1. Introduction: At Triangle Access (“we,” “our,” or “us”), we value the privacy of our riders, clients, and platform users. We provide specialized transit solutions, including Non-Emergency Medical Transportation (NEMT), student transit, and workforce transportation services (collectively, our “Services”).
This Privacy Notice explains how we collect, use, maintain, protect, and disclose personal information and Protected Health Information (PHI). By utilizing our Services, booking rides, or interacting with our digital platforms, you acknowledge the terms outlined in this policy.
2. Information We CollectTo coordinate safe, compliant, and reliable transportation, we collect information directly from riders, authorized representatives, healthcare partners, and automated systems.
- Contact & Identification Data: Names, phone numbers, email addresses, residential addresses, emergency contact details, and dates of birth.
- Non-Emergency Medical Transportation (NEMT) Data: Pickup/drop-off medical facilities, clinic departments, appointment arrival/departure times, authorized medical escorts or caregivers, Medicaid/Medicare recipient ID numbers, health plan or broker authorization numbers, and specific mobility/accessibility accommodations (e.g., ambulatory, standard wheelchair, motorized chair, bariatric, or oxygen tank requirements).
- Student & Workforce Transit Details: School district assignments, authorized guardian pickup lists, employer names, and fixed route schedules.
- Payment & Billing Information: Credit card or banking details processed via secure, PCI-DSS compliant third-party payment gateways (we do not store full payment card numbers on our local servers).
- Telematics & Location Data: Precise real-time GPS tracking from our vehicles, dispatch tablets, and mobile applications to optimize route scheduling, provide accurate arrival estimates, and verify trip completion for health plans or educational sponsors.
- Safety & Video Recordings: Exterior and interior vehicle dashcam footage captured strictly for passenger safety, driver accountability, accident investigation, and insurance verification.
- Third-Party Data Sources: Data shared by NEMT brokers (e.g., Modivcare, MTM), Medicaid Managed Care Organizations (MCOs), healthcare providers, school districts (including McKinney-Vento coordinators), state agencies (such as NCSEAA), or corporate employers.
3. HIPAA & Health Information Privacy; When providing transportation services under contracts with healthcare entities, Medicaid programs, or NEMT brokers, Triangle Access may handle Protected Health Information (PHI) governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
- Business Associate Role: When acting as a "Business Associate" to covered healthcare entities or broker networks, we handle PHI solely to fulfill transportation obligations, verify eligibility, submit claims, or satisfy explicit contractual requirements under a Business Associate Agreement (BAA).
- Minimum Necessary Standard: Our drivers and dispatch personnel are granted access only to the minimum health-related information necessary to ensure safe transport (such as passenger mobility needs or destination medical clinics). Drivers do not have access to full diagnostic histories or medical charts.
- De-Identified Data: We may use fully anonymized or de-identified logistical data (with all individual identifiers removed) to evaluate route efficiency, enhance scheduling models, and calibrate dispatch algorithms.
4. How We Use Your Information: We utilize collected information to:
- Fulfill Transportation Logistics: Dispatch appropriately equipped vehicles (e.g., wheelchair-accessible vans vs. standard sedans) to match individual passenger physical requirements and scheduled pick-up windows.
- Coordinate Care & Transit: Communicate real-time ETA updates, delays, and arrival confirmations with riders, facilities, family members, or case managers.
- Billing & Reimbursement: Verify transport authorizations, submit trip confirmation logs to Medicaid, health insurance plans, or NEMT brokers, and process private fares.
- Safety & Regulatory Compliance: Enforce passenger safety standards, investigate vehicle incidents, maintain vehicle maintenance records, and comply with Department of Transportation (DOT) and state healthcare regulatory audits.
5. How We Share Your Information: Triangle Access does not sell or rent personal information or health records. We disclose data strictly within operational and legal parameters:
- Healthcare Providers & Brokers: We share trip confirmations, no-show notices, and time-stamped pickup/drop-off records with originating medical facilities, managed care plans, and contracting brokers.
- Educational & Corporate Sponsors: We share student attendance logs and employee transit verifications with contracting school districts and corporate clients.
- Authorized Service Providers: We work with vetted third-party vendors who provide our cloud infrastructure, dispatch software, SMS alert systems, and payment processing under strict confidentiality agreements.
- Legal, Regulatory & Emergency Disclosures: We may disclose information if required by court order, subpoena, Medicaid oversight audit, or in emergency situations where passenger safety or life is at immediate risk.
6. Children’s Privacy (COPPA & Student Transit): Triangle Access complies with the Children’s Online Privacy Protection Act (COPPA). While we transport minors under the age of 13 for school districts and specialized youth programs, we do not knowingly solicit or collect personal information directly from children online. All student transportation records, names, and pickup arrangements must be supplied by a parent, legal guardian, or authorized school administrator.
7. Data Security & Retention: We maintain administrative, physical, and technical safeguards designed to safeguard all collected data against unauthorized access, loss, or disclosure:
- Technical Safeguards: Encryption protocols for data in transit and at rest, multi-factor authentication for dispatch/administrative portals, and role-based access restrictions.
- Physical & Organizational Safeguards: Secure facility storage, background checks, and annual HIPAA/privacy training for all administrative personnel and drivers.
- Data Retention: Transportation and billing records (including Medicaid-related transport logs) are retained in compliance with federal and North Carolina record retention mandates (typically 5 to 7 years) before being securely shredded or digitally purged.
8. Your Rights & Choices
- Communications Opt-Out: You can opt out of promotional messages by using the unsubscribe mechanism in our emails. Transactional and operational communications (such as ride dispatch alerts and arrival texts) are necessary for service delivery and cannot be opted out of while actively using the service.
- Review & Correction: You may request access to, or correction of personal contact information held directly by Triangle Access.
- PHI Inquiries: For transportation provided under a Medicaid or private healthcare plan contract, requests regarding formal HIPAA privacy rights (such as full access to medical billing records or accounting of disclosures) should be directed to your primary healthcare provider or transportation broker.
9. Policy Updates: We reserve the right to modify this Privacy Notice to reflect operational updates, technological advancements, or changes in healthcare and transportation laws. Any updates will be posted on this page with a revised effective date.
10. Privacy Contact Information: If you have questions, concerns, or requests regarding this Privacy Notice or our data handling practices, please contact our Privacy Team:
- Entity: Triangle Access
- Attention: Privacy Officer / Compliance Department
- Email: info@triangleaccess.com
- Region: North Carolina, USA