Privacy Policy

Last updated: September 28, 2026.

1. Scope and Unity's role

Unity Testing, LLC ("Unity," "we," "us") provides U.S. DOT drug and alcohol testing program administration, including random and consortium-style programs, program records, participation verification, compliance reports, collection-site coordination, and separate pre-employment testing. We also provide white-label back-office support and administration for other third-party administrators (TPAs).

This policy explains how information is handled in connection with our website, business communications, and those services. Unity is a third-party administrator, not a Medical Review Officer (MRO). Laboratories, collection facilities, MROs, employers, and other TPAs may have their own privacy notices and legal responsibilities.

When we process program information for an employer or TPA, our responsibilities also depend on the service agreement, the client's lawful instructions, and applicable law. A contract or this policy does not override employee rights or mandatory confidentiality requirements.

2. Information relevant to our services

Depending on your interaction with Unity and the agreed service, information may include:

• Business and inquiry details, such as name, company, work email, telephone number, and the information you provide when requesting a quote or contacting us.
• Program administration information, such as employer and participant identifiers, contact details, program rosters, selection and participation records, collection arrangements, and compliance documentation.
• Testing information that Unity is authorized to receive or maintain in its administrative role, including testing status and results where permitted. Medical review and clinical records are subject to the responsibilities of the relevant providers and applicable restrictions.
• Account, transaction, and correspondence information needed to administer the service relationship.
• Technical information associated with website use, such as IP address, browser and device information, request logs, and form-security information.

Information may come from you, your employer or its authorized representative, a client TPA, or testing-service participants authorized to provide it. Only information appropriate to the service and permitted by law should be supplied to Unity.

3. How information is used

Information is used to respond to inquiries, prepare quotes, administer agreed testing programs, maintain records, coordinate authorized program activities, provide participation verification and reports, support client accounts, protect systems, and meet applicable legal obligations.

Business contact information may also be used for updates you request. You may unsubscribe from marketing email using the instructions in the message. Necessary account, testing-program, or legal notices may continue where appropriate.

Using this website or acknowledging this policy is not a blanket authorization to disclose drug-test results, medical information, or protected health information.

4. DOT testing confidentiality

DOT testing information is subject to 49 CFR Part 40 and the applicable transportation agency's rules. Unity's receipt, use, maintenance, and disclosure of this information must follow the requirements that apply to service agents, including sections 40.321 and 40.351.

Individual test results and medical information may be transmitted as expressly permitted or required by the DOT rules. Other third-party disclosures require the employee's specific written consent unless a regulatory exception applies. A general website checkbox does not replace that consent, and blanket releases are not used to authorize disclosures prohibited by Part 40.

One employer's access to Unity's services does not entitle it to another employer's employee records. Requests from government agencies, parties to legal proceedings, or other recipients are subject to the applicable disclosure rules, including sections 40.323 and 40.331 where relevant.

5. HIPAA and health information

HIPAA's Privacy, Security, and Breach Notification Rules apply to covered entities and, for applicable duties, their business associates. HIPAA does not automatically apply to all information concerning a person's health or every employment drug test. Employment records held by an employer in its employment role generally are not protected health information under HIPAA.

Where Unity performs a function that makes it a business associate and handles protected health information, the applicable HIPAA requirements and required business associate agreement govern that work. Such an agreement defines authorized uses, disclosures, safeguards, reporting, and assistance with individual rights. This policy is not a substitute for a business associate agreement or a covered entity's Notice of Privacy Practices.

DOT-required testing disclosures must be evaluated under the applicable DOT rules and HIPAA provisions. We do not treat a website acknowledgment as a HIPAA authorization. Regardless of HIPAA's application to a particular record, applicable DOT confidentiality and other privacy requirements remain relevant.

6. Recipients and service providers

Information may be provided to authorized employer representatives, client TPAs, collection facilities, laboratories, MROs, and other program participants only as appropriate to the service and permitted by law. Service providers supporting hosting, communications, and business operations may process information needed for their authorized functions, subject to applicable contractual and legal restrictions.

Disclosure for legal compliance, a valid government request, or legal proceedings must satisfy the rules applicable to the information. A general business purpose does not authorize disclosure of confidential DOT testing records.

7. Website technology and cookies

The website uses hosted website and form functionality. Hosting and security providers may process technical information to deliver pages, manage requests, and help prevent abuse. Browser settings can restrict or delete cookies, although doing so may affect site functionality.

Contact us with questions about website technologies or your privacy choices.

Please do not put test results, medical details, Social Security numbers, or other sensitive participant information into the public contact form. Contact Unity to arrange an appropriate channel for service records.

8. Security, incidents, and Florida law

Florida's Information Protection Act, section 501.171, Florida Statutes, requires reasonable measures to protect covered personal information and governs applicable breach notifications and disposal obligations. DOT service-agent rules separately require safeguards for confidential employee records. HIPAA security and incident obligations apply where Unity acts in a covered role.

Unity will handle security incidents and provide required notices in accordance with the laws and contractual duties applicable to the incident. Notification timing and recipients depend on those requirements; a HIPAA deadline does not displace a shorter applicable state-law deadline. No website or transmission method can guarantee absolute security.

9. Retention

Program records must be retained for the periods required by applicable DOT and transportation-agency rules, including sections 40.333 and 40.351 where applicable. Retention varies by record category; one blanket period is not appropriate for all testing records.

Other information is retained as needed for the purpose for which it was collected, applicable legal obligations, and legitimate recordkeeping or dispute-resolution needs. Required records and information subject to a legal hold cannot be deleted simply because a service relationship ends or a deletion request is received. Information no longer required should be securely disposed of under applicable requirements.

10. Access, corrections, and privacy requests

You may contact Unity to ask about information relating to you, request a correction, or exercise a right available under applicable law. Identity and authority must be verified before sensitive records are released. Do not send sensitive verification documents through the public inquiry form.

For employee records covered by 49 CFR 40.329(a), service agents must provide the required copies within 10 business days after receiving the employee's written request, subject to that rule. Laboratory data-package requests follow the rule's separate process through the MRO. These direct DOT rights are not replaced by a general instruction to contact an employer.

Where Unity processes information for an employer, TPA, or HIPAA covered entity, it may coordinate with that organization to fulfill other requests as required. Any HIPAA access or amendment process depends on the relevant records, covered entity, and business associate arrangement.

State privacy rights depend on residency, the information, statutory coverage thresholds, and exemptions. Florida's Digital Bill of Rights does not automatically apply to every Florida business or employment record. Unity will assess requests under the law applicable to the request rather than promise rights or exemptions that do not apply.

11. Changes and contact

Last updated: September 28, 2026. Material changes will be communicated as required by applicable law. Changes cannot retroactively authorize a disclosure that requires separate consent.

For privacy questions or records requests, use our Contact Us form and include “Privacy request” in your message. Provide a reply email and a brief description of your request. Do not include sensitive records or verification documents in this public form. We will coordinate an appropriate channel when needed.

Contact Us form