Notice of Privacy Practices
Effective date of this notice: 04/16/2020
If you have questions about this notice, please contact the Privacy Offer listed under Contact Us at the end of the notice.
THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Why do we collect information about you?
Clinical Reference Laboratory is a laboratory located in the United States specializing in clinical and toxicology testing for insurers, employers, as well as healthcare providers. We provide laboratory testing in support of corporate wellness programs, drugs of abuse testing programs, and insurance risk assessment.
What information do we collect about you?
We collect personal and health information (together, “information”) about you. “Personal information” is data which identifies, describes, is associated with, or could be linked to an individual, such as a name, birthdate, postal address, email address, telephone number, driver’s license, SSN or government issued identification number, as well as a computer’s IP address, photographs, a user’s biometric or geolocation information, or the like.
Personal information does not include anonymous or aggregated data that can no longer be used to identify a specific person, even if combined with other data. We also do not consider business information, such as a person’s business title, employer’s name, work email, work phone number, work address, and other similar information to be “personal information.”
In addition to your personal information, the health information you provide use may include your: height, weight, blood pressure, and medications. In addition, through testing of your sample, we obtain your laboratory test results.
We receive health information you provided on your consent form or chain of custody when you provide blood, urine, or saliva sample(s) for laboratory testing relating to your:
- Application for insurance;
- Employment/pre-employment drug testing;
- Participation in a pharmaceutical study;
- Participation in a corporate wellness program;
- Testing ordered by an authorized person.
How will we use information about you?
We may use your information (or disclose it) to:
- Provide laboratory testing services
- Seek payment for services
- Healthcare Operations
- Legal & Public Health Requirements
- Law Enforcement purposes;
- Worker’s Compensation;
- Work site safety laws (OSHA);
- To Report Abuse;
- Pursuant to proper authorization; or
- Health Benefits Information
We will only disclose as much information as is necessary to accomplish the described purpose.
Access to your information and correction
We may use or disclose your health information for any purpose that is listed in this notice without your written authorization. We will not use or disclose your health information for any other reason without your authorization. You have the right to:
1. Request for Restrictions on Use and Disclosure
You may not revoke an authorization for us to use and disclose your information to the extent that we have taken action in reliance on the authorization. If the authorization permits disclosure of your information to an insurance company, as a condition of obtaining coverage, other law may allow the insurer to continue to use your information to contest claims or your coverage, even after you have revoked the authorization. You have the right to ask us to restrict how we use or disclose your health information. We will consider your request. If we do agree, we will comply with the request unless the information is needed to provide you with emergency treatment. We cannot agree to restrict disclosures that are required by law. You have the right to request information not be provided to your health plan if you have paid for services in full.
2. Request to Confidential Communications
3. Request for Access and to receive a copy of your information
4. Request for Amendment of Information
5. Request for Accounting of Disclosures
6. To File a Complaint
Requests Regarding Your Personal Information
If you believe that the Personal Information that we have collected about you is incomplete, inaccurate, or not up to date, or if you would like to review and/or request changes or deletion of that information, please click on the hyperlinks listed above to complete the form or email Privacy@crlcorp.com.
If you do not consent or want to withdraw your consent for us to collect, use, or disclose your Personal Information as described in this Policy, please click on the hyperlink in number 1 listed above to complete the form or email Privacy@crlcorp.com. In your request, please identify the Personal Information at issue and the collection, use, or disclosure you wish to stop.
Denying or withdrawing consent may not allow us to provide you with some or all of the products, services, or information you request.
You may opt-out of receiving marketing-related emails by clicking the “unsubscribe” link at the bottom of any email you receive from us or emailing us at Privacy@crlcorp.com. If you are having difficulty unsubscribing from our marketing communications, please contact us at [compliance@crlcorp.com] or [866-924-5267].
If you opt-out from receiving marketing emails or text messages, we may still need to send you communications about your account, orders, customer service inquiries, and other matters.
If you agreed to receive future marketing communications directly from a third party through our Site, you will need to contact that party to opt-out of such communications. This process may be outlined on that party’s privacy policy.
Sharing Your Personal Information
As a general rule, other than as detailed in this Policy, we do not sell any information we collect from you. Similarly, other than as disclosed in this Policy, we will not disclose any of your information except when we have your permission or under special circumstances, such as when we believe in good faith that the law requires it or under circumstances described in this Policy. For instance, we may share your personal information in the following circumstances:
We may provide your personal information to our partners to assist us in operating this site and transacting business and communicating with you. When we do so, we will exercise reasonable care to ensure that such partners are prohibited from using that information for any other reason and that it is maintained securely and privately.
We may disclose your personal information if we determine that disclosure is reasonably necessary to enforce our contracts, this Privacy Policy or to otherwise protect our operations, clients or users.
We may release your personal information to others (including law enforcement) if we believe such release is reasonably necessary to comply with the law or legal process; enforce or apply the terms of applicable terms of use; detect, prevent, or otherwise address fraud, security or technical issues; or otherwise protect the rights, property or safety of others.
We may sell, transfer and/or disclose your personal information as part of a business divestiture, sale, merger, or acquisition of all or a part of our business. If another company acquires our company, business, or assets, that company will possess the personal information collected by us and will assume the rights and obligations regarding your personal information as described in this Privacy Policy. In the event of an insolvency, bankruptcy, or receivership, your personal information may also be transferred as a business asset.
In addition, we may share aggregate, non-individual information, incapable of identifying a particular person, with third parties for lawful purposes.
California Privacy Rights
If you are a California resident, you may have certain rights with respect to your personal information including the following rights:
- the right to know, by way of our Privacy Policy and any specific inquiries you direct to us, where personal information we have about you comes from, what we use that information for, whether it is being disclosed or sold, and to whom it is being disclosed or sold;
- the right to “opt-out” of our sale of your personal information to any third parties;
- the right, with some exceptions, to have your personal information deleted from our possession or control; and
- the right to receive equal service and pricing from us even if you exercise any of your privacy rights.
California Civil Code Section 1798.83 permits users of the Site who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, or if you have any questions or concerns about your California privacy rights, our Privacy Policy or our use of your personal information, please complete one of the forms available above in the section titled REQUESTS REGARDING YOUR HEALTH INFORMATION, send an e‐mail to Privacy@crlcorp.com, or write us at:
Clinical Reference Laboratory, Inc.
Attn: CRL Privacy Officer – California Privacy Rights
8433 Quivira Road
Lenexa, KS 66202
For all California residents, any such inquiries shall be responded to within forty-five (45) days and at no cost to you.
European Privacy Rights
If you are an EU resident, you are afforded certain rights regarding your personal information. Specifically, EU law provides that EU residents have the following rights:
- The right to be informed about what happens with your Personal Data (information relating to an identified or identifiable natural person), including how it is collected from you, how it is used as well as the right to access that Personal Data, to modify it when it is incomplete or incorrect, and the right to withdraw consent for its use;
- The right to access Personal Data held by organizations about an individual;
- The right to rectification allowing individuals to correct inaccurate information or complete incomplete information;
- The right to erasure (or the right to be forgotten) allowing, with some exceptions, an individual to have their Personal Data deleted upon request;
- The right to restriction and withdraw consent for data processing;
- The right to data portability allowing individuals to ask for the transfer of their Personal Data or to obtain and use their Personal Data for their own purposes;
- The right to object, with some exceptions, to the processing of an individual’s Personal Data;
- The right to prevent automated decision making or profiling and to require that those decisions be made by natural persons.
If you have questions or concerns about these rights and how they relate to this Privacy Policy or the Site, please direct your inquiries to Privacy@crlcorp.com or write us at:
Clinical Reference Laboratory, Inc.
Attn: CRL Privacy Officer – European Privacy Rights
8433 Quivira Road
Lenexa, KS 66202
Storage and Transfer of Your Information
We will retain your information in accordance with applicable law or contract as is required.
We may maintain your information on computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.
We process data in the United States. We transfer your personal data out of the European Union only with your consent or to perform a contract with you, and consistent with the practices described in this Privacy Policy.
Further, CRL is compliant with the EU-US Privacy Shield and performs any and all transfers in compliance with the requirements of the EU-US Privacy Shield. You may find our Privacy Statement at: http://crlcorp.com/privacy-shield/
In pharmaceutical testing we may transfer your sample to a third country for testing to a CRL partner regional lab. Your personal data is de-identified unless the personal data is needed as part of the study. If personal data is needed, it will only be transferred in accordance with appropriate safeguards which meet the General Data Protection Regulation requirements and those under the EU-US Privacy Shield.
Changes to our privacy policy
We reserve the right to change our privacy practices, as described in this notice, at any time. We reserve the right to apply these changes to any health or personal information which we already have, as well as to health or personal information we receive in the future. Before we make any change in the privacy practices described in this notice, we will post a new notice with the changes at www.crlcorp.com/notice-of-privacy-practices. The new notice will include an effective date.
File a Complaint or Contact Us
For more information about this notice, our privacy policies, to exercise any of your rights, as listed on this notice, or if you want to request a hardcopy of our current notice of privacy practices, contact:
Clinical Reference Laboratory, Inc.
Attn: Privacy Officer
8433 Quivira Road
Lenexa, KS 66215
913-492-3652
privacy@crlcorp.com
In the United States, you may also file a complaint directly with the:
Secretary – U.S. Department of Health and Human Services
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201
In the European Union, you may also file a complaint with the Supervisory Authority in the Member State where you live.