Privacy Policy

This policy explains what personal information Moraph collects through its websites (www.moraph.com and the other moraph.com sites, including careers, documentation, the Academy, the Trust Center and service status) and through the client, partner, supplier and candidate portals; why we use it; who processes it for us; and how long we keep it. Information that clients put into Moraph software and managed platforms is handled under each client’s Master Services Agreement and Data Processing Addendum, which take precedence over this policy for that information.

1. What we collect

• Account and sign-in information: your name, email address, phone number, organization and role when you create an account or are invited to one. Passwords are never stored in readable form: we keep only a salted PBKDF2-SHA256 hash of each password. Two-step verification secrets are stored encrypted. For security we keep sign-in records: when sessions start and end, your browser type, and a salted hash of your IP address that changes every day.

• What you send us: enquiries and requests made through our forms, support tickets, messages, documents you upload, job applications, and feedback.

• Technical information: our sites are hosted by Cloudflare, which processes your IP address and request details to deliver pages and protect them from attacks. With your consent, our own analytics records the pages you view, the referring site, campaign tags, your approximate country and your device type (it does not store IP addresses). Every page of every moraph.com site also loads Google Analytics, which measures the pages you view, clicks on our main links and buttons, scrolling, downloads, which of our forms are sent (by the form’s name only) and your device and approximate location. We send page addresses without anything after the “?” and with anything that looks like an ID, a private-link token or an email address removed; signed-in pages report only the site and section; and we never send your name, email address or anything you type into a form. If you visit from the European Economic Area, the United Kingdom or Switzerland, we show a banner and Google Analytics sets no cookies until you choose “Accept” (without it, it receives only cookieless page-view signals with no identifier); elsewhere it runs with its cookies from your first page, and you can turn it off with “Cookie settings” in the footer. We also measure how fast pages load and respond (Core Web Vitals). When you send one of our main forms (an enquiry, a sign-up, a job application or a support ticket) and we accept it, our server tells Google Analytics so (the form’s name and the site only, linked to the same Google Analytics cookie), and only if you have allowed analytics cookies or visit from where no banner is needed. If your browser sends Do Not Track or Global Privacy Control, we load no Google script and our server sends Google nothing. Details are in our Cookie Policy. We do not use device fingerprinting.

• Error reports: if a page breaks in your browser, it tells our server what broke (the error message with numbers, links and email addresses removed, the script and line, the page address without IDs, and your browser’s name). No cookies or identifiers are involved, so this runs for every visitor.

• Business records: contracts, invoices and, for suppliers, payment details (bank details are stored encrypted). We do not take card payments on our websites.

2. Why we use it

• To provide our services: to set up and run accounts, portals and the Moraph software and platforms our clients use.

• To support you: our support teams in the Philippines, India and the United States use it to answer questions, handle incidents and help clients use our services.

• To keep our services secure: to detect and stop misuse, fraud and attacks, using sign-in records and aggregated statistics.

• To tell you about our services: service notices such as scheduled maintenance, security updates and changes to your account, and, where you have agreed, updates relevant to your sector.

• To meet our legal obligations: under the laws that apply to us in each country where we operate, including data protection laws such as the GDPR and the CCPA, and the record-keeping rules that apply to our clients’ regulated activities (for example FINRA rules and HIPAA).

3. How we contact you

We may contact you by email, telephone, text message or post about your account, a support request, billing, or our agreements with you, and occasionally to ask for feedback. Marketing messages are sent only where the law allows and you can opt out at any time.

4. Data Retention & Control

We keep personal information only for as long as we need it for the purpose we collected it for, and longer only where the law requires. The periods below cover information collected through this website and our recruiting system; most are enforced by automatic deletion.

If you would like us to delete your information sooner, or to stop processing it, email our Data Protection Office at privacy@moraph.com. If we must keep certain records for legal or audit reasons, we will tell you which ones and why.

Moraph mobile apps

This section covers Moraph Command, Boardroom, Clinician, Clinical Trials, Field and Onboard: on iPhone, iPad, Mac and Apple Watch, on Apple TV (Boardroom), and on Android phones and Wear OS watches. Moraph CognitionOS and Moraph TraderOS work differently and are covered separately below.

• Accounts: you sign in with a Moraph account that your organization creates for you; there is no sign-up in the apps. On iPhone, iPad and Mac you sign in on Moraph’s own sign-in page in Apple’s secure sign-in sheet, so the app never sees your password. The apps receive your name, email address and Moraph user ID so they can show who is signed in. Some parts need no account: sample data, the applicant and new-hire side of Moraph Onboard, and Moraph Clinical Trials on Apple devices (see below).

• Your work: the apps show and send the records you work with for your organization, such as tickets, messages, documents, tasks, reports, approvals and votes, and the private notes you save in Boardroom, which only you can see. In Moraph Clinician, in Moraph Field for some organizations, and on the study-team side of Moraph Clinical Trials, this can include health information about patients, clients or study participants. This is your organization’s information and is handled under its Master Services Agreement and Data Processing Addendum.

• Sent to us only: the apps send information only to Moraph’s own servers, over encrypted connections. The one exception is Find a study in Moraph Clinical Trials, which asks ClinicalTrials.gov directly (see below). The apps contain no advertising, no advertising ID, and no third-party analytics, crash-reporting or tracking code. They don’t track you across other companies’ apps or websites (on Apple devices they never ask for permission to track you), and we do not sell or share information from them. If you have chosen in your Apple device’s settings to share analytics with app developers, Apple may give us crash reports that don’t identify you.

• Read on your Apple device, not sent: dictation in Boardroom, Clinician, Clinical Trials and Field uses Apple’s speech recognition set to work only on your device, so your voice is never recorded or sent anywhere. When you scan a letter, handout or document with the camera, or pick a photo or screenshot (in Boardroom, Command, Clinical Trials, Field and Onboard), the text is read on your device with Apple’s text recognition, and the picture isn’t kept or sent. You choose what to keep: text you add to a note, comment or support ticket is sent with it, and dates and reminders found in a letter stay on your device.

• Kept on your Apple devices: sign-in tokens are kept in the Keychain, and what the apps save (the last information they loaded, so they open offline, and changes waiting to be sent) is encrypted by the device’s Data Protection. Widgets, Live Activities, Spotlight and Siri use what the app has already saved on the device and send nothing to us. An Apple Watch gets a short summary from the paired iPhone, not from the internet. Signing out ends the session on our server and deletes the sign-in token, the saved information, unsent changes and the widget and Watch data from the device. Deleting an app removes its data from the device.

• Kept on your Android devices: what the apps keep on your phone or watch, including sign-in tokens and changes waiting to be sent while you are offline, is encrypted with a key held in the device’s secure hardware (the Android Keystore). Signing out deletes that key, which makes the saved data unreadable. Uninstalling an app removes its data from the device. A watch receives information from the paired phone through the Wear OS connection, not from the internet.

• Permissions: each is asked for only when you first use the feature that needs it, and you can turn it off in your device settings. Notifications alert you to new work and reminders; on Apple devices they are created on the device from what the app has loaded, so the apps don’t send us a push token. Face ID, Touch ID or biometric unlock: your face or fingerprint never leaves the device, and the app learns only whether the check passed. On Apple devices, the camera, microphone and speech recognition are used only as described above, and calendar access is write-only, to add the meetings, visits, shifts or appointments you choose; the apps never read your calendar. Moraph Clinical Trials asks for your location on Apple devices only if you tap “Use my location” (see below), and on Android uses exact alarms for visit and dose reminders.

• Moraph Boardroom on Apple TV: you sign the TV in from your phone: the TV shows a code, and you approve it at mcp.moraph.com/tv with your Moraph account, under your organization’s sign-in rules. The TV gets read-only access: it can’t vote, acknowledge or edit, and it never shows private notes, conflict declarations, reading progress or ballot responses. Its sign-in tokens are kept in the Apple TV’s Keychain, and Settings > Sign out of this TV ends the connection on our server.

• Moraph Clinical Trials on iPhone, iPad, Mac and Apple Watch: for people looking for a study or taking part in one. It has no account, and the app sends nothing to Moraph. Find a study searches ClinicalTrials.gov, the public registry run by the U.S. National Library of Medicine, directly from your device: it sends the condition you type and, if you choose, where to search (a place you type, which Apple’s maps service turns into map coordinates, or your approximate location, read once when you tap “Use my location”) only to answer that search. Moraph never receives your searches or your location. Your recent searches, saved studies, visits, reminders, notes and questions stay on your device; you can clear your search history in the app, and deleting the app removes everything.

• Moraph web pages in the apps: Onboard (for applicants and new hires) and Clinical Trials (for study participants) can open a personal link that your organization or study team gives you. That page is part of our websites: what you enter there goes to the organization that sent the link and is handled under its agreement with us, and the page uses Google Analytics as described in section 1.

• Sample data: “Try it with sample data” shows made-up information that stays on your device and is never sent to us. It works on every platform, including Apple TV, and on Apple Watch when you start it on the paired iPhone.

• Deleting your data: you can delete your Moraph account in the Moraph Portal under Your account (see Delete your Moraph account), or email privacy@moraph.com. Records you created for your organization stay with your organization. Moraph Clinical Trials on Apple devices keeps your information only on your device, so deleting the app deletes it.

Moraph CognitionOS and Moraph TraderOS

These apps are for iPhone, iPad and Apple Watch; CognitionOS also runs on Mac. They don’t use a Moraph account. Each one sends your information only to the services described below, over encrypted connections, and how it is kept there depends on who runs that service. Neither app contains advertising, an advertising ID, or third-party analytics, crash-reporting or tracking code, and neither tracks you across other companies’ apps or websites.

• Moraph CognitionOS: a private command centre for Moraph clients that syncs with the CognitionOS server Moraph sets up for you. The app sends that server the changes you make, such as edits, decisions and items you mark done or delete, and your device’s name when you sign in, so you can recognise it in your list of devices. Questions you type into Ask are answered on your device by Apple Intelligence where it can; otherwise they go to the server, which sends them, with a summary of your day, to Anthropic’s Claude for an answer. Notifications for urgent decisions and a morning brief come through Apple’s push notification service: the server keeps your device’s push token so it can send them. You can turn notifications off in your device settings.

• Moraph TraderOS: a read-only companion that shows who is trading the investments you own, using public regulatory filings (such as 13F holdings, insider and congressional trading disclosures and short interest) that are included in the app. It cannot place orders or move money. You can use it in three ways:

  • Research and demo only: nothing about you is needed or sent. The built-in research and the made-up demo portfolio stay on your device.

  • Connect your brokerage (Interactive Brokers): you create a read-only Flex Web Service token and report in your Interactive Brokers account and enter them in the app. The app sends the token directly to Interactive Brokers to fetch your positions, cash, trades and daily account values, and keeps the token in your device’s Keychain (behind Face ID or Touch ID if you turn on App Lock). The report is processed on your device and kept there, encrypted, so the app can open offline; it is not sent to Moraph. Disconnecting deletes the token and the saved report from the device. You can also cancel access at any time by generating a new token in Interactive Brokers.

  • Connect a TraderOS server: if you run your own trading server, you enter its address and an API key, which is kept in the Keychain; your Apple Watch receives it from the paired iPhone. The app sends that server its requests, questions you type into Ask (which the server may answer with an AI model, depending on how it is set up) and what you choose to save there, such as valuation models, manual assets and share links. If you turn on alerts and the server is set up for push notifications, the app gives it your device’s push token; turning alerts off or signing out asks the server to delete it. The app keeps the last data it loaded encrypted on your device for up to seven days so it can open offline.

  Sign in with Apple (optional): signing in gives you a profile and keeps a few display settings in step across your devices. Apple shares your name and the email address you choose with the app; they are kept in your iCloud Keychain, and the settings in your own iCloud storage. None of it is sent to Moraph. You can sign out or delete the profile in Settings > Account. Optional App Lock uses Face ID, Touch ID or your passcode; your face or fingerprint never leaves the device, and the app learns only whether the check passed.

• Deleting your data: uninstalling either app removes its data from your device. Information already on the server is controlled by whoever runs that server; if Moraph runs the server you use, email privacy@moraph.com.

5. Changes to this policy

We may update this policy when our services or the law change. The date at the end shows when it last changed. If we make a material change, we will say so on this page and, where appropriate, tell account holders directly before the change takes effect.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to complain to your data protection authority. To use any of these rights, email privacy@moraph.com with the subject line “Data subject request”. If you use Moraph software through your organization, we may refer your request to your organization, which controls that information.

Last updated November 3, 2026.

Cookies

How we use cookies and similar technologies, and how to change your choices, is explained in our Cookie Policy.