Member Authorization and Consent

How to read this document

This is the authorization and consent text Valdura presents to a member during onboarding. It is written in plain language so a member can understand what they are agreeing to before they tap "I agree."

There are two parts:

• Part A is required. Valdura cannot operate the core service without it. You will be asked to agree to it once, during onboarding.
• Part B is optional. Each optional consent stands on its own. You can turn each one on or off at any time in Settings, and declining any of them does not affect the core service.

You must be 18 or older to use Valdura. Valdura is not for emergencies. If you are experiencing a medical emergency, call 911 or your local emergency number.

A note on language used below: "health information" means information about your health, your body, and your care, including the data you give us, the data we generate from it, and the data a connected device, a lab, or a company you connect, such as Avellum, sends us. "Subprocessors" means the vetted companies that operate parts of our technology on our behalf, each under a contract that legally binds them to protect your health information: a Business Associate Agreement (BAA) with our infrastructure vendors, with our AI provider, and with the email and phone vendors that carry the messages you send our support team. Valdura Health LLC is not a HIPAA covered entity; it protects your health information with safeguards modeled on HIPAA and relies on the privacy and security program of its affiliated shared-services company, Avellum Health Co LLC, under a written business associate and data protection agreement. The infrastructure-vendor and AI-provider BAAs, and the BAA for our phone line, are held by Avellum Health Co LLC; the BAA for our company email is held by Valdura with Google.

---

PART A. REQUIRED: Authorization for the Use and Disclosure of Health Information

You must agree to this to use Valdura. It is the permission that lets us provide the core service.

What you are authorizing

By agreeing below, you authorize Valdura Health to collect, use, store, and disclose your health information for the purpose of providing the Valdura service to you. In plain terms, this is the permission that lets the app do the job you signed up for: read your bloodwork and health data, give you AI-generated guidance, track your results over time, and route that work safely through the people and systems that make it possible.

What this covers

This authorization covers the health information you provide and the health information we generate while serving you, including:

• Your account and contact details (name, email, phone, date of birth, biological sex, and zip code).
• Your bloodwork and biomarker results.
• Self-reported health history, lifestyle information, and goals, and what you log day to day: meals, water, weight and body measurements, workouts, supplements, peptides and medications, symptoms, and your daily check-in.
• The cycle, fertility, pregnancy, and sexual-activity information you record. This is reproductive and sexual health information, and we treat it as a protected category.
• Health data from any wearable, health app, or phone health store you choose to connect under Part B, once it reaches us.
• Your conversations with the AI health assistant.
• Documents and photos you upload, such as lab PDFs and meal photos.
• The messages you send our support team, including a bug report or feature request you send from inside the app, and the transcript of any voicemail you leave on our support line.
• The questions you send to a live session or webinar.
• The answers you give to the medical questions for a treatment you buy from Crystal Clear RX, LLC in Valdura, the consents you sign with them, and the name you type to sign.
• Health information a company sends us at your direction: if you connect your Avellum account, the orders, visit status and signed medical intake answers Avellum Health, LLC sends us; and, if you buy a protocol membership from Crystal Clear, the medication and dates of the program you paid for.
• How you use the app, and the app installations we register so we can send you a notification.

This authorization lets us use that information to:

• Provide the service: explain your labs in plain language, generate personalized AI guidance, track your health over time, and surface relevant recommendations.
• Run AI inference securely: your data is processed by our AI on Anthropic's Claude API, in United States regions, using models that do not train on or share your data, under a Business Associate Agreement, and is retained by Anthropic only briefly (up to 30 days) before deletion. We do not use your health information to train AI models, and our AI provider does not either. If you connect your Avellum account, this includes your Avellum medical intake answers, unless you turn off "Let the assistant read these". It never includes the answers you give to the medical questions for a treatment you buy from Crystal Clear in Valdura. The AI does not make clinical decisions on its own.
• Involve a clinician only where a feature says so: the AI assistant provides general information and explanations. It is not medical advice and does not replace a licensed clinician, and you should consult your own clinician for medical decisions. Where a feature explicitly involves a clinician in our advisor network, this authorization lets us share the relevant parts of your health information with that clinician for that feature.
• Run the collection kit you register: when you register a kit, we send our lab partner your legal name, date of birth, biological sex, the code printed on your kit, the date and time you collected the sample if you told us, the test, and a patient code we create at random so the laboratory can keep your orders together, so that the laboratory can test your sample and our lab partner can return your results to us. Nothing is sent for a kit you have not registered, and nothing of yours reaches our lab partner until a written agreement covering your health information is in place with it.
• Send a treatment request you sign: when you buy a treatment from our affiliated company Crystal Clear RX, LLC in Valdura and sign the request, we send Crystal Clear your answers to the medical questions, the consents you signed, the state you are in, and your legal name, date of birth, sex at birth, email address, phone number and shipping address, so that it can pass them to the medical group whose licensed clinician decides whether the treatment is right for you. Nothing of your answers is sent for a request you have not signed.
• Operate and secure the platform: maintain the service, prevent and investigate security issues, and keep audit records of access to your health information.

Who may receive your health information under this authorization

To run the service, your health information is handled by a small set of subprocessors. Our infrastructure vendors (Vercel, Neon, and Paubox) each operate under a signed BAA held by Avellum Health Co LLC; our AI provider, Anthropic, operates under a signed BAA held by Avellum Health Co LLC too; and the two vendors that carry the messages you send our support team each operate under a signed BAA, Quo's held by Avellum Health Co LLC and Google Workspace's held by Valdura:

• Vercel (application hosting, including Blob object storage for the lab files and documents you upload).
• Neon (database).
• Anthropic (AI inference on the Claude API; United States regions; models that do not train on your data), under a Business Associate Agreement.
• Paubox (encrypted email).
• Google Workspace (company email: where a message you send to a Valdura address arrives and is kept).
• Quo (our support phone line: it holds the recording of a voicemail you leave and produces the transcript we keep on your ticket).

It may also be shared with the licensed-clinician advisor network, only where a feature explicitly involves a clinician, as described above, and with our lab partner, the company that arranges the laboratory testing of the sample from a collection kit, when you register a kit, as described above. Our affiliated companies receive only what our Privacy Policy and our Consumer Health Data Privacy Policy describe, to pack and ship your kit, to run a membership, price or credit you chose, to send a treatment request you sign, and to help answer your support messages; and, for a treatment request you sign, Crystal Clear passes it to the medical group that decides on it.

Apart from the collection kit you register, this authorization does not send your data to a lab, a wearable provider, or a recommendation partner. Those flows are covered separately in Part B, and only happen if you turn them on.

What we do not do

• We do not sell your personal or health information.
• We do not use third-party advertising trackers or third-party analytics trackers.
• We do not share your health information with our recommendation partners. When a partner recommendation is involved, the partner receives only a de-identified, per-click attribution token (and, on a link to Crystal Clear, whether you use Valdura in Spanish), never your health data and never a stable identifier that points back to you.

How long this authorization lasts

This authorization has no expiration date. It stays in effect while you have a Valdura account, until you revoke it or delete your account.

Your right to revoke

You can revoke this authorization at any time by emailing privacy@valdura.health or by deleting your account in the app. Revoking is easy, and we will not retaliate.

Please understand one practical consequence: because this authorization is what allows the core service to function, some or all service functions cannot continue without it. If you revoke it, we will stop the affected processing going forward and you may need to close your account. Revoking does not undo processing that already, lawfully, took place before we received your revocation. It also does not affect information we are required to retain by law (for example, a de-identified audit trail).

When you delete your account, your account closes right away and your account and the health information in it are permanently deleted within 31 days of your request. Our encrypted backups are overwritten within 35 days after that, and we ask the subprocessors and affiliated companies that hold copies of what you sent us to delete them, consistent with the Washington My Health My Data Act and similar consumer health-data laws. Some records are kept, including financial records of your payments, the consent to testing and the authorization you signed for each collection kit (kept ten years after your last kit order), and records the law requires others to keep, as our Privacy Policy describes, along with a de-identified audit trail.

Your rights over your information

Independent of revoking, you can at any time:

• Access your information and obtain a copy.
• Correct or amend information that is wrong.
• Export your data in a portable format.
• Opt out of marketing.
• Delete your account and data.

To make any of these requests, email privacy@valdura.health. This mailbox is also our Privacy Officer mailbox.

Required consent statements

When you join, you tick two boxes, and you need both to use Valdura. The first is your agreement to our Terms of Service and Privacy Policy. The second is this authorization, asked for on its own, apart from the Terms, because the Washington My Health My Data Act and Connecticut law ask for consent to collect and use health information separately from general terms. This is their wording in the Valdura app:

☑ I am 18 or older, and I agree to the Terms of Service and Privacy Policy.

☑ I consent to Valdura collecting and using my health information to provide the service, as the Health Information Authorization describes.

On the website the same two sentences link each document they name, and the second adds a link to our notice on how we protect your health information.

The second sentence is your agreement to Part A. It covers the uses and disclosures described in the sections of Part A above: providing the service, running AI inference through our AI provider, involving a clinician only where a feature says so, running a collection kit you register through our lab partner, sending a treatment request you sign to Crystal Clear, and operating and securing the platform, with your health information handled by the subprocessors named above under their Business Associate Agreements. It lasts, and can be revoked, as Part A describes.

---

PART B. OPTIONAL: Separate Consents You Control

Each of these is optional and separately revocable. Optional Consents 1 and 2 are switched off by default until you turn them on. Optional Consent 3 is a question the app asks you, and until you answer it the assistant can read the phone health data you connected, as explained there. Declining any of them does not affect your core Valdura service. You can change any of these at any time in Settings.

---

Optional Consent 1: Personalized marketing and recommendations

What this is

If you turn this on, Valdura can use your data, including your health information, to tailor the marketing messages and product recommendations you see, so they are relevant to your goals and results rather than generic. It never covers the data the Valdura app reads from Apple Health or Health Connect: that data is never used for marketing, whether this consent is on or off.

What it does and does not change

• This is about personalization. It does not change what we do with your data to run the core service, and it never authorizes us to sell your data or to hand your health data to a recommendation partner.
• When a recommendation routes to a partner (for example, the retail partner storefront tied to your membership for supplements; and, for peptide protocols, Avellum if you came to Valdura through Avellum or through our retail partner program, and otherwise Crystal Clear RX, LLC, at its own store or at the Crystal Clear storefront of the partner you joined through), the partner still receives only a de-identified, per-click attribution token, and a link to Crystal Clear also says when you use Valdura in Spanish. Turning this on does not change that. Partners never receive your health data or a stable identifier.

It is optional

This consent is optional. If you decline it, your core service is unaffected: you will still get AI guidance and plain-language explanations of your lab results. You will simply see less personalized marketing. You can also opt out of marketing entirely at any time, separate from this setting.

How to turn it on or off later

You can turn this on or off at any time in Settings, or by emailing privacy@valdura.health.

Consent statement

☐ I authorize Valdura to use my data, including my health information, to personalize the marketing messages and product recommendations I see. I understand this is optional, that it never covers data from Apple Health or Health Connect, that declining it does not affect my core service, that it never authorizes Valdura to sell my data or to share my health data with recommendation partners, and that I can turn it off at any time in Settings.

---

Optional Consent 2: Connecting devices, health apps, and your phone's health data, and ordering lab tests

What this is

If you turn this on, you direct Valdura to exchange your data with the specific third-party providers and sources you choose, so that:

• A wearable you connected with an account (an Oura ring or a Whoop band) can keep sharing your device data with Valdura under your authorization until our app update this month moves the connection to your phone's health app. Oura and Whoop are closed to new connections, and the direct Garmin connection has been removed;
• Your phone's own health store (Apple Health on an iPhone, Google Health Connect on an Android phone) can be read by the Valdura app, under the permission you grant on the phone, and sent to Valdura. There is no provider in the middle here: Apple and Google are not sent that data and get no access to your Valdura account. What your phone holds may have been written there by other apps and devices you use, such as a watch, a smart scale, a fitness or nutrition app, a glucose sensor, or a cycle-tracking app, and what we read includes that; and
• A lab partner you order a test through, if in-app lab ordering opens, can process that order and return your results to Valdura. The collection kit you register is not part of this consent: Part A covers it.

What a device, health app, or phone health store can send us. Sleep; heart and circulation data, including heart rate, heart-rate variability, blood pressure, blood oxygen, and respiratory rate, and the recovery, readiness, strain, or stress scores a provider calculates; activity, workouts, and fitness measures; body measurements and composition; cycle, fertility, and reproductive information, including period days and flow, spotting, ovulation and pregnancy test results, cervical mucus, basal body temperature, sexual activity, and menopausal state; blood glucose, food, nutrients, and water; mood, mindfulness, alcohol, and other substance use; symptoms, medications, and doses; coded findings a consumer device produces, such as sleep apnea events, an irregular heart rhythm notification, or an electrocardiogram classification, which are signals and not diagnoses; any notes or tags you wrote in that app; and the details that travel with a reading, including which app or device authored it and the identifier or email address a provider you sign in with uses for your account there. What actually arrives depends on the source and on what you allow, and some of it arrives only as we add support for it. We do not ask any source for the GPS route of a workout.

Reproductive and sexual health. Some of the above is reproductive and sexual health information, which the Washington My Health My Data Act and California law treat as a protected category, and so do we. When a sexual-activity log reaches us this way, we deliberately do not read whether contraception was used. You can decline this consent, or disconnect a source, and still log any of it by hand instead.

This is what makes connected-device and phone health tracking and lab ordering work. Each connection happens only when you initiate it, for the specific source you select, and under your direction.

What it does and does not change

• You are authorizing the flow of your data to and from the providers you choose. When you connect a device, the device provider shares your data with us; and when lab ordering opens and you place an order, the lab partner receives your order and sends back your results.
• Your connected-device login is protected on our side: we store device authorization tokens with field-level encryption (AES-256-GCM) and never expose them.
• Each provider also handles your data under its own terms and privacy policy once you connect to it. The companies that run Valdura itself, our hosting, database, AI, email, and phone vendors among them, are covered by the Business Associate Agreements Part A describes, held by Avellum Health Co LLC or by Valdura. A wearable or health app you connect is not one of those companies, and no such agreement covers it. That account is yours with that company. Your data reaches us because you told that company to release it to us, and what that company does with your data is governed by your relationship with it rather than by an agreement between it and us. Your phone's health store is different again: it is a store on your own device, Apple and Google are not sent your Valdura health data, and your relationship with them is governed by their terms rather than by any agreement with us.
• Ordering other lab tests through Valdura is not switched on yet. The collection kit you buy is run by our lab partner under Part A once you register it, and our Privacy Policy describes what that partner receives. Our rule for any lab is that it has to be under a written agreement covering your health information before anything of yours reaches it, and we will not open lab ordering to a lab that is not.
• This consent does not turn on personalized marketing. That is Optional Consent 1, controlled separately.

It is optional

This consent is optional. If you decline it, your core service is unaffected: you can still use the AI health assistant, upload your own lab PDFs, and enter your health information by hand. You simply will not have automatic device sync or in-app lab ordering until you turn it on.

How to turn it on or off later

You can connect or disconnect any individual device or lab partner at any time in Settings. Disconnecting stops future data exchange with that provider going forward. You can also withdraw this authorization entirely by emailing privacy@valdura.health.

Consent statement

☐ I authorize Valdura to exchange my data with the third-party providers and sources I choose to connect. I understand that if I connected an Oura ring or a Whoop band directly, which are now closed to new connections, that provider will share my device data with Valdura under my authorization until the connection moves to my phone's health app; that when I allow the Valdura app to read my phone's health store (Apple Health or Google Health Connect) the app will read the health data held there, which can include data other apps and devices wrote into it, and send it to Valdura; and that if I order a lab test through Valdura, the lab partner that handles it will process my order and return my results to Valdura. I understand that what these sources can send includes reproductive and sexual health information, such as my cycle, period, ovulation and pregnancy tests, and sexual activity, wherever I or another app have recorded it. I understand this is optional, that declining it does not affect my core service, that each provider also handles my data under its own terms, and that I can connect or disconnect any source at any time in Settings.

---

Optional Consent 3: Letting your assistant read your phone's health data

What this is

The Valdura app asks you: "Let your assistant read your health app data to answer you?" Your answer decides whether the AI assistant may read the health data Valdura brings in from your phone's health app (Apple Health on an iPhone, Health Connect on an Android phone). Your assistant is Claude, made by Anthropic, our AI provider under the Business Associate Agreement Part A describes. It reads that data to answer your questions and write your notes. Nothing is sold or used for ads.

What it does and does not change

• If you answer yes, the assistant can use that data in its answers, your daily note, your weekly recap and your plans.
• If you answer no, the assistant leaves that data out of all of them. Valdura still receives the data under Optional Consent 2, and your charts still show it.
• Until you answer, the assistant can read the phone health data you connected.
• Whatever you answer, the assistant never reads the blood glucose readings from your phone, and the AI does not use data from a direct Oura connection.
• Your answer does not change what any company other than our AI provider receives.

How to change it

You can change your answer at any time in Settings in the Valdura app, under "Let your assistant read your health app data". We keep a record of each answer and when you gave it.

---

Where these consents live and how to change them

• Part A (required) is captured once at onboarding and remains in effect until you revoke it or delete your account.
• Part B (optional) consents live in Settings, where you can turn each one on or off independently at any time. Optional Consents 1 and 2 are off by default; Optional Consent 3 follows the answer you give in the app.
• For anything else, including access, correction, export, deletion, or withdrawing an authorization, contact privacy@valdura.health. For general help, contact support@valdura.health. To report a security concern, contact security@valdura.health.

Valdura Health Website: www.valdura.health Privacy and data-rights requests: privacy@valdura.health