Privacy

Records about the people being transported — names, addresses, appointment times, and the trips themselves — belong to the transport company, not to ProveTrip. We hold them on that company’s behalf as a business associate under HIPAA, and what we may do with them is set by the business associate agreement each company accepts before its account opens, not by this page. We do not sell that information, use it for advertising, or use it to train models.

Information about the people using the software — drivers, dispatchers, owners — is described below. That is what a driver installing the app is agreeing to.

• Location at each recorded moment. A position is taken when a driver marks an arrival, a pickup, a drop-off, or a no-show. That fix is the evidence the trip happened where and when it is claimed to have happened, which is the point of the product.
• Location during a trip, including when the app is closed or not in use — but only while a trip is actually running, and only where the driver has agreed to it. Reporting starts when a driver begins a trip and stops when the trip closes. Between trips, before a shift, after the last drop-off and on a day off, no position is recorded at all.
  This is used for two things and nothing else: so a dispatcher can see where a vehicle is and tell a member when their ride will arrive, and so the distance actually driven can be measured when a payer’s mileage figure is disputed. It is never used to monitor a driver outside working hours, and the system is built so that it cannot be — a recorded position has to belong to a trip, so one taken outside a trip does not exist to be looked up.
  A driver is asked before this is ever switched on, in the app, in plain words, with declining offered as plainly as agreeing. A driver who declines keeps full use of the app and their employer still sees every pickup and drop-off they record. Permission can be withdrawn at any time in the phone’s own settings, and the app stops reporting immediately. These trails are deleted after 90 days.
• Photographs a driver chooses to take, to document a no-show or an incident. The camera is opened only when a driver taps to use it.
• A signature captured on the screen where a trip requires one.
• Sign-in details — the email address the employer registered, and a label for the handset (“Emy’s iPhone”) so an owner revoking a lost phone can tell one device from another.
• A push notification token, if notifications are allowed, so schedule changes reach the driver.

Trip events are queued on the device when there is no signal and sent when there is. Nothing else is collected: no contacts, no browsing, no advertising identifier, no microphone.

Every time a member’s record is opened, exported, or changed, the software writes an entry naming who did it, when, and from what address. That log exists because HIPAA requires it and because an owner asking “who looked at this?” deserves an answer. It cannot be edited or deleted by the software that writes it.

Sign-in attempts are recorded the same way, including failures, because repeated failures against one account is what a break-in looks like from the inside.

ProveTrip runs on Amazon Web Services in the United States, under a business associate agreement with AWS. AWS provides the databases, file storage, sign-in, and email delivery the product is built on.

Push notifications are delivered through Expo and the platform notification services operated by Apple and Google. A notification carries a driver’s schedule change, never a member’s name or address.

Nothing is sold. Nothing is shared with advertisers or data brokers. Information is disclosed to anyone else only where the law requires it, or where the transport company that owns the records instructs us to.

Trip records and their evidence are kept for as long as the transport company holds an account, and afterwards for the period its business associate agreement specifies — claims are disputed and audited long after a trip is over, and a record deleted early is a payment that can no longer be defended.

A driver who leaves has their access switched off. Their name stays on the trips they drove, because removing it would falsify the record of who provided the service.

Location and camera permissions can be refused or withdrawn at any time in the phone’s settings. Refusing them does not lock a driver out of the app; it means the trips they complete carry less evidence, which their employer may ask about.

A driver or dispatcher who wants to see or correct what is held about them should ask their employer, who controls the account. Where a request concerns a member rather than an employee, it goes to the transport company, which is the covered entity and the only party that can answer it.

Anyone who uses this software — a driver, a dispatcher, an owner — can ask for the information held about them to be deleted. Ask your employer, who controls the account and can do it directly, or write to vince@vincesystems.com and we will action it with them. No account can be created here in the first place, which is why there is no button for this: your employer made the account, and your employer can remove it.

Two things survive that request, and it is fairer to say so than to discover it later. A driver’s name stays on the trips they drove, because removing it would falsify the record of who provided the service somebody was billed for. And the audit log keeps its entries, because a record of who opened a member’s file is not something the software that wrote it is allowed to edit — that is the property that makes it worth having.

Where the request concerns a member rather than an employee, it goes to the transport company that arranged the ride. They hold those records; we hold them on that company’s behalf and cannot delete them on our own initiative.

Who we text. Only drivers at a transport company that uses ProveTrip, and only about their own work. We do not text the people being transported, and we never send marketing by text.

What the messages say. A daily message listing how many trips a driver has and the pickup times, and a message when a trip is added or changed during the day. They look like this:

ProveTrip: 3 trips Sep 25: 8:15 AM, 11:00 AM, 2:30 PM. https://provetrip.com/my-trips Reply STOP to stop.

The details are deliberately not in the message. No member is named, no address and nothing about anybody’s health — that sits behind a sign-in, so a phone left on a passenger seat does not show a patient’s name on its lock screen.

How a number gets here. A driver’s own employer enters it when setting them up to receive work, and is told on that screen to add it only if the driver has agreed to be texted. Drivers who use the app get the same information as a notification and no text at all.

Stopping them. Reply STOP to any message and they end immediately. Reply HELP for help. A driver can also ask their employer to remove the number, which has the same effect. Stopping texts does not affect their account or their work — they still see every trip when they sign in.

Cost and frequency. Message and data rates may apply. Volume follows how much a driver is working: typically one message a day, plus one for each same-day change.

The software is used by transport company employees at work and is not directed at children. Members being transported may be of any age; their records are held for the transport company under the agreement described above.

Questions about this page, or about a specific record, can go to vince@vincesystems.com. A member of the public asking about their own transport records will be directed to the transport company that arranged the ride, because that company holds them and we do not decide what happens to them.