Effective Date: January 1, 2025

Last Updated: November 2, 2026

1. Introduction and Scope

MedaMobil (“we,” “our,” or “us”) provides specialized mobile collection, specimen acquisition, Department of Transportation (DOT) and non-DOT drug and alcohol screenings, paramedical collections, biometric screenings, and clinical laboratory forwarding services (collectively, the “Services”).

This Privacy Policy governs the collection, processing, storage, transmission, and disclosure of personal, employment, technical, biometric, and protected health data obtained from visitors to our website, individuals tested or screened (“Donors” or “Subjects”), corporate clients (“Employers”), Designated Employer Representatives (“DERs”), and Third-Party Administrators (“TPAs”).

By accessing our website, booking an appointment, providing bodily specimens, or signing a digital or physical chain of custody/consent form, you acknowledge and accept the practices outlined in this Privacy Policy.

2. Multi-Framework Regulatory Compliance

MedaMobil operates under strict overlapping state and federal regulatory frameworks:

  • Texas Medical Records Privacy Act (TMRPA): Pursuant to Chapter 181 of the Texas Health & Safety Code, MedaMobil maintains standards that meet or exceed Texas state privacy safeguards, acknowledging Texas’s broader definition of a covered entity and stringent notification standards.
  • Health Insurance Portability and Accountability Act (HIPAA): Where MedaMobil acts as a Covered Entity or a Business Associate to healthcare providers, testing facilities, or clinical laboratories, Protected Health Information (PHI) is safeguarded in strict accordance with the HIPAA Privacy, Security, and Breach Notification Rules (45 C.F.R. Parts 160 and 164).
  • U.S. Department of Transportation (DOT) Regulations: All mandated workplace drug and alcohol testing operations strictly adhere to 49 C.F.R. Part 40 procedures, Federal Motor Carrier Safety Administration (FMCSA) Clearinghouse reporting rules, and related modal administration criteria (FAA, FRA, FTA, PHMSA, USCG). Where DOT regulations mandate specimen retention, split-specimen protocols, custody transfer, or direct disclosure to DERs and federal oversight bodies, DOT mandates supersede conflicting individual state privacy requests or general opt-out demands.
  • Texas Identity Theft Enforcement and Protection Act: Compliant with Texas Business & Commerce Code Chapter 521 regarding the protection of sensitive personal identifiers (e.g., driver’s license, government IDs, financial accounts).

3. Categories of Information We Collect

To deliver mobile testing and ensure legal chain-of-custody validity, we collect the following categories of information:

  • Identifying Information: Full legal name, aliases, physical address, mailing address, mobile/telephone numbers, email address, date of birth, driver’s license number, Commercial Driver’s License (CDL) credentials, social security number (or employee ID), and government-issued photo identification.
  • Employment & Authority Details: Current or prospective employer, hiring status, Department/Division, job title, safety-sensitive designation, and contact details of the supervising DER or TPA.
  • Screening, Physiological, and Health Data: Specific screening panels ordered, medication disclosure lists provided during collection, specimen collection timestamps, collection observation notes, physical chain of custody forms (CCF), breathalyzer readouts, temperature validation metrics, laboratory analytical results, Medical Review Officer (MRO) interview records, split-specimen documentation, and medical practitioner determinations.
  • Financial & Billing Data: Payment card details, corporate account billing data, billing addresses, and invoice transaction records (processed through PCI-DSS-compliant gateways; raw card details are never stored directly on our servers).
  • Technical, Digital & Geolocation Information: IP addresses, browser types, mobile device identifiers, operating systems, approximate geographic location, referral sources, and log data gathered via automated log files, essential cookies, and security tracking tools on our online portals.

4. Legal Basis and Purpose of Processing

MedaMobil processes personal and health information solely for lawful operational, regulatory, and contractual objectives:

  1. Executing Requested Screenings: Administering mobile on-site collection, specimen collection verification, custody validation, and transfer to accredited reference laboratories.
  2. Regulatory & Statutory Reporting: Fulfilling legal requirements under 49 C.F.R. Part 40, reporting verified positive commercial driver results to the FMCSA Drug and Alcohol Clearinghouse, and satisfying state health agency reporting if mandated.
  3. Employer Contractual Obligations: Delivering completed results and testing documentation directly to the employer or sponsoring entity who purchased and authorized the testing program.
  4. Billing and Auditing: Verifying corporate service accounts, processing invoices, resolving disputed charges, and fulfilling insurance or third-party audit requirements.
  5. Legal Defense and Fraud Prevention: Defending against worker’s compensation disputes, wrongful termination allegations, specimen adulteration claims, chain-of-custody challenges, or civil liability proceedings.

5. Strict SMS / Mobile Messaging Privacy Protections (A2P 10DLC & TCPA)

MedaMobil maintains strict compliance with Cellular Telecommunications Industry Association (CTIA) guidelines and carrier A2P 10DLC standards regarding text communications:

  • Explicit Non-Sharing Clause: No mobile phone numbers, SMS opt-in data, or customer consent records collected for text messaging will ever be sold, rented, leased, traded, or shared with third parties, marketing agencies, external partners, or affiliates for promotional or marketing purposes.
  • Scope of SMS Usage: Mobile numbers collected via our booking engine, contact forms, or technician dispatch systems are used exclusively for direct operational communications: dispatch alerts, appointment confirmations, mobile collector arrival notifications, billing notices, and critical chain-of-custody communications.
  • Opt-Out Mechanics: Donors and clients may opt out of SMS communications at any time by texting STOP, END, CANCEL, UNSUBSCRIBE, or QUIT in response to any SMS message. For operational assistance, text HELP or contact our Privacy Officer.

6. Disclosure of Information to Third Parties

MedaMobil does not sell, rent, monetize, or trade personal data or health records to any commercial data brokers or marketing lists. Disclosures occur strictly on a need-to-know basis to fulfill testing and legal mandates:

  • Certified Reference Laboratories: Forwarding urine, oral fluid, hair, blood, breath, or other specimens to SAMHSA-certified or CLIA-certified testing laboratories under strict chain-of-custody protocols.
  • Medical Review Officers (MROs): Transmitting analytical findings to licensed MROs for donor verification, interview clearance, prescription validation, and formal medical determination.
  • Authorized Employers & DERs: Disclosing drug/alcohol clearance status, chain of custody copies, and final results directly to the authorized corporate client who ordered the service pursuant to the donor’s signed authorization or employment mandate.
  • Government, Judicial, and Regulatory Authorities: Disclosing records where compelled by valid federal or state subpoenas, court orders, search warrants, DOT agency audits, FMCSA investigations, or mandatory public health notices under Texas law.
  • Secure Technology & Cloud Infrastructure Vendors: Providing limited, role-based access to HIPAA-compliant cloud hosting, encrypted CRM, and digital signature vendors who execute binding Business Associate Agreements (BAAs) and confidentiality covenants.

7. Specimen Integrity and Chain of Custody (CCF)

Biological specimens collected by MedaMobil represent physical evidence for legal and employment purposes.

  • By submitting to a collection, Donors acknowledge that physical specimens and corresponding Federal Drug Testing Custody and Control Forms (Federal CCF) or Non-DOT CCFs are formal legal records.
  • Chain-of-custody documentation, observation checklists, and tampering logs are business records owned by MedaMobil and the ordering entity. Once a specimen has entered the verified collection workflow, it cannot be recalled, rescinded, or deleted by the donor, except as explicitly provided by federal law or applicable collective bargaining agreements.

8. Robust Data Security Measures

MedaMobil applies administrative, physical, and technical safeguards designed to protect personal and health information against unauthorized access, loss, alteration, or exfiltration:

  • Encryption Standards: Full end-to-end data encryption using TLS 1.3 for data in transit and AES-256 encryption for electronic Protected Health Information (ePHI) at rest.
  • Access Governance: Role-based access controls (RBAC) ensuring employees only view donor information necessary to execute their assigned field collections or dispatch roles.
  • Field Security: Hard-copy chain-of-custody documents and portable collection hardware are maintained under physical seal and direct technician supervision, with strict chain-of-custody handoffs.
  • Employee Compliance: All staff and contracted phlebotomists undergo formal HIPAA, TMRPA, DOT 49 C.F.R. Part 40 qualification training, and criminal background checks prior to field deployment.

9. Record Retention and Legal Supersession

MedaMobil retains health records, testing data, and chain-of-custody files in compliance with the longest applicable retention mandate:

  • DOT Mandated Periods: 49 C.F.R. § 40.333 mandates retention of specific drug and alcohol records for prescribed periods (e.g., 5 years for verified positive results, refusals, calibration records; 2 years for collection logs; 1 year for negative/canceled test records).
  • Texas Medical Records Retention: General health screening and biometric test documentation is retained for a minimum of seven (7) years in accordance with Texas regulatory guidance.
  • Data Destruction: Upon expiration of all legal, regulatory, and audit retention requirements, physical records are securely cross-cut shredded or incinerated, and electronic records are permanently purged using DoD-standard digital sanitation protocols.

10. Individual Rights and Limitations

Depending on your jurisdiction and the nature of the screening performed, you maintain defined rights regarding your personal information, subject to vital legal constraints:

  • Right of Inspection & Access: You may request access to view or obtain a copy of the personal information MedaMobil maintains concerning you.
  • Right to Request Correction: You may request corrections to objective clerical errors in personal identifying data (e.g., misspelled name, incorrect phone number). Scientific test results, collector notes, and certified laboratory findings cannot be altered, amended, or erased.
  • Limitations Imposed by DOT & Employment Law:
    • If your testing was conducted pursuant to federal DOT regulations, you cannot revoke consent retroactively, request data expungement, or restrict reporting to the FMCSA Clearinghouse or DER once testing has commenced.
    • If your test was commissioned directly by an Employer or Third-Party Administrator, MedaMobil may direct your formal records access request to the commissioning Employer as the ultimate Custodian of Record.
  • Exercising Your Rights: To submit an inquiry, verifiable identification must accompany a formal written request sent to our Privacy Officer. We respond within statutory timelines established under Texas law and HIPAA.

11. Third-Party Links and External Portals

Our website or client portals may contain links to external reference laboratories, scheduling engines, payment processors, or regulatory dashboards. MedaMobil does not exercise control over, and assumes no liability for, the privacy protections, cookie policies, or content maintained on external third-party digital properties.

12. Updates and Modifications

MedaMobil reserves the right to modify, amend, or rewrite this Privacy Policy at our discretion to align with revised statutory mandates, technological changes, or modifications in our service structure. Any updates become binding immediately upon publication to our website, with the revised “Last Updated” date displayed at the top of the policy.

13. Privacy Officer and Contact Information

For inquiries, formal access requests, revocation of non-mandatory authorizations, or privacy complaints under Texas law or HIPAA, contact our compliance team:

MedaMobil Privacy & Compliance Department

Attention: Privacy Officer

Email: info@medamobil.com

Primary Central Texas Line: (512) 761-8977

Houston / Secondary Operations Line: (281) 270-7772

Physical Corporate Address: 305 E Huntland Drive, Suite 3005 Austin, TX 78752

If you believe your privacy rights under the Texas Medical Records Privacy Act or HIPAA have been infringed, you have the right to file a formal complaint with our Privacy Officer directly, the Texas Office of the Attorney General, or the U.S. Department of Health and Human Services (Office for Civil Rights).