Privacy Policy

Effective Date: September 4, 2026

Return to Duty SAP Services, LLC respects the privacy of Website visitors, employees seeking SAP services, and employer or DER contacts. This Privacy Policy explains how information collected through r2dsap.com is handled. It applies to general Website activity and inquiries. Additional confidentiality rules may apply once an individual becomes a SAP client or provides information as part of the DOT return-to-duty process.

1. Information We May Collect

Information you provide directly may include your name, telephone number, email address, preferred contact method, whether you are an employee/driver or employer/DER, and the general reason for your inquiry.

We may also receive limited technical information automatically when you use the Website, such as browser type, device type, IP address, general usage data, referring page, and cookie information, depending on the Website platform and settings in use.

Please do not submit test results, treatment records, diagnoses, medication information, Social Security numbers, detailed substance-use history, or other highly sensitive information through a general Website form.

2. How We Use Information

We may use information collected through the Website to respond to inquiries, schedule or coordinate services, communicate about requested services, operate and secure the Website, maintain business records, comply with legal and regulatory requirements, and improve Website usability.

Information obtained as part of actual SAP services may also be used to perform evaluations, make required recommendations and determinations, prepare SAP reports, verify completion of education or treatment, establish follow-up testing plans, and fulfill legally required reporting obligations.

3. DOT Confidentiality and SAP Records

As a DOT service agent, Return to Duty SAP Services is subject to federal confidentiality requirements for DOT drug and alcohol testing information. Except where DOT regulations or other law authorize or require disclosure, individual test results or medical information are not released to third parties without the employee’s specific written consent.

SAP reports are provided to the appropriate DER or other authorized recipient as required by 49 CFR Part 40. Copies of SAP reports to employers are maintained for five years. Clinical records are retained and protected in accordance with applicable federal, state, and local law.

An employee may request copies of SAP reports. When required by 49 CFR § 40.329, follow-up testing information is redacted before the SAP report is provided to the employee.

4. Information We May Share

We may disclose information only as reasonably necessary for the purposes described in this Policy or as permitted or required by law. Depending on the circumstances, recipients may include the employee’s employer or DER, authorized DOT or safety agency representatives, the FMCSA Drug & Alcohol Clearinghouse, the National Transportation Safety Board, professional service providers supporting our operations, or other parties specifically authorized by the individual.

When DOT regulations require specific written consent for a disclosure, we will follow those requirements rather than rely on a general or blanket authorization.

5. FMCSA Clearinghouse Reporting

For FMCSA-regulated CDL or CLP holders, the SAP is required to report specified information to the FMCSA Drug & Alcohol Clearinghouse. This includes the date of the initial SAP assessment and the date the SAP determines that the driver has demonstrated successful compliance and is eligible for return-to-duty testing. Other Clearinghouse reporting responsibilities belong to employers, MROs, or C/TPAs as provided by law.

6. Service Providers

We may use third-party providers for Website hosting, email, scheduling, payment processing, secure document handling, communications, analytics, or other business functions. Providers are selected and configured with privacy and security considerations appropriate to the information they handle. When applicable law requires a specific privacy or security agreement with a vendor, we will seek to use an appropriate vendor and agreement.

7. Cookies and Analytics

The Website may use cookies or similar technologies that are necessary for Website functionality and may use limited analytics to understand Website performance. Cookie and analytics practices may change as Website features change.

We do not intend general Website forms to be used for sensitive health or treatment information. Health-related or authenticated areas, if added in the future, will be reviewed separately for applicable privacy and security requirements before tracking technologies are enabled.

8. No Sale of Personal Information

Return to Duty SAP Services does not sell personal information submitted through the Website.

9. Data Security

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information we maintain. No website, email system, or electronic transmission method is completely secure, so sensitive records should be sent only through the method we specifically provide for that purpose.

10. Data Retention

General Website inquiries are retained only as long as reasonably necessary for communication, business, legal, and recordkeeping purposes. SAP reports and clinical records are retained according to applicable DOT requirements and other federal, state, and local laws.

11. Your Privacy Requests

You may contact us to ask about personal information you have provided through the Website or to request correction or deletion where applicable. Some records cannot be deleted or altered when retention is required by DOT regulations, professional licensing rules, legal obligations, or other applicable law.

If HIPAA applies to the practice or to particular records, rights regarding protected health information will be described in the applicable HIPAA Notice of Privacy Practices rather than solely in this Website Privacy Policy.

12. HIPAA and 42 CFR Part 2

This Website Privacy Policy is not intended to serve as a HIPAA Notice of Privacy Practices or a 42 CFR Part 2 patient notice. Those requirements apply only when the practice or records fall within the scope of those laws. Return to Duty SAP Services will provide any additional notice required by applicable law.

13. Children’s Privacy

This Website is intended for adults seeking employment-related or employer-related services and is not directed to children under 13. We do not knowingly collect personal information online from children under 13.

14. Third-Party Links

The Website may contain links to third-party websites, including government resources. We are not responsible for the privacy practices of websites we do not operate. Review the privacy policy of any external service before providing information.

15. Changes to This Privacy Policy

We may update this Privacy Policy as regulations, services, technology, or data practices change. The current version will be posted on the Website with its effective date.

16. Contact Us

Questions or privacy requests may be directed to:

Return to Duty SAP Services, LLC

Email: chas@r2dsap.com

Phone: 419-701-4741