Consumer Health Data Privacy Policy

Consumer health data we collect

Consumer health data is information that identifies you, or could reasonably be linked to you, and is about your past, present or future physical or mental health. What we collect includes:

• Bloodwork and biomarker results: results from a collection kit you buy and register, lab reports you upload, and where your kit and your sample are on the way to the laboratory.
• Data from your phone's health app: what Apple Health or Health Connect holds and you let the Valdura app read. It can include sleep, heart and circulation, activity and workouts, body measurements, cycle and reproductive information, blood glucose, food and nutrients, mood, mindfulness and substance use, symptoms and medications, findings a consumer device produces, and notes you wrote in another app.
• Data from an Oura ring or a Whoop band you connected directly. Oura and Whoop are closed to new connections. A connection you already made keeps syncing until our app update this month moves it to your phone's health app. The direct Garmin connection has been removed.
• Reproductive and sexual health information: your cycle, period days and flow, spotting, ovulation and pregnancy test results, cervical mucus, basal body temperature, a pregnancy you record, menopausal state, and the fact that you logged sexual activity.
• What you tell us about your health: your health history, conditions, allergies, family history and goals, and what you log day to day, such as meals, water, weight, workouts, supplements, peptides and medications, symptoms, and your daily check-in.
• Your conversations with the AI assistant, and the documents and photos you upload, such as lab reports and meal photos.
• What you write to our support team, including the transcript of a voicemail you leave.
• Posts you choose to publish in the member community.
• Information that says something about your health because of where it sits: your name, email address, date of birth and sex on a health account; the collection kit you buy; a membership tied to an affiliated company; and whether you pay one of our affiliated companies for a peptide protocol, which reaches us so that a membership credit can apply.

Why we collect and use it

• To provide the service you asked for: the assistant and its notes, recaps and plans; reading your results back to you and tracking them over time; running and shipping the collection kit you buy; and the membership, price or credit you chose.
• To answer you when you write or call our support team.
• To keep the service safe and working: security, fraud prevention, troubleshooting, audit logs, and meeting our legal obligations.
• Personalized marketing, only if you turn it on. It is Optional Consent 1 in our Member Authorization, and it is off until you turn it on.

If we de-identify consumer health data, we keep it de-identified and do not try to identify anyone from it.

Where it comes from

• From you, in the app, on the website, in a message to us, or in a call.
• From your phone's health app, when you let the Valdura app read it, and from Oura or Whoop, for a direct connection you already made. Both are closed to new connections.
• From our lab partner, which tells us where your kit and sample are, and your results.
• From our affiliated companies, for a membership, price, credit or kit you chose. Crystal Clear RX, LLC sends us, among other things, your email address, your name, its own identifier for you, your group with it (for example a member, a sales representative, or staff), the storefront your membership came through, and the order for a collection kit you buy on one of its storefronts. Avellum Health, LLC sends us, among other things, your email address, its own reference for you, whether you pay it for a peptide protocol, whether your partner program account qualifies for the member price and when that was confirmed, whether you have earned free time, and the order details for a blood panel you buy through it. Precision Pharma Corp tells us when your kit ships, with the codes printed on the kits in the box.
• From a partner program you choose to link, which tells us whether your account there is active and qualifies for its member price, and when it checked. That is about your account there, not your health.

We do not buy consumer health data, and we receive none from data brokers, advertising networks or social networks.

Consumer health data we share

The categories of consumer health data we share are the categories listed above. Each recipient gets only the part it needs for its job, as described below.

Categories of third parties

• Service providers that process it on our behalf and on our instructions, under written agreements: application hosting and file storage (Vercel), our database (Neon), our AI provider (Anthropic, in the United States, on models that do not train on your data), encrypted email (Paubox), company email (Google Workspace), and our support phone line (Quo). Our payment processor (Stripe) receives your billing details, not your health information.
• Our lab partner, with the certified clinical laboratory it works with and the licensed clinician who authorizes the test, for a collection kit you register. It receives your legal name, date of birth, sex, the code printed on your kit, the date and time you collected the sample if you told us, the test, and a patient code we create at random. Nothing of yours reaches it until a written agreement covering your health information is in place.
• Other members, only for a post you choose to publish, under the display name you choose.
• Courts and government authorities, only when the law requires it.

We do not share consumer health data with advertising networks, data brokers or analytics companies. A recommendation partner receives only a de-identified, per-click token, and a partner program you link receives only the tokens it issued for the link, so neither receives your consumer health data.

Affiliated companies

These laws ask us to name the specific affiliated companies we share consumer health data with. Each of them is under common ownership with Valdura.

• Avellum Health Co LLC, 2750 Taylor Avenue, Suite A-84, Orlando, FL 32806, our shared-services company. It hosts our systems, holds our vendor accounts and the Business Associate Agreements with those vendors, and runs payroll for the staff who work across our companies. It is our processor: it handles every category above only on our behalf and on our instructions, under the Interim Business Associate and Data Protection Agreement between us.
• Precision Pharma Corp, which packs and ships your collection kit and whose support staff help answer the messages you send us. It acts as our service provider under the same agreement. It receives the name and postal address your kit ships to, our order reference and the kit. Its staff help answer support email and calls under that written data protection agreement, working our support mailbox and phone line directly as part of one shared support desk. When our support team hands it a question, it receives the ticket reference, the question as our staff write it, and, where needed, your order reference and your name.
• Avellum Health, LLC, for a membership, price or credit you chose, and for support. When it opens or quotes a Valdura membership checkout for you, we tell it the price, billing period and free days you would get, whether you are already a member, and whether a Valdura account on another email address is tied to the same Avellum patient. When it sends us a protocol credit, our answer can tell it you are already a member. If you hold the member price through an invitation or through our own staff, we send it your email address and how you came to hold it. When we check whether you still qualify for the member price, we send it a keyed one-way code made from your email address. When a support question needs its escalations desk, we send it the ticket reference, your name, your email address and phone number if we have them, your question as our staff summarize it, and what we have already told you.
• Crystal Clear RX, LLC, for a membership that one of its sales representatives, one of its patient records or one of its storefronts is tied to. It receives a record of each membership payment so that it can keep its accounts and pay its representatives. The record includes the payment's date, amount, discount, refunds and billing period, our payment processor's references, the representative's code, Crystal Clear's identifier for you, the storefront, and how the membership came to be tied to Crystal Clear. It does not include your name or email address. When Crystal Clear asks us to turn the access that comes with its membership on or off, our answer can tell it that you already pay for Valdura yourself.

When we ask for your consent

The Washington My Health My Data Act lets a company collect and share consumer health data without a separate consent when that is necessary to provide a product or service the consumer asked for, and lets it share consumer health data with a processor that handles it only on the company's instructions. Everything this policy describes falls into one of those. Each exchange runs the assistant, a kit, a membership, a price, a credit or the support you asked for, or it goes to a processor or service provider working for us, as Avellum Health Co LLC, Precision Pharma Corp and the vendors above do. We ask for your separate consent before we collect or share consumer health data for any other purpose.

Some choices are yours either way: whether to connect your phone's health app, whether the assistant may read it, and whether to turn on personalized marketing. You can change each of them in the app.

We do not sell your consumer health data

We do not sell it, and we never have. A sale would need a separate, signed authorization from you, and we do not ask anyone for one.

No geofencing

We do not set up a virtual boundary around a place that provides health care in order to identify or track people who enter it, collect consumer health data from them, or send them notifications, messages or ads. The Valdura app does not collect the location of your phone.

Your rights

Wherever you live, you can:

• Confirm whether we collect, share or sell your consumer health data.
• Access it, including a list of all the third parties and affiliated companies we have shared it with, with an email address or other online way to contact each one.
• Delete it. Your account closes right away, and your account and the health information in it are permanently deleted within 31 days of your request. Our encrypted backups are overwritten within 35 days after that. We ask every processor, affiliated company and third party we shared it with to delete it too. Some records are kept: our payment processor's payment records and our own billing records of your invoices and subscriptions, which are financial records; a pharmacy's prescription records, which Florida law requires the pharmacy to keep; the test records of the laboratory that ran your sample, which federal laboratory rules require it to keep; and a de-identified record that the deletion happened. If you remain a member of one of our affiliated companies, such as Crystal Clear RX, LLC, that company keeps its own records and may send us your name and email address again to keep the Valdura access that comes with your membership there, unless you ask it to stop.
• Withdraw your consent to our collecting or sharing your consumer health data. If what you withdraw is something the service needs in order to run, we tell you what stops working, and you can delete your account instead.
• Correct it, and get a copy to take elsewhere.

Nevada residents have the same rights under Nevada's consumer health data law, and Connecticut residents under Connecticut's data privacy act. We will not treat you differently for using any of them.

How to make a request

Email privacy@valdura.health, or write to Valdura Health LLC, Attn: Privacy Officer, 2750 Taylor Avenue, STE A84, Orlando, FL 32806. You can also delete your account yourself, and download a copy of your data, in Settings.

We confirm that a request is yours before we act on it, usually by asking you to write from the email address on your account. You can ask someone to make a request for you, and we may ask them for proof that you authorized it. We do not charge for a request.

We respond within 45 days of receiving your request. If we need longer, we may extend that once by up to 45 more days when it is reasonably necessary, and we will tell you within the first 45 days, with the reason.

Appeals

If we decline your request, in whole or in part, you can appeal by replying to our decision or by writing to privacy@valdura.health with "Appeal" in the subject line. We answer an appeal in writing within 45 days of receiving it, and we tell you what we did and why. If we deny your appeal, you can complain to the attorney general where you live. In Washington, you can file a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

How long we keep it

We keep consumer health data while your account is open, and delete it as described under "Your rights" when you ask us to or delete your account. Section 7 of our Privacy Policy lists how long we keep each category.

Changes to this policy

If we change what we collect, why we collect it, or who receives it, we update this page and its date before the change takes effect. We ask for your consent first wherever these laws require it.

Contact

• Privacy Officer: privacy@valdura.health
• Mailing address: Valdura Health LLC, Attn: Privacy Officer, 2750 Taylor Avenue, STE A84, Orlando, FL 32806