We may collect and maintain the following categories of information:

• Business and contact information such as company name, contact names, email addresses, phone numbers, and mailing address.
• Program administration information such as participant roster details, selection workflow records, and reporting metadata.
• Testing administration documentation such as records needed for program management, coordination, reporting support, and audit-ready file delivery.
• Website contact submissions including information entered through forms, email, or phone requests.
• Technical information such as basic website analytics and device/browser metadata used for security and site performance.

We use collected information to:

• Coordinate and deliver DOT and workplace testing administration services.
• Provide support for random testing workflows, post-accident coordination, and compliance-related processes.
• Generate and deliver reporting and documentation requested by authorized employer contacts.
• Communicate with employers, DERs, and authorized representatives regarding service and support.
• Maintain records for legal, contractual, and regulatory requirements.
• Improve service quality, response times, and website performance.

We do not sell personal information. Information may be disclosed only when needed to operate services, including:

• Authorized laboratories, medical review workflows, and service partners involved in program administration.
• Vendors that help us operate systems, communications, and secure records management.
• Governmental or regulatory entities when required by applicable law, regulation, or legal process.
• Professional advisors, insurers, or legal counsel where necessary to protect legitimate business interests and legal rights.

We retain information for as long as necessary to provide services, support compliance workflows, and meet legal or regulatory retention requirements.

We use administrative, technical, and operational safeguards designed to protect information from unauthorized access, misuse, or disclosure. No system can be guaranteed 100 percent secure, but we work to apply reasonable and appropriate controls.