Privacy policy
Last updated November 4, 2026
NEMT Pilot is a service run by Creative Lab 1 ("we", "us") for non-emergency medical transportation (NEMT) companies. This policy explains what information we handle, why, and how we protect it.
Who uses NEMT Pilot
Our customers are NEMT companies ("customer companies"). Their office staff sign in to the office screens, and their drivers use a driver page the company sends them a link to. Patients and riders don't use NEMT Pilot directly.
Information we collect
- Account information: name, email address and role of office staff. If you sign in with Google, we receive your name and email address from Google and nothing else. If you use a password, we store it only in scrambled (hashed) form.
- Company information: the company's name, settings, driver pay rules and, if the company connects it, its MediRoutes login, which we store encrypted.
- Trip and rider information: when a company connects MediRoutes, we read its trips, runs and trip statuses, which can include riders' names, addresses and appointment times. This is protected health information that we handle only on the company's behalf.
- Driver information: driver profiles and documents (such as licenses and certificates) that the company or the driver uploads. Documents are stored encrypted.
- Activity and security logs: sign-ins, failed sign-ins, changes made, and the internet address they came from.
How we use it
- To provide the service to the customer company: show its trips and runs, suggest assignments, calculate driver pay, and track driver documents.
- To keep accounts secure, investigate misuse, and keep a record of who did what.
- To contact company owners about their account and the service.
We don't sell personal information, and we don't use trip or rider information for advertising or for any purpose other than providing the service to the company it belongs to.
Health information (HIPAA)
For customer companies covered by HIPAA, we act as a business associate and handle rider information only under a business associate agreement (BAA) with that company. Each company's data is kept in its own separate database and is never shown to another company. Only the small Creative Lab 1 team that builds and supports NEMT Pilot can open a company's information, and only to build, fix and support the service. Every time they do, it's recorded in that company's activity log, which the company's owners can see.
Who we share it with
- Service providers that run the service for us, such as our cloud hosting provider (Amazon Web Services) and Google for "Sign in with Google". They may only use the information to provide their service to us.
- MediRoutes, only when a company connects its own MediRoutes account, to read that company's trips.
- When the law requires it, or to protect people's safety or our rights.
How we protect it
Connections use HTTPS. Office sign-in uses a password plus a code from a phone app, or Google. People are signed out after 30 minutes without use, and accounts lock after repeated wrong tries. Each company's data is kept apart, documents and MediRoutes logins are encrypted, and sign-ins and changes are logged.
How long we keep it
We keep a company's information while it uses NEMT Pilot. When a company leaves, we delete or return its information within a reasonable time, unless we must keep some of it by law or under its agreement with us.
Your choices
Office staff and drivers can ask their company to correct or remove their information. Company owners can contact us to get a copy of their company's information or to close their account.
Changes
If we change this policy, we'll update the date above and, for important changes, let company owners know.
Contact
Creative Lab 1, 201 W Ash Ave, Burbank, CA 91502, USA · 1saif.ayoob@gmail.com