Privacy Policy

1. Who We Are

Nocturne Health, the registered business name of Stretch Medical Corporation ("Nocturne Health," "we," "us"), is a cash-pay virtual sleep medicine practice operated by licensed physicians. This Privacy Policy explains what information we collect when you use our website, sleep tools, screeners, and booking flow, and how we use and share that information. By using the site you agree to this policy.

2. Information We Collect

We collect three categories of information:

• Information you provide: contact details you submit when joining our waitlist or booking a visit. Booking and payment are handled by our practice-management partner (Carepatron); we do not receive or store card numbers.
• Clinical information: what you share with us once you become a patient.
• Automatically collected information: device and browser type, pages viewed, the referring URL and any campaign or ad-click parameters in the link you arrived from, which on-site tools you open or complete (but never your responses or results), and how you move through our pages (session replay). Our hosting provider necessarily receives your IP address when delivering the site but this is discarded from our analytics data. Collected via cookies and similar technologies — see Section 5.

3. How We Use Your Information

• Provide and improve our clinical services, including scheduling, conducting, and following up on virtual consultations.
• Send transactional messages, including, after a visit, one email asking for a Google review — we store when that email is due and when it was sent on your contact record.
• Operate, secure, and improve the website and the on-site sleep tools.
• Measure and improve website usage and performance.
• Comply with legal, regulatory, and professional obligations.

4. Service Providers and Third Parties We Share Data With

We do not sell your personal information. We share it only with service providers that process it on our behalf under written agreements limiting their use to providing services to us, in these categories:

• Practice-management, scheduling, and payment software used to book and pay for your visit.
• Transactional email delivery.
• Text message delivery for one-time verification codes.
• Website hosting and infrastructure.
• Product analytics: PostHog, which sets cookies and collects usage data as described in Section 5.

We do not use advertising pixels or advertising analytics tags on this website, and we never share clinical information with advertising platforms. The events we send to PostHog describe interactions with the website (page views, tool opens, screener completions, booking-button clicks, booking confirmations) — they do not include screener answers, free-text inputs, or any clinical content.

5. Cookies, Analytics, and Session Replay

We use a small number of first-party cookies and similar browser storage. Strictly necessary storage keeps the site working (for example, security and remembering your privacy choice). We also use PostHog, a product-analytics service that processes data on our behalf through our own domain. PostHog is on by default and collects:

• Usage events — pages viewed, how far you scroll, which site features you use (for example, opening a booking window or completing a sleep tool), errors, and clicks that don't respond. These are linked to a random identifier stored in your browser, not to your name or email address.
• Session replay — a reconstruction of how you move through our pages (clicks, scrolling, and page layout) so we can find and fix confusing parts of the site. Everything you type into any field is masked before it leaves your browser, the text of our booking and waitlist windows is masked, and our sleep screeners and tools are excluded from recording entirely. Appointments are booked on our scheduling provider's page, which session replay cannot see.
• IP addresses are discarded rather than stored with this data.

We do not use advertising cookies, advertising pixels, or third-party analytics tags, and nothing collected here is used for advertising. You can turn off analytics and session replay for this browser with the control below; recording stops immediately, and your choice is remembered on this device until you clear your browser's site data. If your browser sends a Global Privacy Control or Do Not Track signal, analytics and session replay are off automatically.

6. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. We handle medical information in accordance with California's Confidentiality of Medical Information Act and the medical-privacy laws of the other states where we are licensed. We do not sell personal information or share it for cross-context behavioral advertising. To exercise any right, email us at the address below. We will respond within the time required by applicable law.

7. Data Retention

Medical records are retained for the period required by the medical-board rules of the state in which care was delivered (typically 7–10 years from the last visit, longer for minors). Session recordings are deleted after 30 days. Waitlist contact records are retained for 12 months; if we are not able to offer service in your state within that time, they are deleted. Records of one-time code texts, including the number and time, are kept for 6 years.

8. One-time code text messages

When we have a secure document ready for you, we email you a link to a secure page. To open the document, you tick a consent checkbox and press "Send code" on that page, and we will text a one-time verification code to the mobile number you gave us when you booked an appointment. We collect and use your mobile phone number for this purpose, to send these one-time codes. We send one code per request. We do not send marketing or promotional texts. Message and data rates may apply. You can reply STOP at any time to opt out, or HELP for help. If you opt out or can't receive texts, contact us at support@in.nocturnehealth.com.

We keep a security record of each code we send, including the number it was sent to and the time, for 6 years. For text messages, we share your number only with our messaging provider, Amazon Web Services, through AWS Notify, which may use it only to deliver our messages. Text messaging opt-in data and consent will not be shared with any third parties or affiliates. No mobile numbers will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Messages are delivered through AWS Notify. AWS does not share end user phone numbers with third parties for marketing or promotional purposes.

The terms for these messages are in our Terms of Service.

9. Data Security

We use TLS encryption in transit, and our vendors that store clinical data maintain encryption at rest, access controls, and audit logging. No method of transmission or storage is perfectly secure; we work to mitigate risk but cannot guarantee absolute security.

10. Children

Our services are intended for adults aged 18 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, contact us and we will delete it.

11. International Visitors

Nocturne Health operates in the United States and provides clinical services only to patients physically located in the states where our physicians are licensed. If you visit the site from outside the United States, you understand that your information will be processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above and, where appropriate, communicated by email or an on-site notice. Continued use of the site after a change indicates acceptance of the updated policy.