Effective date: January 1, 2026
NStream Healthcare (“NStream,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal information and protected health information (“PHI”) collected through naughtystreams.com, our patient portal, telehealth platforms, clinics, and related services. This Privacy Policy explains what we collect, how we use and share it, your choices, and how we safeguard data. It supplements—not replaces—any Notice of Privacy Practices provided at the start of clinical care where required by healthcare regulations.
We collect identifiers and contact details (name, email, date of birth where relevant), appointment preferences, insurance or membership information you choose to supply, messages submitted through contact or appointment forms, survey responses, and clinical information you provide during intake, visits, telehealth sessions, or portal messaging.
When you browse our website, we may collect device type, browser, IP address, pages viewed, referring URLs, and approximate location derived from IP for fraud prevention and analytics. We use cookies and similar technologies as described in Section 8.
With authorization, we may receive records from other providers, laboratory and imaging results, pharmacy fill data, and eligibility information from payers or employer wellness programs. We verify sources before incorporating data into your chart.
We use personal information and PHI to deliver and coordinate care; schedule and remind you of appointments; process payments; operate telehealth; respond to inquiries; improve clinical quality and patient experience; comply with legal and regulatory obligations; detect fraud and security incidents; and—where you opt in—send newsletters and health education. We do not sell PHI or email lists to data brokers or unrelated marketers.
De-identified or aggregated data that cannot reasonably identify you may be used for research, public health reporting, and service improvement. Any such use follows applicable de-identification standards.
For clinical operations, we process PHI under treatment, payment, and health care operations purposes as defined in applicable privacy regulations, including HIPAA where NStream functions as a covered entity or business associate. Where GDPR or similar frameworks apply to non-clinical website processing, we rely on consent, contract performance, legitimate interests balanced against your rights, or legal obligation as appropriate.
We may share information with:
We require vendors to use data only for contracted services and to maintain appropriate safeguards. A list of major subprocessors is available upon request to care@naughtystreams.com.
Depending on your jurisdiction and relationship with NStream, you may have rights to access, amend, or receive copies of your records; request restrictions on certain uses or disclosures; request confidential communications by alternative channels; obtain an accounting of disclosures; and file a complaint with our privacy office or a supervisory authority.
To exercise rights, email care@naughtystreams.com with sufficient detail to verify identity. We respond within timeframes required by law. Denials may occur where information is exempt (e.g., psychotherapy notes where applicable) or disclosure would harm another person.
Marketing emails include unsubscribe links; you may also use our unsubscribe page. Portal notification preferences can be adjusted separately from marketing subscriptions.
Medical records are retained according to clinical, legal, and accreditation requirements—often a minimum of six to ten years after last encounter or longer for minors. Website logs and security telemetry are kept for limited periods unless needed for investigations. When retention ends, we securely delete or anonymize data.
We employ administrative, technical, and physical safeguards including encryption in transit for web and portal traffic, role-based access controls, workforce training, vendor risk review, and incident response procedures. No system is perfectly secure; report suspected breaches to care@naughtystreams.com promptly so we can investigate and notify affected individuals or regulators as required.
Essential cookies enable sessions, form security, and load balancing. Analytics cookies help us understand aggregate traffic patterns; you may limit non-essential cookies through browser settings or consent tools where displayed. We do not use PHI for third-party behavioral advertising.
Our general marketing website is not directed to children under thirteen. Pediatric care is provided under guardian consent. We do not knowingly collect personal information from children for marketing without parental authorization.
If you access our site from outside your country of residence, data may be processed in regions where our servers or vendors operate. We implement appropriate transfer mechanisms where cross-border processing occurs.
We update this Privacy Policy when practices, technology, or laws change. Revisions appear on this page with a new effective date. Material changes affecting PHI uses will be communicated through the portal or email when required.
In the event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay, including description of the incident, types of information involved, steps individuals should take, mitigation actions we are taking, and contact procedures for questions. Regulatory bodies and media notices will be issued when required by law.
All workforce members with access to PHI complete privacy and security training upon hire and annually thereafter. Access is granted on a minimum-necessary basis and revoked promptly upon role change or termination. Violations of policy may result in disciplinary action up to termination and reporting to licensing boards when appropriate.
Portal messages may become part of your legal medical record. Do not use the portal for emergencies. Shared accounts are discouraged; each adult should maintain individual credentials. Automatic session timeout reduces risk on shared devices.
Residents of states with comprehensive privacy laws may have additional rights regarding personal information not classified as PHI, including rights to know, delete, correct, and opt out of certain sharing for cross-context behavioral advertising. We honor applicable state requests in accordance with overlapping health privacy frameworks.
Email care@naughtystreams.com with subject line “Privacy Request.” Include your full name, date of birth if a patient, and a description of your question or request. We aim to acknowledge inquiries within five business days.