Privacy Policy & Health Information Notice

Effective Date: 07/01/2024

This Privacy Policy & Health Information Notice (“Policy”) explains how SAPvaluate, a brand of SAPvaluate LLC (“SAPvaluate,” “we,” “us,” or “our”), collects, uses, discloses, and safeguards information in connection with our website, services, and communications. Please read it carefully.


1. Scope of This Policy

This Policy applies to information collected or handled by SAPvaluate LLC through:

  • Our website(s) and online services
  • Intake forms, scheduling tools, communications, and payment systems
  • Administrative and coordination services related to DOT-regulated Substance Abuse Professional (“SAP”) processes

This Policy does not govern the independent practices of licensed Substance Abuse Professionals, laboratories, Medical Review Officers (MROs), employers, or other third parties not under SAPvaluate’s direct control. Those parties maintain their own privacy practices.


2. Our Role and Legal Position

SAPvaluate LLC provides administrative, coordination, and compliance-support services in connection with DOT-regulated SAP evaluations and return-to-duty processes under 49 CFR Part 40.

Licensed SAPs engaged through or in connection with SAPvaluate LLC are independent professionals who are solely responsible for clinical evaluations, determinations, recommendations, and reports.

Depending on the nature of the services provided and the information involved, SAPvaluate may handle information that is subject to federal or state health privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

SAPvaluate LLC does not hold itself out as a healthcare provider and does not provide medical treatment. Where applicable law requires HIPAA compliance, SAPvaluate LLC complies to the extent required and consistent with its role as an administrative or support service provider.

This Policy is intended to describe SAPvaluate’s general practices and does not create obligations beyond those required by applicable law.


3. Information We Collect

a. Identifying and Administrative Information

  • Name, address, phone number, email address
  • Date of birth
  • Employer or prospective employer information
  • DOT-related identifiers
  • Scheduling and appointment records

b. SAP Process and Compliance Information

  • Referral and intake details
  • Appointment dates and status
  • Compliance or non-compliance status
  • Return-to-duty and follow-up testing plans
  • Administrative records related to DOT compliance

This information may constitute Protected Health Information (“PHI”) when handled in a HIPAA-regulated context.

c. Payment Information

  • Billing records
  • Payment confirmations
  • Transaction metadata processed by third-party payment providers

SAPvaluate does not store full credit card numbers.

d. Website and Technical Information

  • IP address
  • Browser type
  • Device type
  • Usage data collected through cookies or similar technologies

This information is used for security, analytics, fraud prevention, and operational purposes and is not used to make clinical or healthcare decisions.


4. How We Use Information

  • Facilitating scheduling, coordination, and administrative support for SAP services
  • Communicating regarding appointments, compliance steps, account activity, and services
  • Processing payments and managing billing
  • Operating, maintaining, and improving our website and services
  • Ensuring compliance with DOT regulations and other legal obligations
  • Fraud prevention, security monitoring, auditing, and internal business operations

5. Disclosures of Information

SAPvaluate LLC may disclose information, including PHI where applicable, as permitted or required by law, including in the following circumstances:

a. DOT and Employer Disclosures

Information may be disclosed as required or permitted under 49 CFR Part 40, including to:

  • Employers or Designated Employer Representatives (DERs)
  • DOT agencies or authorized representatives
  • Other parties expressly authorized or required under DOT regulations

These disclosures may include SAP status, compliance or non-compliance determinations, eligibility information, and follow-up testing plans.

b. Service Providers

To vendors and contractors that assist us in operating our services (such as hosting, communications, analytics, and payment processing), subject to contractual confidentiality and security obligations.

c. Legal and Regulatory Requirements

When required by law, subpoena, court order, audit, investigation, or lawful government request.

d. Health, Safety, and Public Protection

When necessary to prevent or lessen a serious and imminent threat to health or safety, as permitted by law.


6. HIPAA and Health Information

  • Uses and discloses PHI only as permitted or required by applicable law
  • Limits uses and disclosures to the minimum necessary where required
  • Maintains reasonable administrative and technical safeguards appropriate to its role

SAPvaluate’s handling of health-related information is administrative in nature and does not replace or override the privacy practices of licensed SAPs or other healthcare providers.


7. Substance Use Information (42 CFR Part 2)

Certain substance-use disorder records may be subject to additional protections under 42 CFR Part 2. Where applicable, SAPvaluate LLC complies with those requirements.

Disclosures required or permitted by DOT regulations or other applicable law remain authorized.


8. Your Rights

  • Request access to certain records
  • Request correction of information
  • Request an accounting of certain disclosures
  • Request restrictions on certain uses or disclosures (not all requests can be honored)
  • Request confidential communications

Requests must be submitted in writing and may be subject to identity verification and legal limitations.


9. Text Messages, Calls, and Electronic Communications

By providing your phone number or other contact information, you consent to receive communications from SAPvaluate LLC, including phone calls, text messages (SMS/MMS), emails, and automated or system-generated messages, related to scheduling, compliance steps, account activity, and services.

Message and data rates may apply. Message frequency may vary.

SAPvaluate LLC does not sell SMS opt-in data. We may share contact information with service providers that assist us in delivering communications, subject to contractual confidentiality and legal requirements.

You may opt out of non-essential text messages at any time by replying STOP or by contacting us. Certain service-related or legally required communications may continue where permitted by law.

Electronic communications are not always secure. By communicating with SAPvaluate LLC electronically, you acknowledge and accept these risks unless you request alternative communication methods in writing.


10. Cookies and Tracking Technologies

SAPvaluate LLC may use cookies or similar technologies to enhance user experience, analyze website usage, and improve services. You may control cookie settings through your browser preferences. Disabling cookies may affect certain site functionality.


11. Data Security

SAPvaluate LLC maintains administrative, technical, and physical safeguards appropriate to the nature of the information handled. No system can be guaranteed to be completely secure.


12. Data Retention

SAPvaluate LLC retains information for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements.


13. Changes to This Policy

SAPvaluate LLC reserves the right to modify this Policy at any time. Changes will be effective upon posting with a revised effective date and will apply to information maintained at that time, as permitted by law.


14. Contact Information and Complaints

Privacy Contact

SAPvaluate LLC

Email: [email protected]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. SAPvaluate LLC does not retaliate for filing a complaint.


15. Acknowledgment

By using SAPvaluate’s website or services, you acknowledge that you have read and understood this Privacy Policy & Health Information Notice.