Kastr for school nurses
Every other vendor in this category has no nurse-facing page at all. That is the whole reason this one exists. Below: what the platform does for health-office work, a column stating plainly what it does not do, and the price — which is on the site rather than behind a call, because you should not have to book a meeting to find out what something costs.
| Need | Kastr today | How it works, or why it does not |
|---|---|---|
| Send to one classroom's families | Workaround only | Select the students; guardians attach automatically. No grade, school or route preset exists — only "specific people" and "everyone" resolve. |
| Reach a family that does not answer texts | Yes | SMS-to-voice failover on terminal SMS failure, with the failover linked to the original attempt. SMS, email and voice only — no push channel. |
| Send urgently outside quiet hours | Yes | Quiet hours default 21:00–07:00. An emergency-flagged send bypasses them and per-family channel preferences, gated on a capability rather than a checkbox. |
| Read the translation before a family does | Yes | DeepL-powered translation with preview in the composer. The composer exposes a set of preview languages, not DeepL's full target list — check yours is there. |
| Prove later what was sent and to whom | Yes | Per-district SHA-256 hash-chained audit log, append-only at two layers: UPDATE and DELETE revoked at the DB role, plus INSERT/SELECT-only RLS policies. |
| Send a form or a treatment sheet | No | No attachments anywhere in the product. Put the content in the body, or link to something you host. |
| Have the platform detect and send automatically | No | Notice rules can be configured; no engine fires them. Every send is composed by a person. If you need automation, weigh this heavily. |
| Hold the health record | No — by design | Kastr holds no health, immunization or care-plan record and applies no clinical logic. Your health record system stays authoritative. |
Kastr is pre-launch. Everything in the "yes" rows is in the codebase and verified against our claims ledger; everything in the "no" rows genuinely does not exist, and we would rather you read it here than find it in a demo. There are no customer references on this page because we have no customers yet.
What a nurse's send actually looks like
Take the most common one: a classroom exposure notice, going out at 2pm so families see it before the evening.
- Select the students. Their guardians expand automatically — one person row per human being, with effective-dated role rows, so a person who is both a guardian and a staff member is one record and not two. You are not maintaining a parent list alongside a student list.
- Save it as an audience preset if you will need the same group again, which for an exposure sequence you will.
- Write it, tick SMS and email. The cost-and-reach estimate updates as you tick, so you see what adding voice would cost before you commit rather than after.
- Preview the translation. Read the Spanish yourself. The most important sentence in a health letter is usually a negative or a conditional, and those are what machine translation gets wrong.
- Send a test to yourself. It arrives with a test prefix, addressed to you only. Read it on a phone.
- Send, or schedule. A scheduled send resolves its audience at send time rather than schedule time, so Thursday's message goes to Thursday's roster.
The step that is slower than it should be is the first. Building a classroom by selecting students is a minute of work for one class and considerably more for a grade level across four buildings. That is the honest state of it.
Can a nurse use this without being a district administrator?
Yes, and it matters more than it sounds. In a lot of districts the nurse cannot send anything without going through the front office or the communications director, which puts a person who has never seen the student between the clinician and the family, at the exact moment speed matters.
The relevant properties: roles are effective-dated and scoped to an organisation, isolation is hierarchy-aware so a school-level user sees their school's records and not the district's or another school's, and row-level security is enforced through a non-owner, DML-only database role inside every transaction — so the isolation is a property of the data layer rather than something the application remembers to check. With no organisation context set, policies evaluate against null and return zero rows: it fails closed rather than open.
Authentication is a magic link — 32 random bytes, fifteen-minute expiry, single-use, with same-device binding and no account enumeration. There is no password to share, which removes the shared-office-login problem entirely. There is also, and we will not pretend otherwise, no SSO, no SAML, no OIDC and no MFA of any kind. Magic link is the only authentication method. For districts with an identity-provider requirement in procurement, that is a real gap and it belongs in your evaluation.
Records, retention and what we will never do with family data
Two commitments that matter more in health communication than anywhere else.
Retention. Retention class is derived from role at record creation — student, guardian and staff records carry different defaults, and those defaults are published rather than described. What we will not claim: there is no configurable retention enforcement and no purge job. The published defaults are a documented policy, not an enforced mechanism, and saying otherwise would be the kind of claim that fails a security review.
Family data. Contract clause 9.4 commits that Kastr never markets or sells to district families and never takes family-facing revenue, ever. That is a contractual term rather than a privacy policy paragraph, which means it survives a change of management. It is worth comparing against platforms that are free to districts and bill families instead — ClassDojo charges families directly for its consumer products — because in that model the district's parent list is the revenue base, and health communication is exactly the context in which that arrangement should give a district pause.
Exit. Clause 11.2 gives a change-of-control exit right: on acquisition or a material change to data terms, terminate within 90 days with export, a prorated refund and no penalty. Clause 7.1 is an export right. Both are contract rights exercised through us — there is no self-serve export button, because that tooling is not built. We would rather state the clause number than imply a feature.
On certification: we hold no SOC 2 attestation. We are pre-launch and have not been audited. The security properties described on this page are verifiable in code and in CI — there is a cross-tenant leakage suite that runs against real Postgres on every build, including an owner-bypass regression check — but that is engineering evidence, not an auditor's opinion, and the two are not interchangeable in a procurement conversation. See the trust page for the current status.
What it costs
$3.50 per student per year under 5,000 students. $3.25 from 5,000 to 14,999. $3.00 at 15,000 and above. One tier — there is no health module, no nurse seat licence, no per-message fee and no add-on for translation or voice. Every feature described on this page is included at that price.
Fixed for 36 months. From year four, any increase is capped at the lesser of CPI-U or 5% under contract clause 3.2, which is the clause that matters if you have ever been through a renewal where the number moved by a third.
For context on why we publish it: ParentSquare publishes no price anywhere on its site. ClassDojo is free to districts and bills families instead. Bloomz publishes tiers. A nurse evaluating tools should be able to find out what something costs without booking a call, and the number above is the number.
If you are evaluating us, the useful question. Ask us what we cannot do. The answer will be: no grade, school or bus-route targeting; no automated notices; no attachments; no push notifications; no SSO or MFA; no native SIS connectors for PowerSchool, Infinite Campus, Skyward, Aeries or Synergy — roster data is POSTed to a documented REST endpoint or pushed with our MIT-licensed CLI; no SOC 2; no self-serve export; and no customers, because we are pre-launch and looking for design partners rather than references. If any of those is disqualifying, it is better for both of us that you find out from a web page than from a procurement process.
Questions people actually ask
Can a nurse send messages without district-admin access to the whole platform?
Yes. Roles are effective-dated and scoped to an organisation, and isolation is hierarchy-aware — a school-level user sees their own school's records and not another school's or the district's. That isolation is enforced by row-level security through a non-owner database role inside every transaction, and with no organisation context set it returns zero rows rather than everything. It fails closed.
Does the message log survive if a family later disputes what was sent?
That is what the audit log is for. Each district's log is hash-chained with SHA-256 so every entry covers the one before it, and it is append-only at two independent layers: UPDATE and DELETE are revoked at the database role, and the row-level security policies grant INSERT and SELECT only with no UPDATE or DELETE policy at all. The result is a notice history that is tamper-evident rather than merely stored. It records what was sent, to which contact point, in which language, and what the delivery outcome was.
Can I send an emergency exposure notice outside quiet hours?
Yes. Quiet hours default to 21:00 to 07:00, and an emergency-flagged send bypasses both quiet hours and per-family channel preferences. The flag is gated on a capability rather than being a checkbox anyone can tick, because a platform where every send can be marked urgent has no urgent sends. Use it for a measles notice; do not use it for a forms reminder.
What does it cost, and is there a separate price for health features?
$3.50 per student per year under 5,000 students, $3.25 for 5,000 to 14,999, $3.00 at 15,000 and above. One tier, everything included — no health module, no nurse seat licence, no per-message fee, no translation surcharge. Fixed for 36 months, with year four onwards capped at the lesser of CPI-U or 5% under contract clause 3.2.
Can Kastr send a notice to one grade level or one school?
Not as a preset, and this is the limitation most likely to affect health-office work. Two audiences resolve: specific people, and everyone in the district. A grade or a building has to be built by selecting its students, which then expands to their guardians automatically, and the selection can be saved as a reusable audience preset. That works, but it is a workaround, and if grade-level targeting is a hard requirement you should weigh it heavily.
Does Kastr hold student health records?
No, deliberately. Kastr is a communications platform: it holds the send record, not the health record, and it applies no clinical or compliance logic. It does not model immunization requirements, exclusion rules or care plans. Your health record system and your student information system remain authoritative, and anything a vendor tells you about your state's immunization rules should be met with a question about where that came from and when it was last verified.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.