Privacy Policy & HIPAA Compliance

1. Overview

Sufficient Care Transport (SCT) is committed to protecting your privacy and securing your personal and protected health information (PHI). We comply with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws. This policy explains how we collect, use, disclose, and safeguard your information.

2. Information We Collect

Personal Information:

• Name, phone number, email address
• Home and appointment addresses
• Date of birth
• Driver's license or government ID
• Payment and insurance information

Protected Health Information (PHI):

• Medical appointment type and provider
• Mobility assistance needs (wheelchair, stretcher, assistance required)
• Special medical conditions affecting transportation (oxygen, equipment, behavioral needs)
• Insurance provider and policy number
• Medical notes provided by user or healthcare providers

Technical Information:

• GPS location data during rides for dispatch and safety
• App usage, device type, IP address, and browser information
• Ride history and booking patterns
• Communications with dispatch and drivers

3. How We Use Your Information

We use your information to:

• Provide, schedule, and manage transportation services
• Dispatch drivers and optimize routes in real-time
• Process payments and insurance billing
• Communicate appointment reminders and ride updates
• Comply with legal and regulatory requirements
• Investigate complaints and prevent fraud or abuse
• Improve safety, service quality, and operational efficiency (with data anonymized where possible)
• Maintain business and medical records as required by law

4. Who We Share Your Information With

Your information may be shared with the following authorized parties:

• Drivers: Name, pickup/dropoff address, mobility needs, medical notes, and contact info.
• Dispatch Staff: Full information necessary to coordinate rides and verify eligibility.
• Insurance Providers: PHI and billing information to process claims and verify coverage.
• Healthcare Providers: Appointment confirmations and ride status if requested.
• Billing & Collections: Payment and account information for invoice processing.
• Legal & Law Enforcement: Information disclosed as required by court order, subpoena, or law.
• Service Vendors: Third-party platforms for payments, mapping, communications (all under confidentiality agreements).

We do NOT sell your personal or health information to third parties for marketing or commercial purposes.

5. HIPAA Compliance & Your Rights

Under HIPAA, you have the right to:

• Access: Request a copy of your PHI in our possession (within 30 days).
• Amend: Request corrections to inaccurate or incomplete information.
• Accounting of Disclosures: Receive a list of all uses/disclosures of your PHI (last 6 years).
• Restrict: Request limitations on how your information is used (request may be denied if not permitted by law).
• Confidential Communication: Request your health information be sent to an alternative address.

To exercise these rights, contact our Privacy Officer at (615) 919-1656 or through your account portal.

6. Data Security & Safeguards

SCT employs industry-standard technical, physical, and administrative safeguards to protect your information:

• Encryption: All data transmitted via HTTPS (SSL/TLS). PHI encrypted at rest in secure databases.
• Access Controls: Only authorized staff can access PHI. Role-based permissions limit exposure.
• Authentication: Password protection and multi-factor authentication for sensitive accounts.
• Audit Logging: All access to PHI is logged and monitored for unauthorized access.
• Backup & Recovery: Regular backups stored securely to prevent data loss.
• Employee Training: All staff trained annually on HIPAA, privacy, and security protocols.
• Incident Response: Breach detection and mandatory notification within 60 days if required by law.
• Vendor Management: All third-party vendors required to sign Business Associate Agreements (BAAs) and maintain HIPAA compliance.

7. Data Retention & Deletion

• Active Customers: Records retained for duration of service relationship plus 7 years (per Medicare/insurance requirements).
• Inactive Accounts: Retained for 7 years from last transaction, then securely destroyed or anonymized.
• Driver Records: Maintained per Tennessee labor law and insurance requirements (minimum 7 years).
• Deletion Requests: You may request deletion of your account; we will comply except where retention is required by law.

8. Cookies & Tracking

Our website and app use cookies and tracking technology to:

• Keep you logged in to your account
• Remember your preferences and booking history
• Track GPS location during active rides for dispatch and safety
• Analyze usage patterns to improve services (anonymized data only)

You can disable non-essential cookies in your browser settings. Disabling tracking may limit app functionality.

9. Data Breach Notification

If your information is compromised in a security breach, SCT will notify you within 60 days via email, phone, or mail. Notification will include the nature of the breach, types of information affected, mitigation steps taken, and steps you can take to protect yourself. We will also notify healthcare providers and insurance companies as required by law.

10. Children's Privacy

SCT services are not intended for children under 13. We do not knowingly collect information from children. If we become aware of such collection, we will delete the information immediately. For minors 13-18, a parent or guardian must authorize account creation.

11. Third-Party Links

Our website and apps may contain links to third-party services (payment processors, mapping, insurance platforms). SCT is not responsible for the privacy practices of external websites. Review their privacy policies before providing personal information.

12. International Users

SCT is based in Tennessee and operates only within the United States. If you access our services from outside the US, your information may be transferred to and processed in the US. By using SCT services, you consent to this transfer.

13. Policy Changes

SCT may update this privacy policy. Material changes will be communicated via email or prominent notice on the website/app. Continued use after changes constitutes acceptance of the updated policy.

14. Contact & Privacy Inquiries

For privacy concerns or to exercise your rights:
Privacy Officer
Sufficient Care Transport
Phone: (615) 919-1656
Hours: 24/7 Dispatch (General inquiries: Business hours)

You also have the right to file a complaint with the U.S. Department of Health & Human Services Office for Civil Rights if you believe your HIPAA rights have been violated.