Sign in

Notice of Privacy Practices

Valdura Health

Version 3.0. Effective July 24, 2026.

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND SHARED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. Valdura provides this notice voluntarily; Valdura is not a HIPAA covered entity (see below).

About this notice

Valdura Health (a limited liability company, "Valdura," "we," "us," or "our") operates the Valdura health platform: an AI health assistant that interprets your bloodwork and health data, an optional bloodwork membership, a licensed-clinician advisor network, and partner-routed product recommendations. This notice explains how we may use and share health information that identifies you, and the rights you have over that information.

Who is responsible for your health information, and our HIPAA status. Valdura Health LLC operates the Valdura platform and brand. Valdura is a direct-to-consumer, cash-pay service that does not bill health insurance or submit healthcare claims to a health plan, which is the activity that brings a provider under HIPAA. For that reason Valdura is not a HIPAA covered entity and is not legally required to issue a HIPAA Notice of Privacy Practices. We provide this notice voluntarily, because we hold your health information to HIPAA-grade standards. Valdura Health LLC and Crystal Clear RX Wellness LLC are affiliated companies under common ownership and shared personnel, and under a written intercompany services agreement Valdura relies on Crystal Clear RX Wellness's established HIPAA compliance program. The Business Associate Agreements that cover the vendors handling your information are held by Crystal Clear RX Wellness LLC. Your enforceable rights over your health information come from consumer health-data laws, principally the Washington My Health My Data Act and CCPA/CPRA. When this notice refers to what "we" or "Valdura" do with your health information, it refers to Valdura operating under this program.

We provide this notice in the spirit of the federal privacy regulations issued under the Health Insurance Portability and Accountability Act (HIPAA), at 45 CFR 164.520, even though we are not a covered entity, and in keeping with the consumer health-data laws that do apply to us, including the Washington My Health My Data Act.

In this notice, "health information" and "protected health information" (PHI) mean information that identifies you (or could reasonably be used to identify you) and relates to your health, your care, or payment for your care. This includes your bloodwork and biomarker results, the health history and goals you share, data from a wearable device you connect, your conversations with the AI assistant, documents and photos you upload, and the account details that tie this information to you.

This notice applies to adults 18 and older. The Valdura platform is not intended for anyone under 18, and it is not for medical emergencies. If you are experiencing an emergency, call 911 or your local emergency number.

How we may use and disclose your health information without your authorization

Because you accept our Health Information Authorization when you join, and consistent with HIPAA's framework and the consumer health-data laws that apply to us, we use and share your health information for the purposes below without asking you to sign a separate authorization each time. The sections below describe those categories, with concrete examples of how each one works on our platform.

For treatment

We use and disclose your health information to provide, coordinate, and manage the health guidance you receive through Valdura. For example:

  • The AI assistant reads your bloodwork results, connected-device data, and self-reported history so it can interpret your labs, track your biomarkers over time, and give you guidance.
  • When the AI produces output that is prescription-adjacent or that would change a care plan, a licensed clinician in our advisor network reviews that output, and the information needed for that review, before it reaches you.
  • If you order labs through us, we share the order details a lab partner needs to draw and process your sample, and that partner returns your results to us.
  • A clinician may use your information to follow up with you, to coordinate your care, or to refer you to another provider when that is appropriate.

For payment

We use and disclose your health information as needed to bill for and collect payment for your membership and any services you order. For example:

  • We process your membership payment and any charges for bloodwork panels or add-ons you select.
  • We confirm that a service you requested, such as a specific lab panel, is one you are eligible to receive under your membership.
  • We keep records of the services provided and amounts charged.

We do this with the minimum information necessary. Our payment processing is handled so that your detailed health information is not exposed to payment vendors beyond what billing requires.

For health care operations

We use and disclose your health information to run Valdura safely and to improve the quality of what we offer. For example:

  • We review AI output and clinician reviews for quality, accuracy, and safety.
  • We operate, secure, and maintain the platform, including troubleshooting, fraud and abuse prevention, and protecting the system against unauthorized access.
  • We evaluate the performance of our AI and our clinician advisor network and work to improve them.
  • We carry out business management and general administrative activities.

When the AI assistant processes your information to generate guidance, that processing runs on Anthropic's Claude API, in United States regions, using models that do not train on your data and do not share it. Anthropic retains what it processes only briefly (up to 30 days, for security and abuse monitoring) and then deletes it. Anthropic processes this data under a Business Associate Agreement. The AI does not make clinical decisions on its own. Clinical-adjacent output is reviewed by a licensed clinician before you act on it.

Business associates and service providers

Some functions of the platform are carried out by vendors that handle health information on our behalf. We share information with them only as needed to do their work. Our infrastructure vendors (Vercel, Neon, and Paubox) each handle your health information under a signed Business Associate Agreement held by Crystal Clear RX Wellness LLC, which requires them to safeguard it; our AI provider, Anthropic, handles it under a signed Business Associate Agreement held by the same program. Our vendors include:

  • Vercel, which hosts the application, including Blob object storage for the lab files and documents you upload.
  • Neon, which provides the database.
  • Anthropic, which provides AI inference on the Claude API (United States regions; models that do not train on your data; under a Business Associate Agreement).
  • Paubox, which provides encrypted email.
  • Lab partners (Quest, Labcorp, or Getlabs), when you order labs, to process the order and return results.

When you choose to connect a wearable device (Oura, Whoop, or Garmin), that provider shares your device data with us under the authorization you give when you connect it.

Our recommendation partners (the retail partner storefront tied to your membership for supplements, and Avellum for peptide protocols) do not receive your health information. When a recommendation routes to a partner, they receive only a de-identified, per-click attribution token. They do not receive your health data or any stable identifier that points back to you.

Other uses and disclosures permitted or required by law

We may use or disclose your health information without your authorization in a limited set of circumstances that the law permits or requires, including:

  • As required by law, when a federal, state, or local law requires the disclosure.
  • For public health activities, such as reporting to a public health authority authorized to receive that information, or reporting an adverse event related to a product.
  • To report abuse, neglect, or domestic violence to a government authority authorized by law to receive such reports.
  • For health oversight activities authorized by law, such as audits and investigations.
  • For judicial and administrative proceedings, in response to a court order, or to a subpoena or other lawful process with appropriate safeguards.
  • For law enforcement purposes, when the disclosure is permitted or required by law.
  • To avert a serious threat to your health or safety or to the health or safety of the public.
  • For specialized government functions, such as military, national security, or protective services, where the law allows.
  • For workers' compensation, as authorized by and to the extent necessary to comply with workers' compensation laws.
  • To coroners, medical examiners, and funeral directors, as the law permits.
  • For organ and tissue donation, where applicable.
  • For research, only where permitted, and ordinarily only after a review process or after the information has been de-identified.

We will tell you, and where the law requires it we will obtain your agreement or give you a chance to object, before making certain of these disclosures.

Uses and disclosures that require your written authorization

Other than the uses and disclosures described above, we will not use or share your health information without your written authorization. In particular, your written authorization is required for:

  • Any sale of your health information. We do not sell your personal or health information, and we will not do so.
  • Marketing communications that involve sharing your health information, beyond ordinary communications about your own membership and the services you use.
  • Most uses and disclosures of psychotherapy notes, if any are ever created.
  • Any other use or disclosure not described in this notice.

Valdura also does not use third-party advertising or third-party analytics trackers.

If you give us an authorization, you may revoke it at any time, in writing, by contacting privacy@valdura.health. A revocation stops future uses and disclosures that relied on that authorization. It does not undo anything we already did in reliance on it before we received your revocation.

Your rights regarding your health information

You have the following rights over the health information we hold about you. To exercise any of them, contact our Privacy Officer at privacy@valdura.health. We will respond within the timeframes the law requires.

The right to inspect and copy

You have the right to inspect and obtain a copy of the health information we hold about you, including an electronic copy when we hold it electronically (which is how we hold most of your information). You can ask us to send your copy to you or to another person you name in writing. In the limited cases where the law allows us to deny a request, we will tell you in writing and explain any right you have to have the denial reviewed.

The right to request an amendment

If you believe information we hold about you is incorrect or incomplete, you have the right to ask us to amend or correct it. Please make your request in writing and tell us why. We may deny a request in the limited circumstances the law allows, for example where we did not create the information or where it is already accurate and complete. If we deny your request, we will explain why in writing and tell you how to respond.

The right to an accounting of disclosures

You have the right to request an accounting of certain disclosures we have made of your health information. This is a list of disclosures other than those made for treatment, payment, health care operations, disclosures you authorized, and certain other categories the law excludes. We maintain audit logging of access to your health information, which supports our ability to provide this accounting.

The right to request restrictions

You have the right to request that we restrict how we use or disclose your health information for treatment, payment, or health care operations. We are not required to agree to every request, but where we do agree, we will honor the restriction except in an emergency.

The right to request confidential communications

You have the right to ask that we communicate with you about your health information in a particular way or at a particular place, for example by a specific email address. We will accommodate reasonable requests.

The right to a paper or electronic copy of this notice

You have the right to a paper or electronic copy of this notice at any time, even if you agreed to receive it electronically. You can request one at privacy@valdura.health, and the current version is available at www.valdura.health.

The right to be notified of a breach

You have the right to be notified if there is a breach of your unsecured health information.

Additional consumer health-data rights

Depending on where you live, consumer health-data and privacy laws may give you further rights, and we extend these rights to our members:

  • Deletion. You may ask us to delete your health information. We honor deletion requests without undue delay and within 30 calendar days. Deletion reaches our backups and is communicated to the vendors that process your data on our behalf, consistent with the Washington My Health My Data Act and similar consumer health-data laws. After we delete an account, a scheduled process permanently purges it following a 30-day grace window, while we retain a de-identified audit trail.
  • Correction. You may ask us to correct inaccurate health information about you.
  • Withdrawing an authorization. You may withdraw any authorization you have given, at any time.
  • Opting out of marketing. You may opt out of marketing communications at any time.
  • Data portability and export. You may request a copy of your data in a portable, exportable form.

To exercise any of these rights, contact privacy@valdura.health.

Our commitments

We commit to the following, and applicable consumer health-data laws require much of it:

  • Maintain the privacy and security of your health information.
  • Give you this notice describing our privacy practices regarding your health information.
  • Follow the terms of the notice that is currently in effect.
  • Notify you, as required by law, if a breach occurs that compromises the privacy or security of your unsecured health information.

To meet these commitments, we have put specific safeguards in place, including:

  • Encryption of your information in transit (TLS) and at rest (database encryption).
  • Field-level encryption of the access tokens for any device you connect (AES-256-GCM) and hashing of session tokens.
  • Role-based access control, with audit logging of every read and write of your health information.
  • Clinician review of clinical-adjacent AI output before it reaches you.
  • A launch-flag gate that keeps the platform running on synthetic data until we deliberately enable real data. The agreements covering our production data vendors are in place: a Business Associate Agreement with each infrastructure vendor (Vercel, Neon, Paubox), held by Crystal Clear RX Wellness LLC, and a Business Associate Agreement with our AI provider (Anthropic).
  • A scheduled job that permanently purges deleted accounts after a 30-day grace window, while retaining a de-identified audit trail.

We do not sell your personal or health information, and we do not use third-party advertising or third-party analytics trackers.

Changes to this notice

We may change this notice. We reserve the right to make the revised notice effective for health information we already have as well as for information we receive in the future. When we make a material change, we will post the updated notice at www.valdura.health and update the effective date below. You may request the current version at any time.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us, and you may also have the right to complain to a government regulator. We will not retaliate against you, and your membership and access to the service will not be affected, for filing a complaint.

  • With us: contact our Privacy Officer at privacy@valdura.health. You can also reach our security team at security@valdura.health, or general support at support@valdura.health.
  • With a state regulator: consumer health-data laws such as the Washington My Health My Data Act and the CCPA/CPRA are enforced by state attorneys general, and you may file a complaint with the attorney general in your state.
  • With the U.S. Department of Health and Human Services: to the extent your information is handled under Crystal Clear RX Wellness's HIPAA compliance program, you may file a written complaint with the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201. You can also call 1-877-696-6775 or file online at www.hhs.gov/ocr/privacy/hipaa/complaints.

Privacy Officer and contact information

Our Privacy Officer is responsible for this notice and for handling your privacy questions, requests, and complaints.

Effective date: Effective July 24, 2026.

Version 3.0.