Privacy & Security Policy

1. Introduction

VialSwift LLC ("VialSwift," "we," "our," or "us") operates a HIPAA-compliant medical courier service in the Houston, Texas metropolitan area. We transport biological specimens, pharmaceutical products, medical supplies, and documents on behalf of healthcare providers, clinical laboratories, hospitals, home-care organizations, and specialty pharmacies (collectively, "Covered Entity clients").

As a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations (45 CFR Parts 160 and 164), VialSwift is legally obligated to safeguard any Protected Health Information (PHI) we create, receive, maintain, or transmit on behalf of our Covered Entity clients.

This Privacy & Security Policy applies to all VialSwift employees, contractors, couriers, and third-party vendors who access PHI or systems containing PHI. It also describes our practices regarding information collected through our website (vialswift.com) and client-facing tracking tools.

What Constitutes PHI in Our Operations

PHI includes any individually identifiable health information we encounter in the course of a delivery — including patient names on specimen labels, requisition forms, medical record numbers, dates of service, diagnoses, or any combination of identifiers that could reasonably identify a patient. VialSwift couriers are trained to treat all materials handled as if they contain PHI.

Permitted Uses and Disclosures

VialSwift uses and discloses PHI solely as required to carry out the transportation services described in our service agreements and Business Associate Agreements. We do not sell PHI, use it for marketing purposes, or disclose it to any third party except:

• → To subcontractors who are themselves bound by a written Business Associate Agreement
• → As required by law (e.g., law enforcement, public health authorities)
• → To avert a serious threat to health or safety
• → As directed in writing by the originating Covered Entity

Minimum Necessary Standard

VialSwift applies the HIPAA Minimum Necessary standard to all PHI access. Couriers receive only the pickup/delivery information required to complete the assigned transport — not the underlying clinical data. Dispatch staff access only what is operationally required. Administrative access to full chain-of-custody records is role-restricted and audited.

Before VialSwift handles any PHI on behalf of a Covered Entity, both parties execute a Business Associate Agreement that meets the requirements of 45 CFR §164.504(e). Our standard BAA covers:

VialSwift implements the administrative, physical, and technical safeguards required by the HIPAA Security Rule (45 CFR Part 164, Subpart C) and follows NIST SP 800-66 guidance for healthcare organizations.

Maintaining an unbroken, auditable chain of custody is fundamental to specimen integrity and legal defensibility. Every VialSwift transport follows a documented custody protocol from pickup to delivery confirmation.

Temperature Excursion Policy

If a temperature excursion is detected during transport, the courier is immediately notified, the specimen is quarantined, and the originating client lab director or designated contact is called within 15 minutes. A written excursion report is provided within 24 hours. The decision to accept, retest, or recollect the specimen rests with the client.

Information We Collect on This Website

Our website does not collect PHI. We may collect the following non-PHI data:

• →Contact inquiries: Name, company, email, phone number, and message content submitted via our contact form or email. Used solely to respond to your inquiry.
• →Job applications: Resume and contact information submitted to careers@vialswift.com. Retained for up to 12 months unless you request deletion.
• →Analytics: Anonymized usage data (pages visited, referral source, browser type) via privacy-respecting analytics. No cross-site tracking or personal profiling.
• →Tracking portal: Tracking numbers entered in our /track tool are logged to facilitate the lookup. Logs are purged after 90 days.

Email Communications

Business-related email communications between VialSwift and Covered Entity clients are treated as potentially containing PHI and are handled under the security controls described in Section 4. We do not send PHI via standard unencrypted email without explicit written authorization from the Covered Entity.

Cookies

This website uses only essential functional cookies required to operate the tracking portal and contact forms. We do not use advertising cookies, third-party tracking pixels, or social media retargeting tags.

VialSwift maintains a written Breach Notification Policy consistent with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) and Texas Health & Safety Code §181.154.

To report a suspected security incident or privacy violation involving VialSwift, contact our Security Officer immediately at security@vialswift.com or call (713) 000-0000. Reports may also be made anonymously.

In addition to federal HIPAA requirements, VialSwift complies with applicable Texas state privacy laws:

• →Texas Health & Safety Code Chapter 181 (Texas Medical Records Privacy Act) — We comply with all requirements for handling protected health information under Texas law, which in some areas is more stringent than federal HIPAA.
• →Texas Business & Commerce Code §521 — We maintain a data security program to protect sensitive personal information of Texas residents from unauthorized access.
• →Texas Data Privacy and Security Act (TDPSA) — For any consumer personal data we collect through our website or operations, we honor applicable rights including access, correction, and deletion requests.

As a Business Associate, VialSwift supports Covered Entity clients in honoring their patients' HIPAA rights. If you are a patient with questions about your health information, please contact your healthcare provider (clinic, lab, or hospital) directly — they are the Covered Entity responsible for your Notice of Privacy Practices.

For non-PHI personal data collected through our website (contact inquiries, job applications, analytics), you may:

• → Request a copy of the personal data we hold about you
• → Request correction of inaccurate data
• → Request deletion of your data (subject to legal retention obligations)
• → Opt out of any future marketing communications

Submit requests to privacy@vialswift.com. We respond within 30 days.

VialSwift reviews this Privacy & Security Policy at least annually and following any material change in our operations, systems, or applicable law. We will notify Covered Entity clients of material changes at least 30 days before the effective date via email to the designated compliance contact on file. The current effective date is displayed in the header of this page. Continued use of our services after the effective date constitutes acceptance of the revised policy.