Legal

How we protect your health information

Valdura Health

Version 3.12. Effective October 26, 2026.

This page describes how health information about you may be used and shared, and how you can get access to it. Valdura is not a HIPAA covered entity, and this page is not a HIPAA Notice of Privacy Practices. We follow the practices it describes by choice.

About this notice

Valdura Health (a limited liability company, "Valdura," "we," "us," or "our") operates the Valdura health platform: an AI health assistant that explains your bloodwork and health data in plain language, bloodwork you can buy separately, partner-routed product recommendations, a member community, and, where we offer them, a place to keep your Avellum orders and records alongside your own and screens on which you can buy a treatment from our affiliated company Crystal Clear RX, LLC. This notice explains how we may use and share health information that identifies you, and the rights you have over that information.

Who is responsible for your health information, and our HIPAA status. Valdura Health LLC operates the Valdura platform and brand. Valdura is a direct-to-consumer, cash-pay service that does not bill health insurance or submit healthcare claims to a health plan, which is the activity that brings a provider under HIPAA. For that reason Valdura is not a HIPAA covered entity and is not legally required to issue a HIPAA Notice of Privacy Practices, and this page is not one. We publish it, and follow the practices it describes, by choice, because we protect your health information with safeguards modeled on HIPAA. Valdura Health LLC and Avellum Health Co LLC are affiliated companies under common ownership, and so are Avellum Health, LLC, Crystal Clear RX, LLC and Precision Pharma Corp. Avellum Health Co LLC is the shared-services company for Valdura and its affiliated companies: it runs payroll for the staff who work across those companies, holds the vendor accounts they share, and holds the Business Associate Agreements with those vendors. Under a written business associate and data protection agreement, Valdura relies on Avellum Health Co LLC's privacy and security program. The Business Associate Agreements that cover the vendors handling your health information are held by Avellum Health Co LLC, except the one for our company email, which Valdura holds with Google. The affiliated company that packs and ships your collection kit is bound by the same written business associate and data protection agreement. Your enforceable rights over your health information come from consumer health-data laws, principally the Washington My Health My Data Act and CCPA/CPRA. When this notice refers to what "we" or "Valdura" do with your health information, it refers to Valdura operating under this program.

We provide this notice in the spirit of the federal privacy regulations issued under the Health Insurance Portability and Accountability Act (HIPAA), at 45 CFR 164.520, even though we are not a covered entity, and in keeping with the consumer health-data laws that do apply to us, including the Washington My Health My Data Act. Our Consumer Health Data Privacy Policy gives the disclosures those laws require, including the affiliated companies we share consumer health data with by name.

In this notice, "health information" and "protected health information" (PHI) mean information that identifies you (or could reasonably be used to identify you) and relates to your health, your care, or payment for your care. This includes your bloodwork and biomarker results, the health history and goals you share, what you log day to day (meals, water, weight, workouts, supplements and medications, symptoms, and your daily check-in), the cycle, fertility, pregnancy, and sexual-activity information you record, the health data held by any wearable, health app, or phone health store you connect, your conversations with the AI assistant, documents and photos you upload, the messages you send our support team and the transcript of any voicemail you leave on our support line, the questions you send to a live session or webinar, the answers you give to the medical questions for a treatment you request from Crystal Clear, the medical intake answers, orders and visit status Avellum sends us when your accounts are connected, the medication and dates of a protocol program you bought, and the account details that tie this information to you. Reproductive and sexual health information is part of this. The Washington My Health My Data Act and California law treat it as its own protected category, and so do we: it carries every right and safeguard in this notice.

This notice applies to adults 18 and older. The Valdura platform is not intended for anyone under 18, and it is not for medical emergencies. If you are experiencing an emergency, call 911 or your local emergency number.

How we may use and disclose your health information without your authorization

Because you accept our Health Information Authorization when you join, and consistent with HIPAA's framework and the consumer health-data laws that apply to us, we use and share your health information for the purposes below without asking you to sign a separate authorization each time. The sections below describe those categories, with concrete examples of how each one works on our platform.

For treatment

We use and disclose your health information to provide, coordinate, and manage the health guidance you receive through Valdura. For example:

The AI assistant reads your bloodwork results, the data from any device, health app, or phone health store you connect, and your self-reported history so it can explain your labs in plain language, track your biomarkers over time, and give you general wellness guidance.
The AI assistant's output is general information and explanation, not medical advice, and it does not replace a licensed clinician. Valdura does not offer clinician consults today. If Valdura offers clinician consults and you choose one, a clinician is involved only where a feature explicitly says so, and then uses only the information that feature needs.
If you order labs through us, we share the order details a lab partner needs to draw and process your sample, and that partner returns your results to us.
If Valdura offers clinician consults and you choose one, that clinician may use your information to follow up with you, to coordinate your care, or to refer you to another provider when that is appropriate.
If you buy a treatment from our affiliated company Crystal Clear RX, LLC in Valdura and sign the request, we send Crystal Clear your answers to the medical questions and the details the request needs, and Crystal Clear passes them to a medical group affiliated with its telehealth partner, whose licensed clinician decides whether the treatment is right for you. "Treatments you buy from Crystal Clear in Valdura" below describes this.
If you connect your Avellum account, Avellum Health, LLC sends us your Avellum orders, where your visits stand and your signed medical intake answers, and you can choose to send Avellum a few of your answers to start a medical request there. "Accounts connected to Avellum" below describes this.

For payment

We use and disclose your health information as needed to bill for and collect payment for your membership and any services you order. For example:

We process your membership payment and any charges for bloodwork panels or add-ons you select.
We confirm which price you are eligible for on a service you requested, such as a specific lab panel, and whether an offer you hold applies to it.
We keep records of the services provided and amounts charged.

We do this with the minimum information necessary. Our payment processing is handled so that your detailed health information is not exposed to payment vendors beyond what billing requires.

For health care operations

We use and disclose your health information to run Valdura safely and to improve the quality of what we offer. For example:

We review AI output, and the work of any clinician involved in a feature, for quality, accuracy, and safety.
We operate, secure, and maintain the platform, including troubleshooting, fraud and abuse prevention, and protecting the system against unauthorized access.
We evaluate the performance of our AI, and of any clinician involved in a feature you choose, and work to improve them.
We carry out business management and general administrative activities.

When the AI assistant processes your information to generate guidance, that processing runs on Anthropic's Claude API, in United States regions, using models that do not train on your data and do not share it. We do not use your health information to train AI models, and Anthropic does not either. Anthropic retains what it processes only briefly (up to 30 days, for security and abuse monitoring) and then deletes it. Anthropic processes this data under a Business Associate Agreement. The AI does not make clinical decisions on its own. Its output is general information, not medical advice, so consult your own clinician for medical decisions. When your Avellum account is connected, the assistant can also read your Avellum medical intake answers, unless you turn that off. It never reads the answers you give to the medical questions for a treatment you buy from Crystal Clear in Valdura.

Business associates and service providers

Some functions of the platform are carried out by vendors that handle health information on our behalf. We share information with them only as needed to do their work. Our infrastructure vendors (Vercel, Neon, and Paubox) each handle your health information under a signed Business Associate Agreement held by our affiliated shared-services company, Avellum Health Co LLC, which requires them to safeguard it; our AI provider, Anthropic, handles it under a signed Business Associate Agreement held by Avellum Health Co LLC; Precision Pharma, which packs and ships your collection kit, is an affiliated company and handles it under the same written business associate and data protection agreement described above; and Google Workspace and Quo, which carry the email you send us and the calls you make to our support line, each handle it under a signed Business Associate Agreement, Google Workspace's held by Valdura and Quo's held by Avellum Health Co LLC. Our lab partner, which arranges the laboratory testing of the sample from your collection kit, receives nothing of yours until a written agreement covering your health information is in place with it. Our vendors include:

Vercel, which hosts the application, including Blob object storage for the lab files and documents you upload.
Neon, which provides the database.
Anthropic, which provides AI inference on the Claude API (United States regions; models that do not train on your data; under a Business Associate Agreement).
Paubox, which provides encrypted email.
Google Workspace, which provides our company email. A message you send to a Valdura address arrives and is kept there, and our support team reads it there.
Quo, which provides our support phone line. It holds the recording of a voicemail you leave and produces the written transcript we keep on your support ticket.
Precision Pharma, which packs and ships your collection kit. We send it our order reference, the storefront you bought from, the kit and quantity, the name and postal address the kit ships to, and, when we have one, a phone number for the shipping label, because the carrier requires one: the phone given with the order, or else the phone saved in your account. Nothing else goes for that order: not your email address, not your date of birth or biological sex, and nothing from your lab results, health history, the data from any device, health app, or phone health store you connect, your cycle or other reproductive information, uploaded documents, or conversations with the assistant. It reports back that the box shipped, with a carrier, a tracking number and the code printed on each kit in the box, and nothing else about you. This release of your name, address and phone number is a disclosure, and it appears in your own privacy log and in any accounting of disclosures you request.
Our lab partner, Better Human, Inc., the company that arranges the laboratory testing of the sample from a collection kit you register, under the Consent to Testing and the Authorization to Release My Laboratory Test Results you sign for each kit. We send it your legal name, date of birth, biological sex, the state you live in, the code printed on your kit, the date and time you collected the sample if you told us, the test, and a patient code we create at random so it can keep your orders together, and nothing else: not your phone number or postal address, not your email address unless you revoke your authorization (we then send it so that Better Human can tell you itself if a result needs urgent attention), and nothing from your health history, the data from any device, health app, or phone health store you connect, your cycle or other reproductive information, uploaded documents, or conversations with the assistant. It returns where your kit and sample are, and your results. This release is a disclosure, and it appears in your own privacy log and in any accounting of disclosures you request. Nothing of yours reaches our lab partner until a written agreement covering your health information is in place with it.

Payments are handled separately, by our payment processor Stripe. Stripe receives your email address, your card details, the shipping address you enter for a collection kit, and the identifiers and item information needed to match a payment to your account. It does not receive your health information, so it is not a business associate and holds no Business Associate Agreement with us.

Support for Valdura and its affiliated companies is run as one desk, under the written business associate and data protection agreement described above. A support staff member at Valdura, and today also at our affiliated company Precision Pharma, may read a message you send us in order to answer it. Precision Pharma's support staff work these messages in their own queue; they hold no Valdura login and no access to your Valdura health record. Our support system uses our AI provider, Anthropic, to sort each incoming message by team and topic. When a question needs another team's own staff, our support staff can send it on, one ticket at a time, to the escalations desk of our affiliated company Avellum Health, LLC or to Precision Pharma's own team, with what that team needs to answer it, as our Privacy Policy describes.

If you connected an Oura ring or a Whoop band directly, that provider shares your device data with us under the authorization you gave when you connected it, until the connection moves to your phone's health app. Oura and Whoop are closed to new connections, and the direct Garmin connection has been removed. The AI does not use data from a direct Oura connection, and you choose in the app whether the assistant reads the data from your phone's health app, as our Privacy Policy describes. When you connect your phone's own health store (Apple Health on an iPhone, Google Health Connect on an Android phone), there is no provider in the middle: the Valdura app reads the data from your own phone, under the permission you grant on the phone, and sends it to us, and Apple and Google are not sent it. What either route can carry is set out in Section 2 of our Privacy Policy, and it includes reproductive and sexual health information wherever you or another app on your phone has recorded it.

Our recommendation partners (the retail partner storefront tied to your membership for supplements; and, for peptide protocols, Avellum if you came to Valdura through Avellum or through our retail partner program, and otherwise Crystal Clear RX, LLC, at its own store or at the Crystal Clear storefront of the partner you joined through) do not receive your health information. When a recommendation routes to a partner, they receive only a de-identified, per-click attribution token, and a link to Crystal Clear also says when you use Valdura in Spanish, so that its site opens in Spanish. They do not receive your health data or any stable identifier that points back to you.

Our affiliated companies Crystal Clear RX, LLC and Avellum Health, LLC exchange limited information with us to run a membership, a price, a credit, a connected account, a treatment or support you chose, such as your email address, their own reference for you, whether you qualify for a member price or a credit, and records of the membership payments tied to them. They do not receive your lab results, your health history, the data from your phone or a device you connected, or your conversations with the assistant through these exchanges, apart from anything you wrote in a support message that our staff send on and the answers you choose to send with a request, described under "Accounts connected to Avellum" and "Treatments you buy from Crystal Clear in Valdura" below. Sections 2 and 4 of our Privacy Policy, and our Consumer Health Data Privacy Policy, describe what each exchange carries.

Other uses and disclosures permitted or required by law

We may use or disclose your health information without your authorization in a limited set of circumstances that the law permits or requires, including:

As required by law, when a federal, state, or local law requires the disclosure.
For public health activities, such as reporting to a public health authority authorized to receive that information, or reporting an adverse event related to a product.
To report abuse, neglect, or domestic violence to a government authority authorized by law to receive such reports.
For health oversight activities authorized by law, such as audits and investigations.
For judicial and administrative proceedings, in response to a court order, or to a subpoena or other lawful process with appropriate safeguards. Reproductive and sexual health information is held to the stricter rule below.
For law enforcement purposes, when the disclosure is permitted or required by law.
To avert a serious threat to your health or safety or to the health or safety of the public.
For specialized government functions, such as military, national security, or protective services, where the law allows.
For workers' compensation, as authorized by and to the extent necessary to comply with workers' compensation laws.
To coroners, medical examiners, and funeral directors, as the law permits.
For organ and tissue donation, where applicable.
For research, only where permitted, and ordinarily only after a review process or after the information has been de-identified.

We will tell you, and where the law requires it we will obtain your agreement or give you a chance to object, before making certain of these disclosures.

Reproductive and sexual health information is held to a stricter rule. We disclose it to a court, a government agency, law enforcement, or anyone else seeking it for a legal matter only when the law requires us to, and only on a warrant or a court order. A subpoena alone is not enough. We tell you about the request first, unless the law or the court forbids us to. We refuse a request from outside the state you live in that seeks information about reproductive or sexual health care that was lawful where you received it. Section 4 of our Privacy Policy sets out this rule.

Information you choose to publish

The Service includes a member community. If you publish a post there, the text you wrote and the display name you chose become visible to every Valdura member, including members on a free account. That disclosure is your own act: you decide what to write, whether to publish it, and whether to take it down, and we never publish anything in the community on your behalf or place you in it by default.

Nothing else about you goes with a post. Your legal name, your contact details, your lab results, your health history, the data from any device, health app, or phone health store you connect, your cycle and other reproductive information, what you write to our support team, your uploaded documents and your conversations with the assistant are not shared with other members, and your display name is a name you choose for this purpose rather than the legal name you gave us for lab orders.

Taking a post down removes it from the community for everyone, but it cannot unread it for anyone who already saw it. Posts are screened before they publish, a post may be refused or removed, other members can report a post, and you can hide another member's posts from your own view.

The same holds for the spaces you choose to join. A post you publish inside a circle a practice runs in Valdura, or on a season's team, is shown only to that space's members and, for a circle, the practice. Joining a season or a circle is your own choice, and we place you on a team only inside a season you chose to join. A season shares nothing from your health record with your team: teammates see only a coarse weekly team level, never your own points or the days you took part, and a circle's practice sees only counts unless you separately let it see your name.

Accounts connected to Avellum

If you are a patient of our affiliated company Avellum Health, LLC, you can ask Avellum, by signing an authorization on Avellum, to keep your health information in Valdura. Avellum then asks us to connect your Valdura account, or to open a free one for you, using your confirmed email address, your name, your language, Avellum's own reference for you and a reference to the authorization you signed. From then on, Avellum sends us your Avellum orders, where your visits stand, and the answers you give on Avellum's medical intake once you sign it. Once we receive this information, we protect it as this notice describes.

Orders and visits. We keep the last copy Avellum sends so we can show it to you, and delete it when the accounts are disconnected. The assistant can read it to answer your questions about your orders.
Medical intake answers. Your sex at birth, height and weight, and the conditions, surgeries, medications, allergies and goals you reported, each with its question as you saw it and the date you signed. Avellum never sends us your answers about mental health, suicidal thoughts, eating disorders, substance use, pregnancy, HIV, blood pressure or heart rate, the result you saw or its reasons, photos or documents, notes or decisions from your care team, your dose or prescription details, your date of birth, address, phone number or state, or your payment card. You can read them, read-only, on the page "From your Avellum medical intake", and delete one intake or all of them. The assistant can read them to help you unless you turn off "Let the assistant read these" on that page. We never use them for marketing and do not share them with our partners or any other company, apart from the vendors that run our service for us.
Answers you choose to send to Avellum. When you start a medical request on Avellum from Valdura, you can choose to send it your sex at birth, your height, a recent weight you entered, the medication and medication allergy lines you keep and the treatment you chose, each shown to you first, so you do not have to type them again. Avellum and the licensed clinicians at its care partner use them only for that request. This disclosure is your own choice, and it appears in your own privacy log.
Signing in. Where we offer it, on the web, a one-time code lets you go between Avellum and Valdura without signing in again; it tells the other company which account is signing in and nothing from your health record. Signing out of one does not sign you out of the other.
Stopping. You can disconnect in Settings on the Valdura website, stop sharing in your Avellum account settings, or write to privacy@valdura.health. Sharing stops from then on, and we delete the copy of your Avellum orders and every Avellum medical intake answer we hold. Your Valdura account stays open until you close it.

Our Privacy Policy describes each of these in full under "Accounts connected to Avellum".

Treatments you buy from Crystal Clear in Valdura

Where we offer it, you can buy a treatment from our affiliated company Crystal Clear RX, LLC without leaving Valdura. Crystal Clear is the seller, and a licensed clinician at a medical group affiliated with its telehealth partner, OpenLoop Health, decides whether the treatment is right for you. Valdura does not make that decision.

What we collect. Your answers to that medical group's questions for the treatments you chose, which can cover conditions such as cancer, kidney and liver disease and heart history, eating disorders, mental health including thoughts of suicide, substance use, pregnancy and breastfeeding, the medicines you take and your allergies, together with the state you are in, the consents you sign and the name you type to sign them.
What we disclose, and to whom. When you sign and submit your request, we send Crystal Clear your answers, the consents you signed, the state you are in, and your legal name, date of birth, sex at birth, email address, phone number and shipping address, and Crystal Clear passes them, through OpenLoop Health, to the medical group so that its clinician can decide on your request. Nothing of your answers is sent for a request you have not signed. This disclosure appears in your own privacy log and in any accounting of disclosures you request.
How we use them. Only for that request: to send it, to show your answers back to you, and, if an answer means a treatment may not be safe for you right now, to stop the request and, for a time, stop offering you these treatments in Valdura. Our AI assistant never reads them, and we never use them for marketing.
Protocol programs. If you buy a protocol membership from Crystal Clear, Crystal Clear tells us the medication's name and the dates you paid for, so we can open that medication's program for you. It never sends us your dose, who prescribed it, or your answers to medical questions.
How long we keep them. For as long as your account is open, and they are deleted with your account. Crystal Clear and the medical group keep their own records of your request under their own privacy commitments and the health privacy rules that bind them.

Our Privacy Policy describes each of these in full under "Treatments you buy from Crystal Clear in Valdura".

Uses and disclosures that require your written authorization

Other than the uses and disclosures described above, we will not use or share your health information without your written authorization. In particular, your written authorization is required for:

Any sale of your health information. We do not sell your personal or health information, and we will not do so.
Marketing communications that involve sharing your health information, beyond ordinary communications about your own membership and the services you use. We never use the data the Valdura app reads from Apple Health or Health Connect for marketing, even with your authorization.
Most uses and disclosures of psychotherapy notes, if any are ever created.
Any other use or disclosure not described in this notice.

Valdura also does not use third-party advertising or third-party analytics trackers.

If you give us an authorization, you may revoke it at any time, in writing, by contacting privacy@valdura.health. A revocation stops future uses and disclosures that relied on that authorization. It does not undo anything we already did in reliance on it before we received your revocation.

Your rights regarding your health information

You have the following rights over the health information we hold about you. To exercise any of them, contact our Privacy Officer at privacy@valdura.health. We will respond within the timeframes the law requires.

The right to inspect and copy

You have the right to inspect and obtain a copy of the health information we hold about you, including an electronic copy when we hold it electronically (which is how we hold most of your information). You can ask us to send your copy to you or to another person you name in writing. In the limited cases where the law allows us to deny a request, we will tell you in writing and explain any right you have to have the denial reviewed.

The right to request an amendment

If you believe information we hold about you is incorrect or incomplete, you have the right to ask us to amend or correct it. Please make your request in writing and tell us why. We may deny a request in the limited circumstances the law allows, for example where we did not create the information or where it is already accurate and complete. If we deny your request, we will explain why in writing and tell you how to respond.

The right to an accounting of disclosures

You have the right to request an accounting of certain disclosures we have made of your health information. This is a list of disclosures other than those made for treatment, payment, health care operations, disclosures you authorized, and certain other categories the law excludes. We maintain audit logging of access to your health information, which supports our ability to provide this accounting.

The right to request restrictions

You have the right to request that we restrict how we use or disclose your health information for treatment, payment, or health care operations. We are not required to agree to every request, but where we do agree, we will honor the restriction except in an emergency.

The right to request confidential communications

You have the right to ask that we communicate with you about your health information in a particular way or at a particular place, for example by a specific email address. We will accommodate reasonable requests.

The right to a paper or electronic copy of this notice

You have the right to a paper or electronic copy of this notice at any time, even if you agreed to receive it electronically. You can request one at privacy@valdura.health, and the current version is available at www.valdura.health.

The right to be notified of a breach

You have the right to be notified if there is a breach of your unsecured health information.

Additional consumer health-data rights

Depending on where you live, consumer health-data and privacy laws may give you further rights, and we extend these rights to our members:

Deletion. You may ask us to delete your health information, or delete your account yourself in Settings. Your account closes right away, and your account and the health information in it are permanently deleted within 31 days of your request; our encrypted backups are overwritten within 35 days after that. We ask the vendors and affiliated companies that hold copies of what you sent us to delete them, consistent with the Washington My Health My Data Act and similar consumer health-data laws. Some records are kept: our payment processor's payment records and our own billing records of your invoices and subscriptions, which are financial records; a pharmacy's prescription records, which Florida law requires the pharmacy to keep; the test records of the laboratory that ran your sample, which federal laboratory rules require it to keep; the consent to testing and the authorization you signed for each collection kit, with the details recorded when you signed (your name, date of birth, state, kit code, the date and time, and the network address or device you used), which our lab partner's agreement requires us to keep for ten years after your last kit order; the records Crystal Clear and the medical group keep of a treatment request you made, under their own policies and the laws that apply to them; and a de-identified audit trail, which does not identify you. If you remain a member of one of our affiliated companies, such as Crystal Clear RX, LLC, that company keeps its own records and may send us your name and email address again to keep the Valdura access that comes with your membership there, unless you ask it to stop.
Correction. You may ask us to correct inaccurate health information about you.
Withdrawing an authorization. You may withdraw any authorization you have given, at any time.
Opting out of marketing. You may opt out of marketing communications at any time.
Data portability and export. You may request a copy of your data in a portable, exportable form.
The list of who received it. You may ask for the list of the third parties and affiliated companies we have shared your health information with, with a way to contact each one.

To exercise any of these rights, contact privacy@valdura.health. We respond within 45 days, and you can appeal a decision, as our Consumer Health Data Privacy Policy describes.

Our commitments

We commit to the following, and applicable consumer health-data laws require much of it:

Maintain the privacy and security of your health information.
Give you this notice describing our privacy practices regarding your health information.
Follow the terms of the notice that is currently in effect.
Notify you, as required by law, if a breach occurs that compromises the privacy or security of your unsecured health information.

To meet these commitments, we have put specific safeguards in place, including:

Encryption of your information in transit (TLS) and at rest (database encryption).
Field-level encryption of the access tokens for any device you connect (AES-256-GCM) and hashing of session tokens.
Role-based access control, with audit logging of every read and write of your health information.
An AI assistant that gives general information and makes no clinical decisions, with a clinician involved only where a feature explicitly says so.
Written agreements with our vendors. The agreements covering our production data vendors are in place: a Business Associate Agreement with each infrastructure vendor (Vercel, Neon, Paubox), with our AI provider (Anthropic), and with our support phone vendor (Quo), each held by Avellum Health Co LLC; a Business Associate Agreement with Google for our company email (Google Workspace), held by Valdura; and, for the pharmacy that ships your collection kit (Precision Pharma), the written business associate and data protection agreement described above.
A scheduled job that permanently purges a deleted account, and the health information in it, within 31 days of the request, with our encrypted backups overwritten within 35 days after that.

We do not sell your personal or health information, and we do not use third-party advertising or third-party analytics trackers.

Changes to this notice

We may change this notice. We reserve the right to make the revised notice effective for health information we already have as well as for information we receive in the future. When we make a material change, we will post the updated notice at www.valdura.health and update the effective date below. You may request the current version at any time.

How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with us, and you may also have the right to complain to a government regulator. We will not retaliate against you, and your membership and access to the service will not be affected, for filing a complaint.

With us: contact our Privacy Officer at privacy@valdura.health. You can also reach our security team at security@valdura.health, or general support at support@valdura.health.
With a state regulator: consumer health-data laws such as the Washington My Health My Data Act and the CCPA/CPRA are enforced by state attorneys general, and you may file a complaint with the attorney general in your state.
With the U.S. Department of Health and Human Services: to the extent HIPAA applies to your information, you may file a written complaint with the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201. You can also call 1-877-696-6775 or file online at www.hhs.gov/ocr/privacy/hipaa/complaints.

Privacy Officer and contact information

Our Privacy Officer is responsible for this notice and for handling your privacy questions, requests, and complaints.

Privacy Officer and data-rights requests: privacy@valdura.health
Security and incident reports: security@valdura.health
General support: support@valdura.health
Website: www.valdura.health
Mailing address: Valdura Health LLC, 2750 Taylor Avenue, STE A84, Orlando, FL 32806

Effective date: Effective October 26, 2026.

Version 3.12.