records, department check-ins with OK/flag/N-A states and follow-up dates, who spoke for each department, issues and their disposition history, notes, recognition, census and staffing figures, PPD, staff absences, expected visitors, and internal messages between colleagues.
Some operational features necessarily identify a resident. The Service is designed to collect only the following: resident first name and last initial (or the Customer's internal non-clinical identifier); appointment date, time, category, provider or clinic, and transport logistics; admission, discharge, or transfer date and operational reason category; and, for grievances, the complainant's name and relationship together with how the concern was addressed and resolved.
Diagnoses, medications, treatment plans, dates of birth, Social Security or insurance numbers, medical record numbers, photographs, biometrics, and behavioral-health, substance-use, HIV, genetic, or reproductive-health information must never be entered. A Business Associate Agreement is available on request for Customers whose compliance program requires one.
If a user connects their own Google Calendar or Microsoft Outlook account, we retrieve the calendar entries needed to display their schedule alongside the huddle. We request the narrowest permissions that make the feature work, hold access tokens securely, and stop retrieving data when the user disconnects.
If you request a demo, download a resource, or contact us, we collect the name, work email, organization, and message you provide, and retain the correspondence to respond and to keep a record of what was agreed.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Customer operational data to train publicly available or third-party foundation models for the benefit of other customers, and we do not use it for our own marketing.
We use information to:
Where the EU or UK GDPR applies, we rely on the following bases:
Where we act as a processor for a Customer, that Customer is responsible for establishing the lawful basis for the operational data it enters.
We share information only as described here, and never for third-party advertising.
We use vetted vendors to run the Service, in these categories: cloud application hosting and database infrastructure; transactional email delivery; payment processing; AI model providers for insight generation; product analytics and error monitoring; and, where a user connects one, calendar providers. Each is bound by contract to protect the data, use it only to perform services for us, and delete or return it when engagement ends. A current list of subprocessors is available on request.
Operational data is visible to that Customer's Authorized Users according to their role and community assignment. Owners, administrators, and regional leaders may have visibility across communities in their organization. Deciding who holds those roles is the Customer's responsibility, not ours.
We may disclose information where required by law, regulation, subpoena, court order, or governmental authority, or where necessary to protect our rights, investigate fraud, or protect the safety of any person. Where we lawfully may, we notify the affected Customer before disclosing their data.
In a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction, subject to this policy. We will notify affected Customers before their data becomes subject to a materially different policy.
We share information for any other purpose only at your direction or with your consent — including when you connect an integration or export a report to a recipient of your choosing.
The Service is operated from the United States, and information is stored and processed there. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses with our subprocessors.
Historical huddle records are intentionally durable: a correction is recorded as a new entry that supersedes the earlier one rather than overwriting it, so the record of what was reported on a given day stays intact for the Customer's own accountability purposes.
We keep information only as long as needed for the purpose it was collected, then delete or anonymize it.
No method of transmission or storage is completely secure, and exports downloaded from the Service leave our controls. We cannot guarantee absolute security, and Customers are responsible for protecting downloaded files and for the credentials of their own staff.
We apply technical and organizational safeguards appropriate to the sensitivity of the data, including:
If we become aware of a security breach affecting personal information we hold, we will notify affected Customers without undue delay, and within the timeframes required by applicable law or by an executed Business Associate Agreement, with the facts known at the time and the steps we are taking.
Depending on where you live, you may have the right to:
California residents may designate an authorized agent to make a request on their behalf; we will verify the agent's authority and your identity before acting. We do not sell personal information or share it for cross-context behavioral advertising, so no "Do Not Sell or Share" mechanism is required. We respond to requests within the period required by law — generally forty-five (45) days, extendable once where permitted.
You may submit a request by email to info@marthenhuddle.com or through the contact form on our website. If your request concerns operational data held on behalf of a facility, we will refer you to that facility as the controller and support their handling of it.
We use cookies and similar technologies that are strictly necessary to keep you signed in, maintain session state, and remember your preferences such as your selected community. We also use limited product analytics and error monitoring to understand which features are used and to diagnose faults.
We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser, though the Service may not function correctly without the necessary ones.
The Service uses AI-assisted processing to summarize huddle activity, highlight patterns across flags and issues, and draft operational insights from a Customer's own data. Outputs are suggestions for review by the Customer's staff.
No automated processing in the Service makes a decision that produces a legal or similarly significant effect on any individual — it does not decide anything about a resident's care, an employee's status, or a regulatory obligation. A person always remains in the loop, and a Customer may contact us to request human review of any output.
The Service is intended for use by healthcare and senior living professionals in the course of their work. We do not knowingly collect personal information from anyone under 18 as a user of the Service. If we learn that we have, we will delete it promptly.
We may update this policy as the Service and the law evolve. We will revise the "Last Updated" date above and, for material changes affecting how we handle personal information, notify active Customers by email or in-app notification before the change takes effect. Continued use afterwards constitutes acceptance.
For privacy questions, a data subject or consumer request, a subprocessor list, a Data Processing Addendum, or a Business Associate Agreement, contact:
Marthen-Huddle
Email: info@marthenhuddle.com
Privacy requests: info@marthenhuddle.com
Website: marthen-huddle.com
This policy describes our practices for transparency and is not legal advice to you.
A twenty-minute working session, not a sales pitch. We will walk through your current huddle and show you exactly what is falling through.