Your privacy and the security of healthcare data is our top priority. This policy explains how we collect, use, and protect your information.
Our privacy principles
Security first. Healthcare data requires the highest level of security. We use industry-leading encryption and security practices.
Transparency. We are transparent about what data we collect, how it is used, and who has access to it.
User control. You maintain control over your data with the ability to access, correct, and delete your information.
Information we collect
Healthcare data
We process patient data, medical records, and emergency coordination information only as necessary to provide our services to healthcare institutions.
Account information
We collect basic account information including names, email addresses, and role information for healthcare professionals using our platform.
Usage data
We collect anonymized usage statistics to improve our platform performance and user experience.
How we use your information
Service delivery
We use collected information solely to provide emergency coordination services, patient tracking, and communication features.
Platform improvement
Anonymized data helps us improve our platform’s performance, reliability, and user experience.
Compliance
We use information to maintain HIPAA compliance and meet our regulatory obligations.
Data protection and security
Encryption
All data is encrypted in transit using TLS 1.3+ and at rest using AES-256 encryption with regularly rotated keys.
Access controls
We implement strict role-based access controls and multi-factor authentication for all system access.
HIPAA compliance
Stream is HIPAA compliant, and Business Associate Agreements (BAAs) are available to healthcare customers.
Data sharing and disclosure
No third-party sales
We never sell, rent, or trade healthcare data or personal information to third parties.
Service providers
We only share data with vetted service providers (cloud infrastructure, security tools) under strict contractual obligations. See our subprocessors for the current list.
Legal requirements
We may disclose information when required by law, court order, or to protect the safety of individuals.
Your rights and controls
Data access
You have the right to access, review, and obtain copies of your personal information we maintain.
Data correction
You can request corrections to inaccurate personal information through your account settings or support.
Data deletion
You may request deletion of personal information, subject to legal and regulatory retention requirements.
Data retention
Healthcare data. Patient and medical data is retained according to healthcare regulations and your institution’s policies, typically 7 to 10 years.
Account information. User account information is retained for the duration of your service agreement plus 3 years for compliance purposes.
Analytics data. Anonymized usage analytics are retained for up to 2 years to improve our services.
International data transfers
Stream operates within the United States, and all customer data is processed in US data centers.
For international customers:
- Data is processed in AWS regions with appropriate security and compliance certifications.
- We implement Standard Contractual Clauses (SCCs) for EU data transfers.
- Data localization options are available for specific regulatory requirements.
Questions about privacy?
If you have questions about this privacy policy or our data practices, please contact our Privacy Officer.
- Email: privacy@streameoc.com
You can also reach us through the contact page.
Policy updates
We may update this privacy policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on our website.
- Sending notification to registered users.
- Providing 30 days notice before changes take effect.