Overview
Coastal Care Transport LLC ("Company," "we," "us," or "our") is a non-emergency medical transportation (NEMT) provider operating in Suffolk, Virginia and the greater Hampton Roads region. We are committed to protecting the privacy and security of the personal, contact, and health-related information you share with us when using our services or visiting our website at coastalcaretransportva.com.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have regarding your data. It applies to all visitors to our website, all persons who submit a scheduling request, join a waitlist, apply for employment, or otherwise interact with Coastal Care Transport.
This Policy is designed to comply with the Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023, applicable HIPAA Privacy and Security Rule obligations as they apply to NEMT providers handling protected health information (PHI), the Children's Online Privacy Protection Act (COPPA), and applicable federal and Virginia state privacy laws.
Information We Collect
We collect information through the forms on our website, through telephone interactions, and through your use of our transportation services. The categories of information we collect include:
| Category | Examples | Source |
|---|---|---|
| Identity & Contact | Full name, phone number, email address, home address, city, state, ZIP code | Schedule a Ride form, Membership enrollment, Waitlist, Employment application |
| Trip & Scheduling | Pickup address, drop-off location, pickup date and time, return trip details, escort/companion information | Schedule a Ride form, phone booking |
| Mobility & Medical Needs | Ambulatory vs. wheelchair status, door-to-door assistance requirements, mobility equipment needs | Schedule a Ride form, Wheelchair-WAV Waitlist, phone intake |
| Payment Information | Credit or debit card information, billing authorization for recurring membership fees | Membership enrollment, payment processor (not stored directly by CCT) |
| Employment | Resume, work history, references, driver's license details, background check consent | Employment application form |
| Website Usage | IP address, browser type, pages visited, time on site, referral source, cookies | Automatically via GoDaddy Website Builder analytics and Google reCAPTCHA |
| Communications | Emails, phone calls, text messages, and other correspondence with our team | Direct contact with Coastal Care Transport |
You are not required to provide all information we request. However, failing to provide certain information (such as your pickup address, contact number, or mobility needs) may prevent us from scheduling or safely completing your transport.
How We Use Your Information
We use the information we collect only for the purposes listed below. We do not sell your personal information to third parties for monetary consideration.
- To schedule and provide transportation services — coordinating your pickup, route, driver assignment, and return trips.
- To manage your membership — processing recurring billing, tracking trip usage, sending renewal notices, and maintaining your account.
- To ensure passenger safety — communicating mobility needs, wheelchair requirements, and special assistance needs to drivers prior to pickup.
- To process payments — billing membership fees, ancillary charges, and one-time trip fares through our secure payment processor.
- To communicate with you — sending ride confirmations, scheduling reminders, receipts, and important service updates.
- To respond to your inquiries — answering questions submitted via phone, email, or our website contact forms.
- To process employment applications — reviewing, assessing, and communicating with job applicants.
- To improve our website and services — analyzing usage patterns, optimizing page performance, and understanding how visitors interact with our site.
- To comply with legal obligations — maintaining transport records as required by Virginia DMV authority, HIPAA, and applicable state and federal law.
- To protect our rights — enforcing our Membership Service Agreement, investigating disputes, and defending against legal claims.
Health & Medical Information
As a non-emergency medical transportation provider, Coastal Care Transport may act as a Business Associate under HIPAA when transporting patients on behalf of covered healthcare entities. When we handle Protected Health Information (PHI) — including medical conditions, appointment details, and mobility needs — we do so in accordance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule.
The health-related information we collect — including your mobility status (ambulatory or wheelchair), any stated medical conditions relevant to your transport, appointment locations, and frequency of medical visits — constitutes Protected Health Information (PHI) under HIPAA when linked to your identity.
We handle your PHI according to the following principles:
- Minimum necessary use — we access and share only the PHI required to schedule and complete your transport safely.
- Authorized disclosure only — we do not disclose your PHI to any party without your written authorization, except as permitted or required by law (e.g., to your healthcare provider for continuity of care, or to law enforcement under valid legal process).
- Secure storage — PHI is stored in encrypted, access-controlled systems. Paper records are secured in locked files accessible only to authorized personnel.
- Driver confidentiality — drivers receive only the minimum information needed to complete your trip (name, pickup address, destination, mobility needs). They do not receive your full medical history.
- No marketing use — your health information is never used for marketing, advertising, or sold to any third party.
- Breach notification — in the event of a breach of unsecured PHI, we will notify affected individuals and, where required, the U.S. Department of Health and Human Services (HHS) within the timeframes required by HIPAA.
If you are a patient transported under a Business Associate Agreement (BAA) with a healthcare facility, your rights under HIPAA are also governed by that covered entity's Notice of Privacy Practices. You may request a copy of any applicable BAA by contacting us.
Sharing & Disclosure
We do not sell, rent, or trade your personal information. We share your information only in the limited circumstances described below:
| Recipient | Purpose | Safeguards |
|---|---|---|
| Drivers & Dispatch Staff | To coordinate your trip: name, pickup/drop-off, mobility needs, contact number | Minimum necessary access; staff trained on confidentiality |
| Payment Processor | Processing membership fees and trip charges; storing card-on-file authorization | PCI-DSS compliant processor; CCT does not store raw card data |
| Website & Technology Providers | GoDaddy (website hosting, analytics), Google (reCAPTCHA on scheduling form) | Subject to their respective privacy policies; data processing agreements in place |
| Healthcare Providers (with authorization) | Sharing trip records or health information with your medical provider for coordination of care, only with your consent or under a BAA | Written authorization or executed BAA required |
| Law Enforcement / Legal Process | Compliance with court orders, subpoenas, regulatory investigations, or legal obligations under Virginia or federal law | Disclosure limited to what is legally required; we will notify you where permitted |
| Business Transfers | In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity | We will notify you before your information is subject to a different privacy policy |
Trip records for Medicaid-reimbursed transport may be shared with the Virginia Department of Medical Assistance Services (DMAS) and authorized Medicaid managed care organizations as required for billing, audit, and compliance purposes. This is a legally required disclosure, not a sale of your data.
Cookies & Website Analytics
Our website uses cookies and similar technologies to improve your browsing experience and understand how visitors interact with our site. The cookie notice displayed on our website ("This website uses cookies. We use cookies to analyze website traffic and optimize your website experience.") describes our use of analytics cookies.
We use the following types of cookies:
- Essential cookies — required for the website to function correctly (e.g., session management, form submission). These cannot be disabled.
- Analytics cookies — used to aggregate data about page visits, traffic sources, and user behavior to help us improve our site. This data is aggregated and not linked to individual identities. Provided by GoDaddy Website Builder's built-in analytics.
- Google reCAPTCHA — used on our Schedule a Ride form to prevent automated spam submissions. Google's reCAPTCHA service collects hardware and software information and sends this data to Google for analysis. By using the form, you agree to Google's Privacy Policy and Terms of Service.
By clicking "Accept" on the cookie banner when you first visit our website, you consent to our use of analytics cookies. You can withdraw your consent at any time by clearing your browser cookies and not accepting the banner on your next visit. Note that disabling analytics cookies does not affect your ability to use our services.
Data Retention
We retain your information only as long as necessary for the purposes described in this Policy, or as required by law. Our general retention schedule is:
- Trip records and PHI — retained for a minimum of 6 years from the date of service, consistent with HIPAA requirements and Virginia DMV operating authority recordkeeping obligations.
- Membership and billing records — retained for 7 years from the date of the last transaction, consistent with federal and Virginia tax and financial recordkeeping requirements.
- Scheduling form submissions — retained for the duration of active service and for 3 years following the last trip, unless earlier deletion is requested.
- Employment applications (not hired) — retained for 2 years from submission date, consistent with EEOC recordkeeping guidelines.
- Website analytics data — retained in aggregated, de-identified form for up to 2 years.
- Communications (email, phone records) — retained for 3 years or as required by applicable law.
After the applicable retention period, personal information is securely deleted or de-identified. You may request earlier deletion of your personal information, subject to our legal obligations to retain certain records (see Section 9 — Your Rights).
Security
We implement administrative, physical, and technical safeguards designed to protect your personal and health information against unauthorized access, disclosure, alteration, and destruction. Our security measures include:
- Encrypted data transmission — our website uses HTTPS (TLS encryption) for all data transmitted between your browser and our servers.
- Access controls — personal information and PHI are accessible only to authorized Company personnel who need it to perform their job functions.
- Payment security — payment card information is processed through a PCI-DSS compliant payment processor. We do not store raw credit card numbers on our systems.
- Physical security — paper records containing personal or health information are stored in locked files at our business location in Suffolk, VA.
- Employee training — all staff who handle personal or health information receive training on confidentiality, HIPAA requirements, and our data handling procedures.
- Incident response — we maintain a breach response plan that complies with HIPAA Breach Notification Rule requirements, including prompt notification to affected individuals and HHS where required.
While we take reasonable and industry-standard measures to protect your information, no method of electronic transmission or storage is completely secure. If you believe your information has been compromised, please contact us immediately at (757) 942-5254.
Your Privacy Rights
Under the Virginia Consumer Data Protection Act (VCDPA) and applicable federal law, Virginia residents have the following rights regarding their personal data. To exercise any of these rights, contact us at wcmcleod@coastalcaretransportva.com or (757) 942-5254.
We will respond to verifiable consumer requests within 45 days as required by the VCDPA. We may extend this period by an additional 45 days where reasonably necessary, with notice. We will not charge a fee for responding to requests unless they are manifestly unfounded or excessive.
Note that certain rights may be limited where we are required by law to retain your information — for example, trip records required by Virginia DMV authority or HIPAA recordkeeping requirements.
With respect to Protected Health Information (PHI), you may also have rights under HIPAA including the right to access, amend, and receive an accounting of disclosures of your PHI. Contact us to submit a HIPAA-specific request. Where our HIPAA obligations are more stringent than the VCDPA, HIPAA governs.
Children's Privacy
Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 without verified parental consent, as required by the Children's Online Privacy Protection Act (COPPA).
We do transport minors as passengers when accompanied by a parent, guardian, or authorized adult caregiver. Any personal information related to a minor passenger is collected from and with the consent of the accompanying adult, used solely for the purpose of completing the transport, and handled with the same or greater level of care as adult passenger data.
If you believe we have inadvertently collected personal information from a child under 13 through our website without parental consent, please contact us immediately and we will promptly delete that information.
Third-Party Links
Our website contains links to third-party websites, including Google (reCAPTCHA, Privacy Policy and Terms of Service links) and our Facebook page. This Privacy Policy applies only to coastalcaretransportva.com and the services provided by Coastal Care Transport LLC.
We are not responsible for the privacy practices or content of any third-party websites. We encourage you to review the privacy policies of any external site you visit. The presence of a link on our website does not constitute an endorsement of that website's privacy practices.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will:
- Update the Last Updated date at the top of this page;
- Post a notice on our website homepage for at least 30 days following a material change; and
- Where required by law, notify affected users directly by email or other direct communication.
Your continued use of our website or services after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree with a revised policy, please discontinue use of our services and contact us to request deletion of your data.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal or health information, please contact us through any of the following methods:
- Phone: (757) 942-5254
- Email: wcmcleod@coastalcaretransportva.com
- Mail: Coastal Care Transport LLC, Suffolk, VA 23435
- Website: coastalcaretransportva.com
For HIPAA-specific privacy requests or to report a suspected breach of your protected health information, please contact us by phone or email and indicate that your request is HIPAA-related.
For Virginia VCDPA rights requests (access, correction, deletion, portability, opt-out), please email us with the subject line: "Virginia Privacy Rights Request — [Your Name]" and include your full name and the nature of your request. We will verify your identity before processing your request.