Portal Privacy

01About this notice and our role

This Portal Privacy notice applies to personal information processed through the student portal and related registration, learning, communication, payment, assessment, and document-management features provided by STEAMS ONLINE, Inc. (“Steams Online,” “Steams,” “we,” “us,” or “our”).

Your school, training provider, employer, or other organization administering your program is referred to as your “Institution.”

The Portal may display your Institution’s name, branding, or customized website address. This notice applies to the Steams-operated features made available through that Portal.

For information your Institution collects and maintains through Steams, we generally act as its technology service provider or data processor, as applicable. Your Institution determines the educational purposes for collecting that information, the records it requires, and the users authorized to access those records.

Steams may separately process limited information for its own account administration, security, support, legal compliance, and service-management purposes. Our legal responsibilities depend on the information and the activity involved; we do not treat all student information as available for independent business use.

Your Institution may provide additional privacy notices explaining its practices. This notice does not replace those notices, your Institution’s educational-record obligations, or the Student Portal Terms of Use. Visits to Steams’ general marketing website are addressed separately by the privacy notice applicable to that website.

02Information processed through the Portal

The information processed depends on your Institution, its settings, and the features you use. Not every category below is collected from every user.

Information may come directly from you, your Institution and its authorized personnel, an authorized parent or sponsor, connected service providers, or your browser and device when you use the Portal.

Your Institution may import records collected outside Steams. Questions about the source or necessity of an Institution-required field should be directed to that Institution.

Required information should be identified in the relevant workflow. Choosing not to provide information necessary for a particular function may prevent that function from being completed. Optional information should not be submitted unless you wish to provide it.

03Why information is used

We process information to provide the Portal functions requested by you and your Institution. These purposes include creating and maintaining accounts, processing registration, delivering learning materials, recording participation, supporting assessments, managing documents, displaying payment records, and facilitating authorized communications.

Information also supports technical assistance, troubleshooting, fraud prevention, account protection, investigation of misuse, and compliance with applicable legal obligations.

Your Institution may use Portal records to administer attendance requirements, review progress, determine completion, manage tuition, and meet applicable reporting or recordkeeping obligations.

Service analysis and improvement must remain consistent with the purpose for which information was collected, applicable agreements, and privacy requirements. Identifiable educational records are not available for unrestricted product development or unrelated commercial use.

Where we use genuinely de-identified or aggregated information, we take reasonable steps to prevent it from being linked back to an individual. Removing a name alone does not necessarily make a record anonymous.

04Who may receive information

Your Institution and authorized users

Your Institution’s administrators, instructors, and other authorized personnel may access information relevant to their responsibilities.

An authorized employer, sponsor, parent, or guardian may receive information through the access or disclosures established for that relationship. Paying tuition, sponsoring training, or being related to a student does not automatically provide unrestricted access to the student’s records.

Your Institution may direct appropriate disclosures to licensing bodies, credentialing organizations, funding agencies, clinical-placement partners, or other recipients where there is a lawful basis.

An Institution does not gain permission to access another Institution’s private records merely because both use Steams.

Service providers

We may disclose information to providers that help deliver hosting, storage, security, payment processing, email, text messaging, document processing, electronic signatures, technical support, and enabled AI functionality.

Providers processing information on our behalf must be subject to appropriate confidentiality, security, and data-use restrictions. Information made available to them is limited to what is reasonably needed for the authorized service.

Some connected providers process information for their own purposes, such as payment-network compliance or fraud prevention. Their notices apply to those independent activities.

Legal requirements and protection of rights

We may disclose information when legally required or when reasonably necessary and legally permitted to address fraud, security incidents, threats to safety, disputes, or protection of legal rights.

We assess requests in light of applicable restrictions on educational records and other protected information.

Business changes

Information may be transferred as part of a merger, acquisition, restructuring, or transfer of the relevant business. Applicable privacy protections, contractual restrictions, and legal requirements continue to apply. A business transfer does not, by itself, authorize unrelated use of student information.

05Learning activities, identity checks, and shared content

Where enabled, the Portal records learning activities such as course access, attendance, assessment attempts, submitted answers, progress, completion events, and timestamps.

Identity-check features may process security questions, responses or verification results, and associated activity information. These records support account protection, participation verification, and academic-integrity reviews.

Authorized personnel may review relevant records for those purposes. These features do not guarantee that impersonation or unauthorized assistance will always be detected.

Automated functions may score assessments, calculate progress, or apply access rules configured for a course. Questions about an incorrect result or its effect on your program should be directed to your Institution for review.

Private assignments are not public merely because they are uploaded. However, your name, profile information, and posts may be visible to authorized participants when you use a class discussion or shared activity.

Do not post information in a shared area that you do not intend other participants to see. Recording, public credential verification, or additional monitoring features require appropriate feature-specific disclosures where applicable.

06Payments and financial information

Payment transactions initiated through the Portal involve the payment provider selected for the transaction. That provider processes the payment credentials needed to complete the payment.

Steams and your Institution may receive or retain transaction information such as payment amounts, dates, status, processor references, tokens, receipts, and masked payment-method details. These records support billing, reconciliation, refunds, installment management, and transaction inquiries.

Do not include full payment-card numbers, card security codes, or bank-login credentials in messages, assignments, support requests, or ordinary document uploads.

Your Institution manages its tuition, cancellation, and refund policies. The payment provider’s privacy notice also applies to its processing.

This notice does not authorize recurring payments or automatic withdrawals. Any required payment authorization must be obtained separately.

07AI-assisted learning features

Your Institution may enable AI-assisted tutoring, explanations, practice questions, or other learning tools.

When you use an AI feature, relevant information may be processed to generate a response. This may include your question, selected course material, uploaded documents, conversation context, and technical information needed to operate the feature.

AI interactions may be retained as part of learning history, technical logs, or support records. Authorized personnel may access relevant information for educational administration, troubleshooting, security, or support, consistent with their permissions and the applicable arrangements.

Do not assume that an AI conversation is an anonymous or off-the-record conversation.

We do not use identifiable student records, private coursework, or student AI conversations to train general-purpose AI models, and we do not authorize our AI service providers to do so.

Using relevant course material to answer a question is different from using that material to train a general-purpose model. Data supplied to an AI service must be limited to the authorized learning or support purpose.

Do not enter unnecessary sensitive information or identifiable information about patients, clients, coworkers, or other third parties. AI output can be inaccurate; review important information with your instructor or another appropriate source.

08Cookies, analytics, and advertising

The Portal uses cookies or similar technologies where needed to maintain sessions, support authentication, remember relevant preferences, and protect the service.

Where enabled and legally permitted, functional or performance technologies may help identify errors and improve reliability. Where consent is required for a nonessential technology, it must be obtained before that technology is activated.

Browser settings may allow you to block or delete cookies. Blocking essential session technologies may prevent sign-in or other Portal functions from working.

We do not sell personal information collected through the Portal. We do not share it for cross-context behavioral advertising or use educational records to build advertising profiles.

We do not use advertising trackers to target students based on their activity within authenticated Portal pages.

These restrictions do not prevent your Institution from communicating with you about your program or sending other communications for which it has an appropriate legal basis.

Embedded or linked third-party services may have their own technologies and privacy practices. Your Institution and Steams must consider those practices when enabling integrations; a link to a provider’s notice does not remove responsibilities for disclosures made to that provider.

09Email, text messages, and other communications

Steams and your Institution may use contact information to provide registration confirmations, payment receipts, course notices, account alerts, password-reset messages, and other service-related communications.

Marketing communications are separate from essential service communications. Portal use alone is not consent to receive automated marketing calls or marketing text messages.

You may use the applicable unsubscribe instructions or contact the sender to change marketing preferences. Where permitted by law, necessary account, security, or transaction emails may continue after you unsubscribe from marketing.

For text messages, follow the opt-out instructions provided by the sender. Contact your Institution about alternative ways to receive important course information.

10Sensitive information and healthcare-related training

Some programs may require sensitive information to establish eligibility, meet professional requirements, arrange accommodations, or document participation. This could include identification documents, background-screening information, or health-related records.

Such information should be requested only where necessary and processed through an appropriate, authorized workflow. Your Institution should explain the purpose and any applicable requirements.

The Portal is designed for educational and administrative use, not as a general-purpose patient-record system. Do not upload identifiable patient records or clinical case information unless the use has been specifically approved and appropriate legal and contractual arrangements are in place.

Serving a healthcare training program does not automatically mean that every record is governed by HIPAA. The applicable protections depend on the organization, the record, and how it is maintained. Some student health records fall under FERPA rather than HIPAA. This notice does not replace a required business associate agreement or other legally required arrangement.

Do not put sensitive records in class discussions, ordinary support messages, or AI prompts when they are not necessary for the activity.

11Children and younger students

The Portal supports educational and training programs that may have different age requirements.

An account for a child under 13 must not be established unless Steams and the Institution have approved a process that addresses the applicable children’s privacy requirements before collection.

Where COPPA applies, required notices and verifiable parental consent—or a legally permitted school-authorization arrangement—must be in place. School authorization is limited to the permitted educational context and is not permission to use children’s information for unrelated commercial purposes. Steams does not transfer its own COPPA responsibilities to an Institution.

Parents and authorized school representatives may contact Steams regarding access to, deletion of, or further collection of a child’s information, subject to applicable requirements.

If we learn that a child’s information was collected without a required authorization, we will take appropriate steps to address the collection, including restricting processing and deleting information where required.

This notice alone is not parental consent.

12Information security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and loss. These include protections for web connections and restrictions on access to information.

Access by Steams personnel and service providers is limited to authorized purposes such as operating, maintaining, securing, or supporting the service.

No online service or security measure can eliminate every risk. Protect your credentials, use authorized accounts, and report suspected unauthorized access promptly.

When a security incident affects personal information, we will investigate and take appropriate action. We will notify affected Institutions, individuals, or authorities where required by applicable law or our contractual obligations.

This section does not waive any rights or remedies available under applicable law.

13Retention, deletion, and account closure

We retain personal information for as long as reasonably necessary for the purposes described in this notice, taking account of applicable agreements, documented retention requirements, and legal obligations.

Different records may have different retention periods. Relevant considerations include active enrollment, access to completed coursework, educational-record obligations, financial recordkeeping, security investigations, and the resolution of disputes.

For records maintained on behalf of your Institution, its lawful instructions and the applicable service agreement help determine retention and deletion. Those instructions do not authorize retention prohibited by law.

Account closure, graduation, withdrawal, or the end of a course does not necessarily require immediate deletion of all related records. Your Institution may need to retain certain records after your access ends.

When information is no longer needed and no lawful retention requirement applies, it will be deleted or appropriately de-identified. Backup copies may remain until removed through the applicable backup-retention cycle, with continued protection and restricted use.

Existing contractual and privacy-notice commitments remain applicable to information collected under them. This notice does not retroactively extend a previously promised deletion deadline.

Contact your Institution about its educational-record schedule or Steams about retention within our responsibility.

14Your privacy choices and requests

Depending on your location, the applicable law, and our role in processing the information, you may have rights to access information, obtain a copy, correct inaccuracies, request deletion, or restrict or object to certain processing.

Other rights may include withdrawing consent, limiting certain uses of sensitive information, opting out of covered advertising or disclosures, and challenging a decision on a privacy request. These rights have conditions and exceptions; they do not all apply to every user or record. California law, for example, provides specific rights where the business and processing are covered.

For information maintained on behalf of your Institution, contact the Institution first. You may also contact Steams, and we will assist within our responsibility or coordinate with the appropriate party.

Where available, you can update profile details directly in your account. Academic records may require Institution review rather than direct editing.

We may verify your identity and authority before providing records or making changes. Verification requests will be proportionate to the information and the risk involved. Do not send passwords or unnecessary identification documents in an ordinary email.

We will respond within the period required by applicable law and explain relevant limitations or refusals where required. Authorized agents may submit requests where permitted, subject to appropriate verification.

We will not unlawfully discriminate against you for exercising privacy rights. You may also complain to the relevant privacy regulator or other competent authority.

15Educational-record rights and FERPA

FERPA applies to educational agencies and institutions receiving funds through programs administered by the U.S. Department of Education. Not every private training provider or certificate program is automatically covered.

Where an Institution is subject to FERPA, access to and handling of covered records must follow the applicable requirements. When Steams operates under the school-official exception, the arrangement must satisfy the conditions for that exception, including institutional control and restrictions on unauthorized use and redisclosure.

Your Institution administers requests concerning its educational records and determines applicable access and disclosure rights. Steams supports those processes within its role and contractual responsibilities.

This notice does not replace your Institution’s FERPA notice or independently authorize a disclosure that requires consent or another lawful basis.

16Processing locations and international users

Steams operates from the United States. Personal information may be processed in the United States and other countries where authorized personnel or service providers operate, subject to applicable legal and contractual requirements.

Privacy laws may differ between countries. Where cross-border processing requires particular safeguards, those safeguards must be established for the relevant transfer.

Where a law requires an identified lawful basis, processing must rely on an appropriate basis for the activity. For Steams’ own processing, that may include necessary performance of an agreement with you, legal obligations, legitimate interests in protecting and supporting the service where permitted, or consent for an optional activity.

For Institution-directed processing, your Institution determines the applicable purposes and lawful basis, and Steams operates within the authorized arrangement.

You may contact Steams for information about processing locations and applicable transfer safeguards. Simply accessing the Portal does not waive international privacy rights or serve as blanket consent to transfers requiring additional protection.

17Changes to this notice

We may update this notice to reflect changes in Portal features, data practices, legal requirements, or our operations.

The published notice will identify its effective date. For material changes affecting how information is collected, used, or disclosed, we will provide appropriate notice and obtain additional consent where required.

We will not rely solely on a silent website update to authorize materially different uses of previously collected information where further notice or permission is required.

18Privacy questions and requests

For questions about Steams’ handling of personal information or to submit a privacy request, contact:

Include your name, the email address associated with your account, your Institution’s name, and a brief description of your request.

Do not include your password, full payment-card details, or unnecessary sensitive documents.

For educational-record corrections, grades, attendance, transcripts, or your Institution’s own privacy practices, contact your Institution directly. Steams will assist with matters within its responsibility.