Privacy Policy
Last updated October 17, 2026
Who this is for
Rosterly is a scheduling and shift coverage service used by healthcare organizations and the people who work for them. It is operated by Steven Lawrence LLC.
Each organization that uses Rosterly decides who gets an account. If your employer or agency gave you a Rosterly sign-in, they are the one who controls your account and the information in it.
What Rosterly stores
About each person with a sign-in: name, email address, phone number if one is given, position, employment type, weekly hours limit, and the credentials the organization tracks (the credential, its number, its expiry date, and a copy of the document if one is uploaded).
About the work: shifts, who is scheduled for them, callouts, requests to cover or swap a shift, and time off requests.
For home visits: the name, address and phone number of the person being visited, and any visit notes the organization types in. Rosterly is built for scheduling. It is not a medical record, and organizations are asked to keep clinical details out of it.
About training: the courses each person takes, their quiz scores, the date they passed, their certificates, live in-services the organization records for them, and the skills a supervisor has signed off.
About use of the service: when each person signs in, a log of important actions (who changed what and when), failed sign-in attempts with the address they came from, and a record of emails and text messages Rosterly sent.
Passwords
Passwords are never stored as typed. Rosterly keeps only a one-way hash, which cannot be turned back into the password. Nobody at the organization or at Rosterly can read your password.
How the information is used
To show people their schedule, to find workers who can cover a shift, to send the alerts that go with that, and to give the organization reports on its own scheduling.
Rosterly does not sell personal information, and does not use it for advertising.
Who can see what
Each organization's information is kept separate. People in one organization cannot see another organization's information.
Inside an organization: workers see their own schedule, their own credentials, and shifts they are offered. Managers and administrators see the organization's schedule, people and credentials.
Rosterly's own platform staff can reach an organization's information when that is needed to run, support or secure the service.
Patient information
Patient pages (care plans, visits and handouts) are shown only to the organization's managers and administrators, and to the workers who visit that patient. Every time someone opens or changes patient information, Rosterly records who, which patient, what and when, and the organization's administrator can see that record.
After 15 minutes away from patient pages, Rosterly asks for the password again before showing patient information.
The patient side is switched on only when Rosterly runs on hosting covered by a HIPAA Business Associate Agreement. Organizations that use it sign a Business Associate Agreement with Steven Lawrence LLC.
Payments
Organizations pay through Stripe. Card details are entered on Stripe's own secure page and are never received or stored by Rosterly. Rosterly keeps the plan, the number of seats, and a record of each payment's amount and date.
When you contact us
If you send a message from the Rosterly front page, Rosterly keeps your name, organization, email address, phone number, staff size and message, and uses them only to answer you.
Email and text messages
When an organization has alerts by email or text switched on, Rosterly sends shift alerts to the email address or phone number on your profile. You can turn either one off in your profile. Text messages are sent through a messaging provider, which receives the phone number and the words of the message in order to deliver it.
Cookies
Rosterly uses one cookie, which keeps you signed in while you use it. It is removed when you sign out or close the browser. There are no advertising or tracking cookies.
Keeping and removing information
Information is kept for as long as the organization keeps its Rosterly account. Old alerts and old failed sign-in records are cleared out automatically. An organization's administrator can deactivate a person's account, and an organization can ask for its information to be removed when it stops using Rosterly.
To see, correct or remove information about you, ask your organization's administrator first, since they control your account.
Changes
If this policy changes in a way that matters, the new version will be posted here with a new date.
Questions
Ask your organization's administrator, who can reach Rosterly support.