Member Authorization and Consent

Valdura Health (a limited liability company) Product brand: Valdura

Last updated: July 24, 2026.

How to read this document

This is the authorization and consent text Valdura presents to a member during onboarding. It is written in plain language so a member can understand what they are agreeing to before they tap "I agree."

There are two parts:

Part A is required. Valdura cannot operate the core service without it. You will be asked to agree to it once, during onboarding.
Part B is optional. Each optional consent stands on its own. You can turn each one on or off at any time in Settings, and declining any of them does not affect the core service.

You must be 18 or older to use Valdura. Valdura is not for emergencies. If you are experiencing a medical emergency, call 911 or your local emergency number.

A note on language used below: "health information" means information about your health, your body, and your care, including the data you give us, the data we generate from it, and the data a connected device or lab sends us. "Subprocessors" means the vetted companies that operate parts of our technology on our behalf, each under a contract that legally binds them to protect your health information: a Business Associate Agreement (BAA) with our infrastructure vendors and with our AI provider. Valdura Health LLC is not a HIPAA covered entity; it protects your health information to HIPAA-grade standards and relies on the HIPAA compliance program of its affiliated company, Crystal Clear RX Wellness LLC, under a written intercompany services agreement. The infrastructure-vendor and AI-provider BAAs are held by Crystal Clear RX Wellness LLC.

PART A. REQUIRED: Authorization for the Use and Disclosure of Health Information

You must agree to this to use Valdura. It is the permission that lets us provide the core service.

What you are authorizing

By agreeing below, you authorize Valdura Health to collect, use, store, and disclose your health information for the purpose of providing the Valdura service to you. In plain terms, this is the permission that lets the app do the job you signed up for: read your bloodwork and health data, give you AI-generated guidance, track your results over time, and route that work safely through the people and systems that make it possible.

What this covers

This authorization covers the health information you provide and the health information we generate while serving you, including:

Your account and contact details (name, email, phone, date of birth, biological sex, and zip code).
Your bloodwork and biomarker results.
Self-reported health history, lifestyle information, and goals.
Your conversations with the AI health assistant.
Documents and photos you upload, such as lab PDFs and meal photos.
How you use the app.

This authorization lets us use that information to:

Provide the service: interpret your labs, generate personalized AI guidance, track your health over time, and surface relevant recommendations.
Run AI inference securely: your data is processed by our AI on Anthropic's Claude API, in United States regions, using models that do not train on or share your data, under a Business Associate Agreement, and is retained by Anthropic only briefly (up to 30 days) before deletion. The AI does not make clinical decisions on its own.
Obtain licensed-clinician review: any AI output that is prescription-adjacent or care-plan-changing is reviewed by a licensed clinician in our advisor network before it reaches you and before you act on it. This authorization lets us share the relevant parts of your health information with that clinician for that review.
Operate and secure the platform: maintain the service, prevent and investigate security issues, and keep audit records of access to your health information.

Who may receive your health information under this authorization

To run the service, your health information is handled by a small set of subprocessors. Our infrastructure vendors (Vercel, Neon, and Paubox) each operate under a signed BAA held by Crystal Clear RX Wellness LLC; our AI provider, Anthropic, operates under a signed BAA held by the same program too:

Vercel (application hosting, including Blob object storage for the lab files and documents you upload).
Neon (database).
Anthropic (AI inference on the Claude API; United States regions; models that do not train on your data), under a Business Associate Agreement.
Paubox (encrypted email).

It is also shared with the licensed-clinician advisor network for the clinical review described above.

This authorization does not by itself send your data to a lab, a wearable provider, or a recommendation partner. Those flows are covered separately in Part B, and only happen if you turn them on.

What we do not do

We do not sell your personal or health information.
We do not use third-party advertising trackers or third-party analytics trackers.
We do not share your health information with our recommendation partners. When a partner recommendation is involved, the partner receives only a de-identified, per-click attribution token, never your health data and never a stable identifier that points back to you.

How long this authorization lasts

This authorization has no expiration date. It stays in effect while you have a Valdura account, until you revoke it or delete your account.

Your right to revoke

You can revoke this authorization at any time by emailing privacy@valdura.health or by deleting your account in the app. Revoking is easy, and we will not retaliate.

Please understand one practical consequence: because this authorization is what allows the core service to function, some or all service functions cannot continue without it. If you revoke it, we will stop the affected processing going forward and you may need to close your account. Revoking does not undo processing that already, lawfully, took place before we received your revocation. It also does not affect information we are required to retain by law (for example, a de-identified audit trail).

When you delete your account, we honor it without undue delay and within 30 calendar days. We permanently purge your account after a 30-day grace window, including from backups, and we push the deletion to our subprocessors, consistent with the Washington My Health My Data Act and similar consumer health-data laws. We retain only a de-identified audit trail.

Your rights over your information

Independent of revoking, you can at any time:

Access your information and obtain a copy.
Correct or amend information that is wrong.
Export your data in a portable format.
Opt out of marketing.
Delete your account and data.

To make any of these requests, email privacy@valdura.health. This mailbox is also our Privacy Officer mailbox.

Required consent statement

☑ I am 18 or older, and I authorize Valdura Health to collect, use, store, and disclose my health information to provide the Valdura service to me. I understand this includes processing by Valdura's subprocessors (Vercel, Neon, Paubox, and Anthropic, our AI provider, under signed Business Associate Agreements) and review of clinical-adjacent AI output by Valdura's licensed-clinician advisor network. I understand this authorization has no expiration date, that it lasts until I revoke it or delete my account, that I can revoke it at any time by emailing privacy@valdura.health, and that some or all service functions cannot continue without it.

PART B. OPTIONAL: Separate Consents You Control

Each of these is optional and separately revocable. They are switched off by default until you turn them on. Declining any of them does not affect your core Valdura service. You can change any of these at any time in Settings.

Optional Consent 1: Personalized marketing and recommendations

What this is

If you turn this on, Valdura can use your data, including your health information, to tailor the marketing messages and product recommendations you see, so they are relevant to your goals and results rather than generic.

What it does and does not change

This is about personalization. It does not change what we do with your data to run the core service, and it never authorizes us to sell your data or to hand your health data to a recommendation partner.
When a recommendation routes to a partner (for example, the retail partner storefront tied to your membership for supplements, or Avellum for peptide protocols), the partner still receives only a de-identified, per-click attribution token. Turning this on does not change that. Partners never receive your health data or a stable identifier.

It is optional

This consent is optional. If you decline it, your core service is unaffected: you will still get AI guidance, lab interpretation, and clinician-reviewed output. You will simply see less personalized marketing. You can also opt out of marketing entirely at any time, separate from this setting.

How to turn it on or off later

You can turn this on or off at any time in Settings, or by emailing privacy@valdura.health.

Consent statement

☐ I authorize Valdura to use my data, including my health information, to personalize the marketing messages and product recommendations I see. I understand this is optional, that declining it does not affect my core service, that it never authorizes Valdura to sell my data or to share my health data with recommendation partners, and that I can turn it off at any time in Settings.

Optional Consent 2: Connecting wearable devices and ordering lab tests

What this is

If you turn this on, you direct Valdura to exchange your data with the specific third-party providers you choose, so that:

A wearable device you connect (Oura, Whoop, or Garmin) can share your device data (such as sleep, heart rate, HRV, and activity) with Valdura under your authorization, and
A lab partner you order through (Quest, Labcorp, or Getlabs) can process your lab order and return your results to Valdura.

This is what makes connected-device tracking and lab ordering work. Each connection happens only when you initiate it, for the specific provider you select, and under your direction.

What it does and does not change

You are authorizing the flow of your data to and from the providers you choose. When you connect a device, the device provider shares your data with us; when you order labs, the lab partner receives your order and sends back your results.
Your connected-device login is protected on our side: we store device authorization tokens with field-level encryption (AES-256-GCM) and never expose them.
Each provider also handles your data under its own terms and privacy policy once you connect to it. Lab partners and wearable providers that handle your health information for Valdura do so under a signed BAA.
This consent does not turn on personalized marketing. That is Optional Consent 1, controlled separately.

It is optional

This consent is optional. If you decline it, your core service is unaffected: you can still use the AI health assistant, upload your own lab PDFs, and enter your health information by hand. You simply will not have automatic device sync or in-app lab ordering until you turn it on.

How to turn it on or off later

You can connect or disconnect any individual device or lab partner at any time in Settings. Disconnecting stops future data exchange with that provider going forward. You can also withdraw this authorization entirely by emailing privacy@valdura.health.

Consent statement

☐ I authorize Valdura to exchange my data with the third-party providers I choose to connect. I understand that when I connect a wearable device (Oura, Whoop, or Garmin) that provider will share my device data with Valdura under my authorization, and that when I order lab tests (through Quest, Labcorp, or Getlabs) that lab partner will process my order and return my results to Valdura. I understand this is optional, that declining it does not affect my core service, that each provider also handles my data under its own terms, and that I can connect or disconnect any provider at any time in Settings.

Where these consents live and how to change them

Part A (required) is captured once at onboarding and remains in effect until you revoke it or delete your account.
Part B (optional) consents are off by default and live in Settings, where you can turn each one on or off independently at any time.
For anything else, including access, correction, export, deletion, or withdrawing an authorization, contact privacy@valdura.health. For general help, contact support@valdura.health. To report a security concern, contact security@valdura.health.

Valdura Health Website: www.valdura.health Privacy and data-rights requests: privacy@valdura.health