Privacy Policy.

Scope and Who This Policy Covers

This Privacy Policy is issued by Apex Courier Logistics Group LLC, DBA Apex Medical OC (“Apex,” “we,” “us”), a California limited liability company, California Entity No. B20260171016, with its registered office at 15 Enterprise, Suite #250-C, Aliso Viejo, CA 92656 and its operational and dispatch hub in Mission Viejo, CA 92691.

It explains how Apex handles information in connection with our public website, our sales and intake process, our dispatch and notification systems, and the operational records generated by clinical logistics and compliance-testing work. It applies to visitors to the Apex website and anyone who submits the service request form; business contacts at prospective, current, and former client organizations, including procurement officers, lab directors, safety managers, and designated employer representatives; individuals who contact Apex dispatch by telephone, SMS, or email; and authorized client personnel who access Apex portals, reports, or chain-of-custody exports.

This policy does not govern Protected Health Information, which is addressed in Section 02, and it does not govern the internal personnel records of Apex employees and contractors, which are handled under a separate internal policy.

Website Data and Protected Health Information Are Governed Separately

This is the most important distinction in this document, and procurement reviewers should read it first. Apex handles two structurally different streams of information, and they are governed by different legal instruments.

Practically, this means a hospital or clinic client should evaluate Apex against the HIPAA Statement and the negotiated Business Associate Agreement for anything touching patient data, and against this policy for everything else. Consumer deletion rights under California law do not reach PHI held by Apex as a business associate, and they do not reach federally regulated drug and alcohol testing records. See Section 09.

Categories of Information We Collect

Apex collects the following categories, and no others, in the ordinary course of business.

Contact and business information

Submitted voluntarily through the service request form or by email, telephone, or SMS: name, organization, job title, work email address, work telephone number, service address or facility, service type requested, requested timing, and any free-text notes you choose to provide. We ask that free-text fields not be used to transmit patient identifiers.

Click-to-agree acceptance records

When you accept the Terms of Service, a Business Associate Agreement, an authorization, or a rate schedule through an Apex interface, we store an acceptance record consisting of the identity of the accepting user, the exact document version accepted, a UTC timestamp, the originating IP address, and the browser user agent string. This record exists to evidence assent and is retained as a compliance record.

Telemetry and location data from Apex vehicles and devices

Generated by Apex equipment and Apex personnel, not by your devices: GPS waypoints and route traces, geofence arrival and departure events at pickup and delivery locations, temperature probe readings logged every 60 seconds, refrigeration and battery power state, device and operator identifiers, and photographic seal or packaging verification images. This telemetry documents the custody and condition of what we are moving. It is operational evidence, not consumer tracking, and it is not used for advertising.

Operational and compliance records

Dispatch tickets and run identifiers, chain-of-custody metadata, barcode and QR specimen identifiers, proof-of-delivery signature vectors, notification and SMS delivery logs, call handling records, service exception notes, invoices, and payment records.

Website and server data

Standard server logs including IP address, requested URL, referring URL, timestamp, and coarse geographic region derived from IP. Apex does not deploy third-party advertising trackers or cross-site behavioral advertising pixels on this website.

Apex does not knowingly collect biometric identifiers, precise consumer geolocation from personal devices, government identification numbers, or financial account numbers through this website.

How We Use Information

Information described above is used only for the following purposes:

• To respond to service requests, quote work, and schedule dispatch from the Mission Viejo hub.
• To execute and evidence custody: to produce the temperature log, the chain-of-custody record, and the proof-of-delivery packet that accompany each run.
• To meet regulatory and contractual recordkeeping obligations, including the 7 year retention described in Section 06.
• To send operational notifications by SMS, email, or push: pickup confirmations, arrival alerts, exception alerts, and delivery confirmations.
• To invoice, collect payment, resolve billing questions, and improve route structure and response time using aggregated operational data.
• To secure our systems, detect and investigate fraud or misuse, and enforce our agreements.
• To comply with law, respond to lawful process, and cooperate with regulators and auditors within the limits set by HIPAA and by any applicable Business Associate Agreement.

Apex does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not use business-contact data to build advertising profiles. Marketing communications, where sent at all, go to business contacts about services relevant to their organization and carry an unsubscribe mechanism.

Service Providers and Subprocessors

Apex uses third-party service providers to operate. We name the categories honestly rather than claiming an all-in-house stack we do not have. A current, specifically named subprocessor list is available to clients and to procurement reviewers on request.

Any subprocessor that may create, receive, maintain, or transmit PHI on behalf of Apex is engaged under a written Business Associate Agreement that flows down the same obligations Apex owes to the covered entity. Apex does not permit PHI to be processed by a vendor that will not sign one. Subprocessors are permitted to use information only to perform services for Apex and are prohibited from using it for their own purposes.

Data Retention

Retention is set by the purpose and by regulation, not by convenience.

Records under legal hold, or subject to an open audit, investigation, or dispute, are retained until the hold is released regardless of the schedule above. Backup media are purged on a rolling cycle, so deletion from live systems may precede deletion from backups by a short interval.

Security Measures

Apex states its security posture precisely, and states its limits just as precisely. The following controls are in place:

• HTTPS in transit for all web traffic, and TLS for all data in transit between application components and subprocessors.
• AES-256 encryption at rest for stored operational and compliance data.
• Role-based access control, so that operators, dispatch, billing, and client users each see only the data their role requires.
• Audit logging of access to and modification of compliance records.
• Daily backups of production data.
• SHA-256 hash-sealing of compliance records, so that a chain-of-custody packet or temperature log can be checked against its recorded hash. This makes an altered record tamper-evident.

California Privacy Rights: CCPA and CPRA

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights below with respect to personal information Apex holds about you as a business.

Right to know and access

To request the categories and specific pieces of personal information we collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties to whom it was disclosed.

Right to delete

To request deletion of personal information we collected from you, subject to the statutory exceptions, including records we must retain for legal, compliance, security, or contractual reasons.

Right to correct

To request correction of inaccurate personal information we maintain about you.

Right to opt out of sale or sharing

Apex does not sell personal information and does not share it for cross-context behavioral advertising. There is accordingly nothing to opt out of, and Apex maintains no “Do Not Sell or Share” sale program. We will honor a Global Privacy Control signal as an opt-out request if our practices ever change.

Right to limit use of sensitive personal information

To direct that sensitive personal information be used only for permitted purposes. Apex does not use sensitive personal information for inferring characteristics and does not use it for advertising.

Right to non-discrimination

Apex will not deny service, charge a different price, or provide a different level of quality because you exercised a privacy right.

To exercise a right, contact us using Section 12. We will verify your identity in proportion to the sensitivity of the request, which for a business contact usually means confirming control of the email address or telephone number on file. An authorized agent may submit a request with written permission and, where required, a verified power of attorney. We respond within 45 days and may extend once by a further 45 days with notice.

Drug and Alcohol Testing Records Are Not Consumer Records

Where Apex performs specimen collection, program administration, or transport in connection with an employer’s drug and alcohol testing program, the resulting records are not consumer records subject to deletion at the request of the tested individual.

Federally regulated testing records are governed by 49 CFR Part 40 and the applicable operating administration rules, together with the retention obligations those rules impose. Non-federal testing records are governed by the client employer’s written policy and program, and by the service agreement between Apex and that employer. In both cases Apex acts at the direction of the employer or its Third Party Administrator, and Apex will not delete, alter, or suppress a required testing record on the request of the tested individual.

An individual who wants to access, question, or correct a testing record should contact the employer’s Designated Employer Representative or, for federally regulated results, the Medical Review Officer of record. Rights available to tested individuals under Part 40, including the right to request a test of the split specimen, are described on the DOT Compliance Statement. Apex will assist an employer in responding to such a request but is not the custodian of record for the employer’s program.

Children’s Privacy

The Apex website and services are directed to healthcare organizations, employers, laboratories, and government buyers. They are not directed to children. Apex does not knowingly collect personal information from anyone under 16 years of age through this website, and does not sell or share the personal information of consumers under 16 under any circumstance.

Where a specimen belonging to a minor is transported for a covered entity, any associated identifiers are PHI, handled under HIPAA and the Business Associate Agreement rather than under this policy, and are subject to the barcode-first minimization design described in the HIPAA Statement. If you believe a child has provided information to us through the website, contact us using Section 12 and we will delete it.

Changes to This Policy

Apex may revise this policy to reflect changes in law, technology, subprocessors, or operations. When we do, we will update the Last updated date at the top of this page and post the revised version here.

Where a change is material and affects an active client relationship, we will give notice to the client administrative contacts on file before the change takes effect, and where a click-to-agree acceptance is required, we will request renewed acceptance and record it as described in Section 03. Continued use of the website or of Apex services after the effective date of a revision constitutes acceptance of the revised policy for ordinary business data. Superseded versions are retained so that any acceptance record can be matched to the exact text in force at the time.

Contact for Privacy Requests

Privacy questions, access, deletion, and correction requests, and authorized agent submissions should be directed to Apex in writing. Use the registered office address below for any request you want treated as formal written notice.

Email: chris@apexmedicaloc.com with “Privacy Request” in the subject line. Telephone: 888-494-4409, toll-free, 24/7. Mail: the registered office address in the contact block below.

Requests concerning PHI should identify the covered entity involved so that Apex can route the request to that entity, which is the party with the direct obligation to the individual under the HIPAA Privacy Rule.