Privacy Policy

1. Introduction

Rainbow Road Transport, LLC (“the Company,” “we,” “us,” or “our”) is a non-emergency medical transportation (NEMT) provider serving Chicagoland, all of Illinois, and long-distance interstate travel to and from Illinois. We provide wheelchair, Stretcher-Alternative, and ambulatory transportation with PASS-certified Transportation Specialists, and transportation is scheduled 24 hours a day, seven days a week.

This policy explains how we collect, use, disclose, and safeguard your information when you use our services, call us, visit rainbowroadllc.com, or otherwise interact with us. It covers both visitors to this website and clients who book transportation — if you are only reading the site, sections 8 and 15 are the ones that apply to you. Using this site or our services means you accept the practices described here.

2. Information We Collect

2.1 Personal Information

Name, date of birth, home address, pickup and drop-off locations, phone number, email address, emergency contact, and billing information.

2.2 Protected Health Information (PHI)

Information protected under HIPAA, which may include your name and date of birth, pickup and destination locations, appointment details, mobility and equipment needs, special medical requirements such as oxygen or a feeding tube, conditions that affect transport safety, the referring provider, and insurance information.

2.3 Payment Information

Card number, expiration date, security code, and billing address. Card numbers are not stored on our servers — payments are processed and tokenized by Stripe, a PCI-DSS Level 1 service provider.

2.4 Phone Communications

Calls are handled through Talkdesk, a HIPAA-compliant contact platform. Call recordings and transcripts may be retained for quality assurance and training.

2.5 Information Collected Automatically

IP address, browser type, device and operating system, referring pages, pages viewed, and cookie data.

3. How We Use Your Information

• Coordinating and delivering your transportation
• Communicating with authorized parties — facilities, case managers, or family — only where you have authorized it
• Safety and quality assurance
• Billing and payment processing
• Meeting our legal and regulatory obligations, including HIPAA
• Customer support
• Improving our services

4. HIPAA Compliance and Protected Health Information

We are committed to protecting PHI in accordance with HIPAA and applicable federal and state privacy law. Our full Notice of Privacy Practices, including your individual rights under HIPAA, is published separately.

• Administrative, physical, and technical safeguards protect PHI, and access is limited to authorized personnel.
• We do not sell or share PHI for marketing purposes.
• Business Associate Agreements are in place with third parties that handle PHI on our behalf.
• Staff receive privacy training, data is encrypted, and we conduct audits and maintain breach-response procedures.
• We use and disclose PHI only as HIPAA permits — for treatment, payment, and healthcare operations; where required by law; with your written authorization; or to providers involved in your care.

When you book a transport, you authorize us to use and disclose your protected health information strictly for transportation-related services. That authorization is recorded in the booking agreement you complete at reservation, and you can withdraw it — see “Your rights and choices” below.

5. Online Payment and Card Security

Payments are processed by Stripe (PCI Level 1). Data is transmitted over TLS/SSL and card numbers are tokenized, so full card numbers never reach our servers. Stored data is encrypted at rest using AES-256. A saved payment method is stored only as a token plus the last four digits, and can be deleted on request.

6. Phone Payment Security

You can pay by phone in one of two ways: give your card details to a trained agent, where they are tokenized through Stripe immediately; or ask for a secure payment link by text or email, in which case you complete checkout with Stripe directly and our staff never handle your card. Either way, a saved card is retained only as a token plus the last four digits.

7. Phone Communications and Call Recording

Our contact platform, Talkdesk, maintains SOC 2 and SOC 3, ISO 27001, PCI DSS Level 1, HIPAA, GDPR, and ISO 22301 compliance. Calls may be recorded and transcribed for quality assurance and training, and recordings are encrypted. Transcripts are subject to automatic redaction of personal and health information. Access is limited to authorized, trained personnel.

8. Cookies and Tracking

We use a small number of cookies and similar browser storage:

• Essential: remember your display preference (light or dark) and your region for our cookie notice.
• Analytics (Google Analytics): help us understand how visitors use this site and measure our advertising. They never collect anything you type into our forms.

Visitors in the European Economic Area, United Kingdom, Switzerland, Turkey, and parts of the Middle East and Asia are asked before any analytics cookies are set. Anyone can turn analytics off at any time using “Cookie Settings” at the bottom of every page, or through their browser settings.

9. Information Sharing and Disclosure

We do not sell, rent, or trade your information. We share it only as follows:

• Affiliate transportation providers, in order to fulfill a trip — limited to name, locations, times, and mobility or equipment needs, and subject to confidentiality and HIPAA requirements.
• Service providers including Stripe, Talkdesk, HERE Technologies, Google Maps, and our IT providers, under Business Associate Agreements where required.
• Healthcare providers, where you have authorized it.
• Legal requirements, where disclosure is required by law.
• Business transfers, in the event of a merger or acquisition.

10. Data Security

We maintain administrative, technical, and physical safeguards including SSL/TLS encryption, access controls, monitoring, staff training, and secure disposal. Our partners hold their own certifications, including Stripe's PCI DSS Level 1 and Talkdesk's SOC 2 and SOC 3 and ISO 27001. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Retention

• Transportation records: at least six years, in line with healthcare regulations.
• Billing and payment records: seven years, for tax and accounting purposes.
• Call recordings: retained according to our quality assurance policy.
• Marketing preferences: until you withdraw them.

After these periods, records are securely deleted or anonymized.

12. Your Rights and Choices

You may request access to your information, ask us to correct it, request deletion subject to the legal retention periods above, request restrictions on its use, opt out of marketing communications, and revoke an authorization you previously gave. Contact us using the details below to exercise any of these rights.

13. Illinois Privacy Rights

We comply with the Illinois Biometric Information Privacy Act (BIPA) and other applicable Illinois law. We do not collect biometric information — we do not use fingerprints or facial recognition.

14. Children's Privacy

We transport minors. We do not knowingly collect information directly from children under 13 without parental consent; information about a minor is collected from a parent, guardian, or authorized adult.

15. Third-Party Links

Our site may link to third-party websites. We are not responsible for their privacy practices.

16. Changes to This Policy

We may update this policy. When we do, we will revise the effective date above, post the updated policy, and notify you where appropriate.

How to Reach Us

Questions about this policy, or requests to exercise your rights, can go to any of the following.

Rainbow Road Transport, LLC

1530 S Monterey Ave, Schaumburg, IL 60193

Office

(847) 585-8888

Fax

(847) 929-9993

General Inquiries

info@rainbowroadllc.com

Privacy & HIPAA Requests

privacy@rainbowroadllc.com

Written privacy and HIPAA requests should be addressed to the Privacy Officer and marked “HIPAA Privacy Request.”