Privacy Policy

Last Updated: October 26, 2026 Effective Date: October 26, 2026

At Express Lab, we are committed to protecting your privacy. This Privacy Policy (“Policy”) explains how we collect, use, disclose and protect personal information when you visit our website, www.expresslabidaho.com (the “Site”). We follow the privacy laws that apply to us, including applicable U.S. federal and state laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

By using the Site, you agree to the collection and use of information in accordance with this Policy.

1. Introduction and Scope

This Policy applies to personal information that Express Lab collects through the Site. It does not apply to protected health information that we handle in providing healthcare services, which is protected under HIPAA and other applicable law.

Our contact details: Express Lab, 3910 Washington Parkway, Idaho Falls, Idaho 83404. Phone: 208-529-8330. Email: voncrofts@idahomed.com.

Privacy contact: Von Crofts, Privacy Officer, 208-523-1122 ext. 622, voncrofts@idahomed.com.

We encourage you to read this Policy carefully to understand our practices regarding your information.

2. Information We Collect

We collect only the information we need for the purposes described in this Policy.

2.1 Information You Give Us

When you complete a form on the Site, we receive what you type into it. Depending on the form, this can include:

• Identifiers and contact details: name, business or office name, email address, phone and fax numbers, mailing address, and your preferred time to call.
• Business and ordering details: billing preference, anticipated start date, standard work days and hours, specimen pick-up locations, and supply or kit quantities.
• Communications: anything you add in a notes or message field.

We use forms for physician inquiries and sign-ups, corporate wellness and saliva drug test sign-ups, health fair requests, and supply orders from client facilities. Submissions are delivered to our staff by email or to our internal ordering system. They are not stored on the Site.

2.2 Usage Data

When you visit the Site, we and our service providers automatically receive limited technical information, including:

• Device information: IP address, browser type and version, operating system.
• Usage patterns: pages visited, time spent on pages, the page that referred you, and the date and time of your visit.
• Location data: general location (such as city) derived from your IP address. We do not collect precise location.

2.3 Sensitive Personal Information

We do not intentionally collect sensitive personal information, including health information, through the Site. Please do not include medical or health details, Social Security numbers or payment card numbers in website forms or emails to us.

2.4 Cookies and Tracking Technologies

The Site uses the following:

• Google Analytics 4: uses cookies and similar technology to report how visitors use the Site, such as pages viewed, approximate location, device type and how a visitor found us. It loads only if you accept analytics on our cookie banner, and never if your browser sends a Global Privacy Control signal. Analytics data is kept for the retention period set in our analytics account.
• Cloudflare Web Analytics: gives us aggregate page-view and performance statistics. It does not use cookies and does not track individual visitors across sites.
• Cloudflare Turnstile: protects our forms from automated abuse. It may check characteristics of your browser to tell people from bots.
• Content from other providers: the Site loads content from other companies, including Google Maps and YouTube (embedded maps and a video), Cloudinary (images), Google Sheets (the clinical test directory), ShareFile (a secure file-exchange embed), and code libraries delivered from content-delivery networks (jQuery, DataTables, Bootstrap and Font Awesome). When your browser loads this content, the provider receives your IP address and may set its own cookies. Videos from YouTube are governed by YouTube's own privacy policy.
• Server logs: our hosting provider automatically records standard technical information about each request to keep the Site secure and working.

Your choices. When you first visit, a banner asks whether you accept analytics cookies. We remember your choice in a first-party cookie that lasts 12 months, after which we ask again. This cookie records only your choice and the date, and it is necessary for the banner to work. You can change your choice at any time using the “Your Privacy Choices” link in the page footer. If your browser sends a Global Privacy Control signal, we treat it as a decline and do not load Google Analytics. You can also block or delete cookies in your browser settings, though some features may not work as expected.

3. How We Use Your Information

We use the information we collect to:

• provide and maintain the Site and respond to your inquiries, sign-ups, requests and orders;
• understand how the Site is used so we can improve it;
• keep the Site secure and detect and prevent fraud, abuse and technical problems; and
• meet our legal and regulatory obligations.

We do not use the Site for targeted advertising.

4. How We Share Your Information

We may share personal information with third parties in the circumstances below, with appropriate safeguards in place.

4.1 Service providers. We use companies that help us run the Site and handle your requests. They may access personal information only to perform these tasks for us and may not use it for other purposes. These include Cloudflare, Inc. (hosting, security, form delivery and aggregate analytics), Google (analytics, fonts, maps and video), the email providers that deliver form submissions to our staff, and the messaging and ordering systems we use to process requests.

4.2 No sale of personal information. We do not sell your personal information.

4.3 Business transfers. If Express Lab is involved in a merger, acquisition or asset sale, personal information may be transferred. We will give notice before it becomes subject to a different privacy policy.

4.4 Legal requirements. We may disclose personal information if we believe in good faith that it is necessary to comply with a legal obligation (such as a subpoena or court order), protect the rights, property or safety of Express Lab, our users or the public, or prevent or investigate wrongdoing.

4.5 With your consent. We may share personal information for any other purpose with your explicit consent.

4.6 Aggregated or de-identified data. We may share information that has been aggregated or de-identified and cannot reasonably be used to identify you.

5. Where Information Is Processed

Express Lab is based in the United States, and we process information in the United States. Some of our service providers may process information in other countries. By using the Site, you understand that your information may be transferred to and processed in the United States and elsewhere.

6. Data Security and Retention

6.1 Data security. We use reasonable technical and organizational measures to protect personal information from unauthorized access, alteration, disclosure or destruction, including:

• Encryption: the Site is delivered over HTTPS (SSL/TLS), and we instruct browsers to use only HTTPS.
• Access controls: access to personal information is limited to authorized personnel.
• Data minimization: we collect only the information we need.

No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security.

6.2 Data retention. We keep personal information only as long as necessary for the purposes in this Policy, unless a longer period is required or permitted by law. Form submissions and the email copies of them are kept only as long as needed to respond to you and keep our records. When we no longer need personal information, we securely delete or anonymize it.

7. Your Privacy Rights

Depending on where you live, you may have rights under state privacy laws, including California’s CCPA/CPRA and other state privacy laws that apply to us.

7.1 Your Rights

• Right to know and access: you may ask what personal information we have collected about you, the sources and purposes, the categories of third parties we disclose it to, and for a copy of it.
• Right to correct: you may ask us to correct inaccurate personal information.
• Right to delete: you may ask us to delete personal information, subject to legal exceptions.
• Right to opt out: you may opt out of the sale or sharing of personal information for cross-context behavioral advertising. We honor Global Privacy Control signals as an opt-out request.
• Right to limit sensitive personal information: you may ask us to limit use of sensitive personal information to what is necessary. We do not use sensitive personal information for other purposes.
• Right to non-discrimination: we will not discriminate against you for exercising your rights.

7.2 How to Exercise Your Rights

Contact us at voncrofts@idahomed.com or 208-529-8330. We may need to verify your identity before we act on a request. We respond within the time required by applicable law (45 days under the CCPA). You may exercise your rights free of charge unless a request is manifestly unfounded or excessive.

8. Children’s Privacy

The Site is not directed to children under the age of 13, and we do not knowingly collect personal information from them.

If you are a parent or guardian and believe your child has given us personal information, please contact us. If we learn that we have collected personal information from a child without verifiable parental consent, we will delete it.

9. Links to Other Websites

The Site contains links to websites we do not operate. If you follow a link, you go to that site, which has its own privacy practices. We encourage you to review the privacy policy of every site you visit. We do not control and are not responsible for the content or privacy practices of other sites.

10. Changes to This Privacy Policy

We may update this Policy from time to time. We will post the updated Policy on this page and change the “Last Updated” date at the top. We review this Policy at least once a year. Changes are effective when posted, and we encourage you to review this page periodically.

11. Complaints

If you have concerns about our privacy practices, please contact us using the details in Section 1. California residents may also contact the California Attorney General or the California Privacy Protection Agency.