Privacy Policy

1. Scope

MedStream Capital is located at 9719 S Dixie Hwy #8, Miami, FL 33156. This policy applies to the MedStream Capital website and to the online application linked from it. It covers business applicants, practice owners, guarantors, and site visitors. MedStream Capital is a commercial lender; this policy is not a consumer financial privacy notice for personal or patient borrowing, because MedStream Capital does not offer either.

2. Information we collect

Business identifiers. Practice legal name, EIN, business address, entity type, state of formation, and professional or facility licensure status.
Owner identifiers. Name, date of birth, Social Security number, phone number, and email address for each owner at 20% or more.
Financial information. Business bank statements, deposit and balance data, Plaid-linked account data, existing debt and advance balances, and equipment quotes on equipment files.
Site usage. IP address, user agent, pages viewed, and referral source, including the ref partner code that identifies a referring ISO.
Call recordings where you have consented to recording.

3. Information we do not collect

MedStream Capital does not collect, request, receive, or store protected health information. We do not connect to electronic health record systems, practice management systems, or clearinghouses. We do not collect patient names, diagnoses, procedure codes, claim detail, or treatment records.

MedStream Capital is not a HIPAA covered entity and not a business associate. We underwrite on business financial records — bank statements, deposits, and the practice's own stated revenue. We do not request, receive, access, or store protected health information, and we do not connect to your EHR, practice management system, or clearinghouse.

4. How we use it

Underwriting and credit decisioning; identity verification; fraud prevention; servicing and collections on funded files; legal and regulatory compliance; and placement with a bank, SBA, or specialist partner where a MedStream Capital in-house product is not the right answer.

5. Soft credit inquiry

MedStream Capital runs a soft credit inquiry at application. A soft inquiry does not affect the applicant's personal credit score and is not visible to other lenders as an application for credit. A hard inquiry, if any, occurs only with separate written consent given prior to funding.

6. Sharing

Bank, SBA, and specialist partners where your file is placed, for that partner's own underwriting.
The referring ISO partner identified by the ref code — deal status and commission-relevant data only, not your full file, your statements, or your credit data.
Service providers under contract: Plaid for bank verification, an e-signature provider, hosting, and telephony.
As required by law, including subpoena, court order, and regulatory examination.

We do not sell personal information. We do not share your contact details with other lenders, and we do not sell or broker applications.

7. GLBA

MedStream Capital maintains a privacy program compliant with the Gramm-Leach-Bliley Act and its implementing rules, including the Safeguards Rule, and provides the required initial and annual privacy notices to applicants and funded customers.

8. State privacy rights

Where applicable to business contact data we hold, residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana may request access to, correction of, deletion of, or a copy of personal information, and may appeal a denial. Do Not Sell or Share: MedStream Capital does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of — but you may submit a request anyway and we will confirm in writing. We respond to verified requests within 45 days.

Submit a request by calling (888) 896-5559 or writing to MedStream Capital, 9719 S Dixie Hwy #8, Miami, FL 33156.

9. Security

TLS 1.3 in transit. AES-256 at rest. Plaid-verified bank linking, so MedStream Capital never sees your online banking credentials. A GLBA-compliant privacy program on SOC 2 Type II infrastructure. Social Security numbers are stored encrypted, and only the last four digits are displayed in any MedStream Capital interface. Access to sensitive fields is role-gated and every access is logged.

10. Retention

Declined and withdrawn application files are retained for 25 months from the date of the decision, consistent with Regulation B record-retention practice for business credit, and then deleted or de-identified. Funded files are retained for the life of the obligation plus 7 years. Call recordings are retained for 24 months.

11. Children

This site and these products are directed to U.S. businesses and to individuals 18 and older. MedStream Capital does not knowingly collect information from anyone under 18.

12. Changes and contact

We will post any change to this policy on this page with a new "last updated" date. Questions: MedStream Capital, 9719 S Dixie Hwy #8, Miami, FL 33156, (888) 896-5559.