Valdura Privacy Policy

Plain-language summary

Valdura is an AI-first health platform. To help you understand your bloodwork and health data, we collect the information you give us (account details, lab results, health history, and the things you log day to day) and, if you choose to connect one, the health data held by a wearable, a health app, or your phone's own health store, and we use it to power your AI health assistant and to route product recommendations. Some of what we collect is reproductive and sexual health information, and we treat it as a protected category, with a stricter rule for legal requests (Section 4). Section 2 describes these categories and where each one comes from. The assistant gives you general information and explanations, not medical advice, and it does not replace a licensed clinician, so consult your own clinician for medical decisions. Our production AI runs on Anthropic's Claude API, in the United States, on models that do not train on your data, under a Business Associate Agreement. We do not use your personal or health data to train AI models, and our AI provider does not either. We do not sell your personal or health information, and we run no third-party advertising or analytics trackers. We share information with our affiliated companies only to run the memberships, prices, credits, kits, connected accounts, treatments and support you choose, and Section 4 names each of them. If you buy a treatment from our affiliated company Crystal Clear inside Valdura, the answers you give to its medical questions go to Crystal Clear and the medical group that decides on your request, and our AI never reads them. You can access, export, correct, or delete your data at any time. When you delete your account, we permanently delete your account and the health information in it within 31 days, and our encrypted backups are overwritten within 35 days after that. Questions or requests go to privacy@valdura.health.

1. Who we are and the scope of this policy

Valdura Health operates the Valdura platform: a text-based AI health assistant that explains your bloodwork and health data in plain language and gives you general wellness guidance, an optional paid membership for that assistant and the app, bloodwork panels and add-ons bought separately, collected at home or, where we offer it, drawn at a lab partner, partner-routed product recommendations, a member community you can read, and publish in with a paid membership, habit seasons and circles you can choose to join, and, where we offer them, a way to share the data you choose with a practice you work with, a place to keep your Avellum orders and records alongside your own and screens on which you can buy a treatment from our affiliated company Crystal Clear RX, LLC. The assistant provides general information and explanations. It is not medical advice and does not replace a licensed clinician, and a clinician is involved only where a feature of the service explicitly says so.

This policy applies to the information we handle when you create a Valdura account, use the app, connect a device, order labs, or otherwise interact with our services. It applies to our website at www.valdura.health and to the mobile app.

Who is responsible for your health information. Valdura Health LLC operates the Valdura platform and brand. Valdura is a direct-to-consumer, cash-pay service: it does not bill health insurance and does not submit any healthcare claim to a health plan, which is the activity that would bring a provider under HIPAA. For that reason Valdura is not a HIPAA covered entity. We have nonetheless chosen to protect your health information with safeguards modeled on HIPAA. Valdura Health LLC and Avellum Health Co LLC are affiliated companies under common ownership, and so are Avellum Health, LLC, Crystal Clear RX, LLC and Precision Pharma Corp, which this policy names where they send us or receive information about you. Avellum Health Co LLC is the shared-services company for Valdura and its affiliated companies: it runs payroll for the staff who work across those companies, holds the vendor accounts they share, and holds the Business Associate Agreements with those vendors. Under a written business associate and data protection agreement, Valdura relies on Avellum Health Co LLC's privacy and security program: its policies, procedures, technical safeguards, workforce, and training. Avellum Health Co LLC handles your information only on our behalf and on our instructions, as our processor (in California terms, our service provider). The agreements that cover the vendors handling your health data are a Business Associate Agreement held by Avellum Health Co LLC with each infrastructure vendor, with our AI provider, and with the phone vendor that carries the calls you make to our support team; a Business Associate Agreement that Valdura holds with Google for the company email that carries the messages you send us; and, for the pharmacy that packs and ships your collection kit, which is an affiliated company, the same written business associate and data protection agreement. Our payment processor handles your billing information rather than your health information, and is described in Section 4. Your enforceable privacy rights are set by consumer health-data laws, principally the Washington My Health My Data Act and CCPA/CPRA, and we commit to the practices described in this policy. When this policy refers to what "we" do with your information, it refers to Valdura operating under this program.

Valdura is intended only for adults 18 years of age and older. See the "Children" section below.

A note on emergencies: Valdura is not an emergency service and is not a substitute for professional medical judgment. If you are experiencing a medical emergency, call 911 or your local emergency number immediately.

A note on health-privacy laws: Valdura is not a HIPAA covered entity (see Section 1). This policy is nonetheless written to honor the spirit and substance of HIPAA, and your enforceable rights come from consumer health-data laws, including the Washington My Health My Data Act and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), where they apply to you. Valdura relies on the privacy and security program of its affiliated shared-services company, Avellum Health Co LLC, under a written business associate and data protection agreement (see Section 1). We commit to the data practices and protections described here.

2. Information we collect, and how we collect it

We collect the categories of information below. Much of this is information you provide directly. Some is generated as you use the service, and some comes from sources you connect.

Account and contact information. Your name, email address, phone number, date of birth, biological sex, and zip code. You provide this when you sign up and manage your account.

Event and booth contact information. If you give us your contact details at a live event, such as a conference booth, we collect your email address, the first name you give us, whether you told us you are an independent business owner with one of our partners, and which printed code or link you arrived from. We use it to send you the next steps you asked for, and, if you ask us to by checking the box, to send you occasional updates you can unsubscribe from at any time. This is contact information, not health information, and we do not collect any health information from you at an event.

Bloodwork and biomarker results. The results of any panel or add-on tests you buy from us, and any lab results you upload yourself. When you register a collection kit, we also keep the code printed on it and the date and time you tell us you collected your sample, and our lab partner tells us where your kit and your sample are on the way to the laboratory, including the tracking for the sample's return trip.

Connected devices, health apps, and your phone's health store. If, and only if, you choose to connect a source, we receive the health data that source holds about you. Nothing connects on its own, and you can disconnect at any time. There are two shapes, and they work differently:

• A device you connected with an account: an Oura ring or a Whoop band. You signed in at that provider and granted us permission there, and we fetch your data from that provider. Oura and Whoop are closed to new connections; existing connections keep syncing until our app update this month moves them to your phone's health app. The direct Garmin connection has been removed.
• Your phone's own health store, which is Apple Health on an iPhone and Google Health Connect on an Android phone. There is no cloud account here and nothing to sign into: you grant the Valdura app permission on the phone itself, the app reads from the store on your own device, and it sends us what it read. Apple and Google are not sent that data and get no access to your Valdura account. Your phone's health store holds what other apps and devices have written into it, which can include a watch, a smart scale, a fitness or nutrition app, a glucose sensor, or a cycle-tracking app, and what we read includes that. When you connect, we may also read up to one year of the data already in that store, not only what is recorded from then on. You can change or withdraw the permission at any time, in your phone's settings or in the app.

Data from Health Connect. Valdura's use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. We do not use it for advertising, and we do not sell it. We do not transfer it to anyone except as needed to provide the Valdura service to you, such as to the vendors in Section 4 that store it and run the assistant, or as the law requires. People at Valdura read it only with your consent, for security purposes, or as the law requires.

Phone health data is never used for marketing. We never use the data the Valdura app reads from Apple Health or Health Connect for marketing or advertising. Personalized marketing (Optional Consent 1 in our Member Authorization) does not cover it, even when you turn that consent on.

What these sources can send us. What actually arrives depends on the source, on the device you wear, on what other apps have written to your phone, and on what you allow, and some of these categories arrive only as we add support for them. So read this as the full range this permission covers, rather than as a description of what sits in your own account:

• Sleep: how long and when you slept, and the stage and quality detail a source provides.
• Heart and circulation: resting and daily heart rate, heart-rate variability, blood pressure, blood oxygen, respiratory rate, and the recovery, readiness, strain, or stress scores a provider calculates.
• Activity and fitness: steps, distance, floors, workouts and their detail, energy burned, active minutes, and fitness measures such as VO2 max.
• Body measurements and composition: weight, body fat, and measures such as height, lean mass, bone mass, body water, and metabolic rate.
• Cycle, fertility, and reproductive health: period days and flow, spotting, ovulation test results, cervical mucus, basal body temperature and overnight temperature trend, pregnancy test results, sexual activity, and menopausal state. See "Reproductive and sexual health information" below, which explains how we handle this category and the limits we hold ourselves to.
• Metabolic and nutrition data: blood glucose, the food and drink you logged in another app and the nutrients in it, and water.
• Mental state and behavior: mood or state-of-mind entries, mindful and meditation sessions, alcohol and other substance use, and time in daylight.
• Symptoms, medications, and findings from a device: symptoms logged by you or by another app, medications and the doses you recorded, and coded findings a consumer device produces, such as sleep apnea events, breathing disturbances, an irregular heart rhythm notification, an electrocardiogram classification, or a high blood pressure event. A finding from a consumer device is a signal, not a diagnosis, and we say so wherever we show one.
• What you wrote yourself in that app, such as the notes or tags you attach to a day. Free text can carry far more than a number does, so we treat it as health information whatever it happens to say.
• The details that travel with a reading: which app or device authored it and when it was recorded, and, for a provider you sign in with, the identifier or email address that provider uses for your account there. We use the authoring app to tell one source's account of a night from another's, so the same night is not counted twice.

We do not ask any connected source for the GPS route of a workout.

Self-reported health information. Health history, conditions, surgeries, allergies, family history, lifestyle details, and the goals you share with us, whether through intake, in a form, or in conversation with the AI assistant. It also covers what you log day to day: meals and their nutrition, water, weight and body measurements, workouts and the sets you record, supplements, peptides and medications with their doses and schedules, symptoms and how severe they are, your daily check-in including mood and energy, and any note you write alongside them.

Cycle, fertility, and pregnancy you log yourself. If you use our Fertility or Menopause Focus, or log this information anywhere in the app, we collect what you record: period days and flow, spotting, ovulation test results, cervical mucus, basal body temperature, pregnancy test results, sexual activity, and a pregnancy with its due date and anything you choose to note about it. The same categories can also reach us from a connected source, as described above. See "Reproductive and sexual health information" below.

What you publish in the community. If you choose to publish a post in the member community, we collect the text you write, the tags you pick for it, and the display name you chose to publish under. You decide what goes in a post, you decide whether to publish one at all, and you can take one down.

Seasons and circles you join. If you choose to join a habit season, we record that you joined, the team you are on, and, for each day of the season, whether you did each kind of thing the season counts (moved, logged a meal, took time to relax, kept a sleep habit), worked out from what you already log or connect, along with your own season totals. If you choose to join a circle a practice runs in Valdura, we record that you joined, any gathering you say you will attend, and any separate permission you give the practice to see your name.

What you share with a practice. If you choose to share data with a practice you work with, we record which kinds you chose, with which practice and for how long, and every time someone at the practice, or Valdura's assistant answering a licensed professional there, opens it. We also keep what the practice sends you through Valdura, such as a note a provider signs after a visit with you or a program like a workout routine. If you start sharing from a provider's page, we record that you did.

Live sessions and webinars. If you watch a live session or webinar in Valdura, we record which sessions you watch, and if you send a question to one, we keep what you wrote. If you join a webinar from a guest link a member shared with you, we collect the first name, email address and state you give us, and we record which member shared the link and whether you watched. Section 4 describes this under "Live sessions and webinars".

AI chat conversations. The text of your conversations with the AI health assistant, so the assistant can give you continuous, context-aware guidance, and so that a clinician can see the relevant parts where a feature explicitly involves one.

Uploaded documents and photos. Files you upload, such as lab PDFs and meal photos.

Answers to medical questions for a treatment you request. If you buy a treatment from our affiliated company Crystal Clear RX, LLC in Valdura, we collect the answers you give to the medical questions it needs, the consents you sign and the name you type to sign them. Section 4 describes them under "Treatments you buy from Crystal Clear in Valdura".

Messages you send us. When you write to our support team, report a bug, or send us a feature request from inside the app, we keep what you wrote and the contact details you wrote in with, and, for a report sent from the app, the page you were on and the kind of device you were using. If you leave a voicemail on our support line, we keep your phone number and the written transcript of what you said, and the recording itself stays with the phone system we use. People describe their health when they write to support, so we treat what you send us as health information whatever it happens to say.

Your app installations. When you sign in to the Valdura app on a phone, we record the installation so we can send you a notification: the push token the operating system issues for the app on that device, whether it is an iPhone or an Android phone, the name the phone gives itself, and the app version. That token addresses the app on a device, not you, and it tells us nothing about where you are or what you do in other apps.

Billing and payment information. When you buy a membership or a bloodwork order, our payment processor collects your payment card details directly at checkout, and we never see or store your full card number. We keep a record of what you bought, the current billing state of your membership, the identifiers our payment processor gives us so that a payment can be matched to your account, and, if you order a collection kit, the shipping name, address, and phone number you enter at checkout.

App usage information. Basic information about how you use the app, which we use to operate, secure, and improve the service. If you reach us from a link or printed code we published, such as a QR code at a conference booth, we also record the campaign tags carried on that link, the site you came from, and a one-way code derived from your network address and browser so that a repeat page view is not counted twice, all so we can tell which of our own materials brought people to us. Those tags describe the material, not you; the one-way code cannot be turned back into your network address and is never linked to your account or to any health information; we record all of this on our own servers; and, as above, we run no third-party advertising or analytics trackers.

Reproductive and sexual health information. Some of what is described above is information about reproduction and sexual activity: your cycle and its phase, period days and flow, spotting, ovulation and pregnancy test results, cervical mucus, basal body temperature, a pregnancy you record, menopausal state, and the fact that you logged sexual activity. The Washington My Health My Data Act and California law treat this as its own protected category of consumer health data, and so do we. We collect it only because you logged it or because you connected a source that holds it. It carries every right, safeguard, and deletion promise in this policy, and we never sell it and never share it for advertising. Two limits are worth stating plainly. When a sexual-activity log reaches us from a connected source, we deliberately do not read whether contraception was used; if you record that yourself in Valdura, we keep the choice you made. And we never present any of this as a method of avoiding pregnancy, because it is not one. When a court, a government agency, law enforcement or anyone else asks us for it, the stricter rule in Section 4 applies.

Information from affiliated companies and partners. Some of what we hold reaches us from a company you deal with, so that a membership, a price, a credit or a kit you chose works in Valdura. We use it for that purpose and to keep your account accurate. What each one sends us includes the following.

• Crystal Clear RX, LLC. If a Crystal Clear membership or role comes with Valdura access, Crystal Clear sends us your email address, your name, its own identifier for you, which group you are in with it (for example a member, a sales representative, or staff), and the storefront your membership came through. It sends these each night, when your access changes, and in the one-time, encrypted sign-in link it gives you to open Valdura. If you buy a collection kit on a Crystal Clear storefront, it sends us the order, including your email address, the kit, and the name, postal address and phone number it ships to. If you buy a protocol membership from Crystal Clear, it tells us which protocol program you paid for and its dates, and if you buy a treatment from Crystal Clear in Valdura, it tells us your price and where your order stands, as Section 4 describes under "Treatments you buy from Crystal Clear in Valdura".
• Avellum Health, LLC. If you are an Avellum patient, Avellum can send us your email address, its own reference for you, and whether you are currently paying it for a peptide protocol, so that we can apply the membership credit that comes with one and email you that offer. If you start a Valdura membership from Avellum, it sends your confirmed email address, its reference for you, the date it last confirmed that your partner program account qualifies for the member price (or that it has not), and whether you have earned free time, so that we can quote and open the right checkout. If you link your Avellum account to your Valdura membership for the member price, Avellum tells us whether your partner program account qualifies and when it checked, and keeps us up to date each day. If you buy a blood panel through Avellum and the payment is made through our payment account, we receive your email address and the order details so that we can send your confirmation. If you connect your Avellum account to Valdura, Avellum also sends us your Avellum orders, where your visits stand and the answers you give on its medical intake, as Section 4 describes under "Accounts connected to Avellum".
• A partner program you choose to link. If you arrive from a partner's store and choose to link your account there, the partner tells us its own identifier for the link, whether your account there is active, whether it qualifies for the partner's member price, and when it checked, and it checks again each night while the link lasts. It sends no name, email address or account number, and nothing about your health.
• Precision Pharma Corp. When it ships your collection kit, it tells us so, with the carrier, the tracking number and the codes printed on the kits in the box, as Section 4 describes.

Consumer health data. Much of what we collect (bloodwork and biomarkers, data from connected devices, health apps and your phone's health store, reproductive and sexual health information, the health history, symptoms, medications, meals, workouts and check-ins you log, AI conversations about your health, the questions you send to a live session or webinar, uploaded health documents, the answers you give to medical questions for a treatment you request, the medical intake answers, orders and visit status Avellum sends us when your accounts are connected, and the medication of a protocol program you bought) is "consumer health data" under laws like the Washington My Health My Data Act, and sensitive personal information under the CCPA/CPRA. We treat all of it as sensitive and handle it according to this policy and your authorizations.

We do not buy personal or health information about you from data brokers, and we do not run third-party advertising or analytics trackers that would collect information about you across other apps or websites.

3. How and why we use your information

We use your information for the following purposes, and not for unrelated purposes without your consent.

To provide the service. We use your data to power your AI health assistant, to explain your lab results in plain language, to track your biomarkers and health data over time (longitudinal tracking), and to generate recommendations tailored to you.

Clinician involvement. The AI health assistant provides general information and explanations. It is not medical advice and does not replace a licensed clinician, and you should consult your own clinician for medical decisions. A clinician in our advisor network is involved only where a feature of the service explicitly says so. When one is, that clinician sees the relevant parts of your information.

AI processing on a secured US rail. Our production AI inference runs on Anthropic's Claude API, in United States regions, on models that do not train on, or share, your data. We use it to run the assistant, to write your daily note and weekly recap, to build your plans, to read the lab reports, documents and meal photos you upload, to screen community posts before they publish, to answer a licensed professional's questions about the data you choose to share with their practice (using only that data), to sort the messages you send our support team by team and topic, and, when your Avellum account is connected and you allow it, to read the answers from your Avellum medical intake (see "Whether the assistant reads your Avellum medical intake answers" below). For a support email, what it reads includes your email address, the subject and the message; for a voicemail, the written transcript. It never reads the answers you give to the medical questions for a treatment you buy from Crystal Clear in Valdura. When your Avellum account is connected, it can read the copy of your Avellum orders and visits to answer you when you ask about them. Anthropic retains what it processes only briefly (up to 30 days, for security and abuse monitoring) and then deletes it. Anthropic processes this data under a Business Associate Agreement. The AI does not make clinical decisions autonomously. As described above, its output is general information rather than medical advice, and medical decisions belong with your own clinician.

We do not train AI models on your data. We do not use your personal information or your health information to train artificial intelligence models, ours or anyone else's, and our AI provider, Anthropic, does not use it to train its models either. Where this policy says we use your information to improve the platform, that never includes training an AI model on it.

Whether the assistant reads your phone's health data. The Valdura app asks whether your assistant may read the health data it brings in from your phone's health app (Apple Health or Health Connect). You can change your answer at any time in Settings in the app, under "Let your assistant read your health app data". If you say no, the assistant leaves that data out of its answers, your daily note, your weekly recap and your plans, and your charts still show it. Until you answer, the assistant can read the phone health data you connected. The assistant never reads the blood glucose readings from your phone, and the AI does not use data from a direct Oura connection.

Whether the assistant reads your Avellum medical intake answers. If your Avellum account is connected, the page "From your Avellum medical intake" in Valdura has a switch, "Let the assistant read these". It is on until you turn it off. While it is on, the assistant can use those answers to help you; while it is off, it leaves them out. Either way you can still read them on that page, and delete them.

Partner-routed recommendations. When we recommend a product, we may route you to a partner. As explained in the "How and with whom we share your information" section, our recommendation partners receive only de-identified, per-click attribution tokens (and, on a link to Crystal Clear, whether you use Valdura in Spanish), never your health data or stable identifiers.

Counting crisis referrals. Some states ask companies like ours to report each year how many times they referred someone to crisis help. So we count each time the assistant's reply, or the crisis line we show in place of a post or question, names 988 or the Crisis Text Line, 911 or Poison Control: one number per day, by the kind of resource and by where in Valdura it was shown. Nothing about you is kept with the count: not your name, not your account, and not the words you or the assistant wrote.

Service operations and security. We use your information to operate, maintain, secure, troubleshoot, and improve the platform, to prevent fraud and abuse, to keep audit logs, and to meet our legal and compliance obligations.

We do not use your information for third-party advertising, and we do not use third-party analytics trackers.

4. How and with whom we share your information

We share your information only in the limited ways described below. We do not sell your personal or health information, and we do not share it with third parties for their own advertising.

Service providers (subprocessors). We rely on a small set of vendors to run the platform, and each may use your data only to provide services to us. Our infrastructure vendors (Vercel, Neon, and Paubox) each operate under a signed Business Associate Agreement held by our affiliated shared-services company, Avellum Health Co LLC; our AI provider, Anthropic, operates under a signed Business Associate Agreement held by Avellum Health Co LLC; Precision Pharma, the pharmacy that packs and ships your collection kit, is an affiliated company and operates under the same written business associate and data protection agreement described in Section 1; and the two vendors that carry the messages you send our support team each operate under a signed Business Associate Agreement: Google Workspace, for email, under one that Valdura holds with Google, and Quo, for our phone line, under one held by Avellum Health Co LLC. Our payment processor, Stripe, Expo, which delivers the app's push notifications, and Mux, which streams live sessions and webinars, are the three vendors below that hold no Business Associate Agreement with us, because none of them receives health information: Stripe receives your billing information, Expo receives only what a notification needs, and Mux receives only your device's IP address and which session you watched. Our lab partner, which arranges the laboratory testing of the sample from your collection kit, receives nothing of yours until a written agreement covering your health information is in place with it. These vendors are:

• Vercel, for application hosting, including Blob object storage for the lab files and documents you upload.
• Neon, for our database.
• Anthropic, for AI inference on the Claude API (United States regions; models that do not train on your data; under a Business Associate Agreement), including sorting the messages you send our support team, as Section 3 describes.
• Paubox, for encrypted email.
• Google Workspace, for our company email. A message you send to a Valdura address arrives and is kept there, and our support team reads it there.
• Quo, for our support phone line. Quo holds the recording of a voicemail you leave and produces the written transcript we keep on your support ticket.
• Precision Pharma, for packing and shipping your collection kit. Precision Pharma is an affiliated company under common ownership with Valdura and operates under a signed Business Associate Agreement: the written business associate and data protection agreement described in Section 1. When you buy a kit, we send Precision Pharma our order reference, the storefront you bought from, the kit and quantity, the name and postal address the kit ships to, and, when we have one, a phone number for the shipping label, because the carrier requires one: the phone given with the order, or else the phone saved in your account. For a kit order we do not send your email address, and we do not send your date of birth, your biological sex, your lab results, your health history, the health data from any device, health app, or phone health store you connect, your cycle or other reproductive information, your uploaded documents, or your conversations with the assistant. Precision Pharma tells us back that the box shipped, with the carrier, the tracking number and the code printed on each kit in the box, so that each kit can be matched to the order it shipped on, and nothing else about you. You can see the day we released your shipping details to them in your own privacy log.
• Our lab partner, Better Human, Inc., for arranging the laboratory testing of the sample from your collection kit. Before your sample is tested, you accept a Consent to Testing and sign an Authorization to Release My Laboratory Test Results for that kit, which appoints Valdura as your agent to receive your results; your results are released to us only under that authorization, and you can revoke it under Lab test authorizations in Settings or by writing to privacy@valdura.health. If you revoke, we also give our lab partner your email address, so that it can tell you itself if a result needs urgent attention. A result that reaches us after you revoke is deleted without being used. When you register a kit with us, we send our lab partner what it needs to arrange the testing of your sample, and nothing else: your legal first and last name, your date of birth, your biological sex (the laboratory's reference ranges depend on it), the state you live in (so that a physician licensed in your state can order the test), the code printed on your kit, the date and time you collected the sample if you told us, the test, and a patient code we create at random so the laboratory can keep your orders together (it means nothing outside our lab partner). We do not send your email address (except when you revoke, as above), your phone number, your postal address, your health history, the health data from any device, health app, or phone health store you connect, your cycle or other reproductive information, your uploaded documents, or your conversations with the assistant. Our lab partner, the certified clinical laboratory that runs your sample, and the licensed clinician who authorizes the test use those details only to authorize, run, and report your test. Our lab partner tells us back where your kit and your sample are, and your results, which we add to your record. Nothing of yours reaches our lab partner until a written agreement covering your health information is in place with it, and nothing is sent for a kit you have not registered. You can see the day we sent your details to our lab partner in your own privacy log.
• Stripe, for payment processing. Stripe receives your email address, your card details (which you enter with Stripe directly, and which we never see or store), the shipping address you enter at checkout for a collection kit, and the information we attach to a checkout so that the payment can be matched to your account: your Valdura account identifier, the item you are buying, and the referral code recorded on your account when you signed up. Stripe does not receive your lab results, your health history, the health data from any device, health app, or phone health store you connect, your cycle or other reproductive information, your uploaded documents, or your conversations with the assistant.
• Expo, with Apple's push notification service and Google's Firebase Cloud Messaging behind it, for push notifications to the Valdura app on your phone, if you allow them. They receive the push token for the app on your device, a fixed sentence chosen only by the kind of update and your language (for example, "Your results are in"), and the name of the app screen to open. They never receive your name, a result, a value, or anything you wrote: the details stay in the app, behind your sign-in. You can turn notifications off in the app's settings or in your phone's settings at any time.
• Mux, for streaming live sessions and webinars and their replays. When you watch, Mux receives your device's IP address and which session you watched, never your name or your questions.

Who answers your support messages. Support for Valdura and its affiliated companies is run as one desk, under the written business associate and data protection agreement described in Section 1. A support staff member at Valdura, and today also at our affiliated company Precision Pharma, may read a message you send us in order to answer it, along with the contact details you wrote in with. Precision Pharma's support staff work these messages in their own queue; they hold no Valdura login and no access to your Valdura health record. Our support system uses our AI provider, Anthropic, to sort each incoming message by team and topic (see Section 3). When a question needs another team's own staff, our support staff can send it on, one ticket at a time: to the escalations desk of our affiliated company Avellum Health, LLC, by email, with the ticket reference, your name, your email address and phone number if we have them, your question as our staff summarize it, and what we have already told you; or to Precision Pharma's own team, with the ticket reference, the subject and question as our staff write them, and, where needed, your order reference and your name.

Affiliated companies and partners, for what you chose. We share with the companies below only what each exchange needs to run a membership, a price, a credit, a connected account, a treatment or support you chose. None of them receives your lab results, your health history, your cycle or other reproductive information, the data from your phone or a device you connected, or your conversations with the assistant through these exchanges, apart from anything you wrote in a support message that our staff send on and the answers you choose to send with a request, described under "Accounts connected to Avellum" and "Treatments you buy from Crystal Clear in Valdura" below.

• Crystal Clear RX, LLC. For a membership that a Crystal Clear sales representative, a Crystal Clear patient record or a Crystal Clear storefront is tied to, we give Crystal Clear a record of each membership payment so that it can keep its accounts and pay its representatives. The record includes the payment's date, amount, discount, refunds and billing period, our payment processor's references for the invoice and the subscription, the representative's code, Crystal Clear's identifier for you, the storefront, and how the membership came to be tied to Crystal Clear. It does not include your name or email address. When Crystal Clear asks us to turn the access that comes with a Crystal Clear membership on or off, our answer can tell it that you already pay for Valdura yourself. For a treatment you buy from Crystal Clear in Valdura, see "Treatments you buy from Crystal Clear in Valdura" below.
• Avellum Health, LLC. When Avellum quotes or opens a Valdura membership checkout for you, we tell it the price, billing period and free days you would get, whether you are already a member, and whether a Valdura account on another email address is tied to the same Avellum patient. When Avellum sends us a protocol credit, our answer can tell it that you are already a Valdura member. If you hold the member price through an invitation or through our own staff rather than through Avellum, we send Avellum your email address and how you came to hold it, so that both companies keep the same record. Each night we ask Avellum whether the people who hold the member price through it still qualify, sending a keyed one-way code made from each email address rather than the address itself. A support question can also go to Avellum's escalations desk, as described above. If you connect your Avellum account, see "Accounts connected to Avellum" below.
• A partner program you choose to link. We send it only the one-time token from the link you followed and, while the link lasts, the token it issued for your link, so that it can tell us whether your account still qualifies. We send it nothing about you or your health.

Avellum Health Co LLC is not on this list because it handles your information only on our behalf, as Section 1 describes, and Precision Pharma's part is described above.

Accounts connected to Avellum. If you are a patient of our affiliated company Avellum Health, LLC, you can ask Avellum to keep your health information in Valdura by signing an authorization on Avellum. If you do, Avellum asks us to connect your Valdura account, or to open a free one for you, and from then on it sends us your Avellum orders, where your visits stand, and the answers you give on Avellum's medical intake once you sign it, so that your health information is in one place. Our assistant can read your medical intake answers to help you, unless you turn that off. We keep what Avellum sends only while your accounts stay connected, and we never use your medical intake answers for marketing or share them with our partners. Connecting is your choice, and not connecting changes nothing about your Valdura account. Here is what each part involves.

• Connecting the accounts. Once you have signed Avellum's authorization and confirmed your email address with Avellum, Avellum sends us that email address, your first and last name, the language you use on Avellum, Avellum's own reference for you, and a reference to the authorization you signed: its version, a fingerprint of its text, and when you signed it. We connect the Valdura account that uses that email address, or open a free Valdura account for you if there is none, and we email that account to say so. We tell Avellum whether we connected an account you already had or opened one, and how we found it. You accept our Terms and this policy yourself, the first time you open Valdura; nobody accepts them for you. Once we receive your information from Avellum, this policy applies to it.
• Your Avellum orders and visits. When you look at your Avellum orders in Valdura, we ask Avellum for your blood panel orders, with their status, shipping and tracking; your treatments, with their status, when they started, your next charge date and when they end; where each of your visits stands, in the same words Avellum shows you; Avellum's help contacts; and the address of your care portal, when you have one. We keep the last copy we receive so we can show it to you, replace it when it is refreshed, and delete it when your accounts are disconnected. Our assistant reads it only to answer your questions about your Avellum orders, and only the words your Avellum orders page shows you. Avellum never sends us your dose, your prescription, or notes or decisions from your care team. Beside a blood panel order, we show the progress of a collection kit you registered with us, from our own records.
• Your Avellum medical intake answers. When you sign a medical intake on Avellum, and again if Avellum's care team corrects an answer at your request, Avellum sends us your answers: your sex at birth, height and weight, and the conditions, surgeries, medications, allergies and goals you reported, each with its question as you saw it and the date you signed. An answer you typed in your own words arrives as you typed it. A medical intake you signed before your accounts were connected is sent once they are. Avellum never sends us your answers about mental health, suicidal thoughts, eating disorders, substance use, pregnancy, HIV, blood pressure or heart rate; the result you saw after you signed, or the reasons for it; any photo or document you sent; notes or decisions from your care team; your dose or other prescription details; your date of birth, address, phone number or the state you were in; or your payment card details. We show the answers to you, read-only, on the page "From your Avellum medical intake", where you can delete one intake or all of them; to change an answer, contact Avellum. Our assistant can read them to help you, as Section 3 describes, and you can turn that off on the same page. We never use them for marketing, and we do not share them with our partners or with any other company, apart from the vendors that run our service for us. We delete them when you delete them, when your accounts are disconnected, or when your account is deleted.
• Answers you choose to send to Avellum. When you start a medical request on Avellum from Valdura, you can choose to send it a few answers you already gave us, so you do not have to type them again: your sex at birth, your height, a weight you entered yourself in the last 30 days with its date, the medication and medication allergy lines you keep, and the treatment you chose to start. You see each one first and can leave any of them out, and nothing is sent unless you choose "Send these to Avellum". Avellum and the licensed clinicians at its care partner use them only to fill in that request, where you check each answer before you sign it. Avellum can pick them up once, within 7 days; if it does not, we delete them. After Avellum picks them up, we keep a record of which answers were sent and when, and delete the answers themselves. Until you sign the request on Avellum, you can withdraw them in Settings, under "Sent to Avellum", or by writing to privacy@valdura.health, and if Avellum already has them, we ask it to delete them. We never send your health conditions, lab results or readings from a device or health app this way.
• Signing in across the two. Where we offer it, on the web, you can go between Avellum and Valdura without signing in again. A one-time code, good for two minutes, tells the other company which account is signing in and nothing from your health record. Each company keeps its own sign-in, and signing out of one does not sign you out of the other. If you are already signed in to Valdura as someone else, we ask before we switch accounts.
• What we tell Avellum. Besides how we connected your account, we tell Avellum its own reference for you, the connection's reference and your language when we ask for your orders, the one-time code when you go to Avellum from Valdura, and that the connection ended when it ends. Apart from the answers you choose to send, as described above, we send Avellum nothing from your Valdura health record.
• Disconnecting. You can disconnect at any time in Settings on the Valdura website, stop sharing in your Avellum account settings, or write to privacy@valdura.health. Either way, sharing stops from then on, we tell the other company, and we delete the copy of your Avellum orders and every Avellum medical intake answer we hold. Your Valdura account stays open until you close it, and deleting it disconnects the accounts too. If you connect again later, Avellum sends your signed medical intakes again.

Treatments you buy from Crystal Clear in Valdura. Where we offer it, you can buy a treatment, such as a weight loss medication or a peptide, from our affiliated company Crystal Clear RX, LLC without leaving Valdura. Crystal Clear is the seller. A licensed clinician at a medical group affiliated with OpenLoop Health, Crystal Clear's telehealth partner, decides whether a treatment is right for you; Valdura does not sell the treatment and does not make that decision. To ask for one, you answer that medical group's questions in Valdura and sign your request, and we keep your answers and send them to Crystal Clear, which passes them to the medical group. We use your answers only for that request and to keep you safe, as described below. Our assistant never reads them, and we never use them for marketing. Here is what each part involves.

• What you give us. Your answers to the medical questions for the treatments you chose. Depending on the treatment, they can cover cancer, kidney and liver disease, heart history, diabetes, eating disorders, mental health including thoughts of suicide, substance use, pregnancy and breastfeeding, the medicines you take and your allergies, your height and weight, and your goals. You also tell us the state you are in when you ask, sign the consents the request needs, and type your name to sign. We fill in your name, date of birth, email address, phone number, sex at birth, height and a recent weight from your Valdura account, and you confirm each one. If a request asks for a photo, we pass it on and do not keep it.
• How we use them. They are the record of your request: we show them back to you, you can print them for your own doctor, and they are in the copy of your data you can download. They are locked once you sign. To correct one, you contact Crystal Clear's support team, and we hold the checkout for that request in the meantime. If an answer means a treatment may not be safe for you right now, we stop the request and, for a time, stop offering you these treatments anywhere in Valdura. We do not use your answers for anything else.
• What we send, and to whom. To show you a price and record your order, we send Crystal Clear your Valdura account reference and your membership standing: whether and through when you pay for Valdura, whether you came to Valdura through Avellum or a partner program or hold a price or credit from one, the storefront you came through, the partner and representative codes on your account, and Crystal Clear's own reference for you if you have one. That standing carries no health information, and Crystal Clear uses it to set your price. When you sign and submit your request, we send Crystal Clear your answers, the consents you signed and the name you typed, the state you are in, and your legal name, date of birth, sex at birth, email address, phone number and shipping address. Crystal Clear passes them, through OpenLoop Health, to the medical group, so that its clinician can decide on your request. Nothing of your answers is sent for a request you have not signed. Crystal Clear tells us back your price, your order's reference and, as your order moves, where it stands, so we can show you.
• Paying. You pay on a card form from Crystal Clear's telehealth partner, shown inside Valdura, and the charge is Crystal Clear's. We never see or store your card details.
• Protocol programs. A protocol membership you buy from Crystal Clear, in Valdura or on its own checkout, includes that medication's program in Valdura. To open it for you, Crystal Clear tells us which program you paid for: the medication's name, whether your protocol membership is running or has ended, the first day and the last day paid for, its own order reference, and your email address or your Valdura account reference. It never sends us your dose, who prescribed it, your answers to medical questions or any note about you. We use it only to open that program for you, and we keep it while your account is open.
• How long we keep them, and who else sees them. We keep your answers, the consents you signed and what we sent for as long as your account is open, and they are deleted with your account, as Section 5 describes. Apart from Crystal Clear, the medical group and the vendors that run our service for us, nobody receives them from us. Crystal Clear and the medical group keep their own records of your request, under their own privacy commitments and the health privacy rules that bind them, and deleting your Valdura account does not delete those.

Other members, and only what you publish yourself. The open member community is one space that every member can read; seasons, teams and circles are separate spaces you enter only by choosing to join them, as described below. When you publish a post in the open community, that post and the display name you chose are visible to every Valdura member, including members on a free account. Nothing else about you is shared with them: not your legal name, not your email, not your lab results, not your health history, not the health data from any device, health app, or phone health store you connect, not your cycle or other reproductive information, not what you write to our support team, and not your conversations with the assistant. We never publish anything on your behalf, and we do not put you in the community by default. Your display name is a name you choose for this purpose, and we never use the legal name you gave us for lab orders as a byline. You can take a post down at any time, which removes it from the community for everyone, and you can hide another member's posts from your own view. Because a published post is public to the membership, treat it the way you would treat anything else you say in a room full of people: once others have read it, taking it down does not unread it.

Seasons and teams you choose to join. Joining a season is your choice, and you can leave at any time. When you join, we place you on a team, or, where a season offers it, you join one with a code. A season counts that you did something (moved, logged a meal, took time to relax, kept a sleep habit), never a measurement. Your teammates and other members never see your own points, the days you took part, or anything from your health record. Team results are shown only as a coarse weekly level, only when at least 11 people contribute, and only when they are designed so that no one can be singled out by a small group of teammates comparing what they did. You can choose to show your display name to your team; it stays off unless you turn it on. We keep these figures in de-identified form and do not attempt to re-identify anyone from them.

Circles you choose to join. A circle is a space that a practice you know, such as a provider's office, a trainer or a gym, runs in Valdura for its own clients. Joining is your choice, with a code the practice gives you, and you can leave at any time. The practice sees only counts, such as how many members joined and how many say they will attend a gathering, shown only when there are at least 11 and rounded down; it does not see who you are. Only if you give it separate permission, on a screen of its own and for a period you pick, does the practice see the name you give it and the gatherings you say you will attend, and you can take that permission back at any time; every time the practice looks, we record it and show you. Other members of the circle see only what you post there, when the circle allows posts. Nothing from your health record is shared with the practice or with other members through a circle.

Practices you choose to share with. If a practice you work with, such as a dietitian, a chiropractor, a physical therapist, a trainer or gym, a med spa, or a physician's practice, invites you through Valdura, you can choose to share specific kinds of your data with that practice: your connected device data (daily sleep, resting heart rate, heart-rate variability and steps, from any wearable, health app or phone health store you connect), your food log, your daily check-ins, your lab results, your goals, or your workouts (the workouts you log, with their exercises, sets, reps, weights or times, and whether each came from that practice's program, never your notes or effort ratings). A wearable or food log share is shown in your time zone, so the practice also sees which time zone you are in. A practice can ask only for the kinds its type of license ordinarily uses; for example, a trainer or a chiropractor can never receive your lab results, and a dietitian receives only a nutrition-related subset of them. A daily check-ins share with a trainer, gym, med spa or massage therapist leaves out your mood and stress answers. You choose each kind separately and for a period you pick, on a screen of its own. You can also start sharing yourself from a provider's page in Valdura, without an invitation; when you do, the provider also sees your name and the email address on your account while you share, so they can get in touch with you. Nothing is shared by default, and a practice never receives your data because it pays Valdura, referred you to us, or is listed in our directory. A lab results share contains only markers such as cholesterol, blood sugar, blood count, iron, kidney and liver function, thyroid, vitamins and minerals, inflammation, and cortisol, from your five most recent panels, each labeled only by its date; it never contains reproductive or fertility hormone results, pregnancy tests, sexual-health or STI tests, or drug and alcohol screens. A goals share leaves out goals about fertility, pregnancy, menopause, sexual health, or alcohol and drug use. The practice and the people who work there can see only the kinds you chose, only while that period lasts, and never your conversations with the assistant, your documents, your notes or photos, or your cycle, pregnancy, or sexual-health information. Every time someone at the practice opens your data, we record who and when, and you can see that record in Settings. A licensed professional at the practice may also ask Valdura's AI assistant questions about the data you share with that practice; the assistant uses only that data, each time it reads it is recorded the same way and shown to you, and what it writes is kept for the practice only while you keep sharing. If a provider at the practice signs notes from a visit with you, Valdura stores them in your account under "From your providers", in the provider's words and under their name, and your own assistant may repeat what a signed note says when you ask, always saying it is your provider's note; you can hide a note from your own view at any time. You can stop sharing any kind of data, or everything, with a practice at any time in Settings, and it takes effect immediately; the practice is not notified. If you delete your account, all sharing ends at once. Stopping does not remove what the practice already saw or wrote in its own records, which the practice keeps under its own legal obligations. A practice may also send you programs, such as a workout routine; each arrives in your account under the practice's name, is yours to change, and stays yours if you stop working with that practice. Some practices are Valdura partners and receive a fee from Valdura if you become a member after they invite you; we tell you before you pay.

Live sessions and webinars. Members can watch live sessions and webinars in Valdura, including sessions with Dr. Calvin Wilson, our Clinical Advisor, and can send questions when a session takes them. A question you send goes to a Valdura moderator without your name. The moderator chooses which questions to read on air and may reword them so they say nothing about you; the hosts and everyone watching never learn who asked. We keep the link between you and your question so you can see it in your account and your data export, and so we can tell you when it was answered. We record which sessions you watch, so we know who attended. Sessions are recorded so members can watch the replay, and a recording shows only the hosts and their guests, never a member. Sessions are streamed by Mux, a video service: when you watch, Mux receives your device's IP address and which session you watched, never your name or your questions. A member can share a guest link to a webinar. A guest who uses it gives us their first name, email address and state; we record which member shared the link and whether the guest watched, and we use those details to run that webinar and to remind the guest of it. If the guest says yes, we may also email them about Valdura, and they can unsubscribe at any time.

Lab partners. The sample from a collection kit you register is run by our lab partner, as described above. Ordering a lab test through Valdura in any other way is not switched on; if it opens, we will describe the lab that handles it here first.

Connected devices, apps, and phone health stores. If you connected an Oura ring or a Whoop band directly, that provider shares your device data with us under your authorization until the connection moves to your phone's health app. Oura and Whoop are closed to new connections, and the direct Garmin connection has been removed. When you connect your phone's own health store (Apple Health on an iPhone, Google Health Connect on an Android phone), the data moves only one way: the Valdura app reads it from your own phone and sends it to us, and Apple and Google are not sent it. You control every one of these connections and can revoke any of them at any time.

Clinician advisor network. A clinician in our advisor network is involved only where a feature of the service explicitly says so, as described above. That clinician accesses only the information needed for that feature.

Recommendation partners (de-identified only). When you click a product recommendation, we route the click to a recommendation partner (the retail partner storefront tied to your membership for supplements; and, for peptide protocols, Avellum if you came to Valdura through Avellum or through our retail partner program, and otherwise Crystal Clear RX, LLC, at its own store or at the Crystal Clear storefront of the partner you joined through) for attribution. These partners receive only a de-identified, per-click attribution token, and a link to Crystal Clear also says when you use Valdura in Spanish, so that its site opens in Spanish. They do not receive your health data, your name, or any stable identifier that would let them recognize you across visits.

Legally required disclosures. We may disclose information when we are legally required to do so, for example in response to a valid subpoena, court order, or other lawful request, or where disclosure is necessary to protect the rights, safety, or security of our members, the public, or Valdura. Where the law permits, we will limit any such disclosure to what is required, and we disclose reproductive or sexual health information only under the stricter rule below.

Legal requests for reproductive or sexual health information. Your reproductive and sexual health information (described in Section 2) is held to a stricter rule. We disclose it to a court, a government agency, law enforcement, or anyone else seeking it for a legal matter only when the law requires us to, and only on a warrant or a court order. A subpoena alone is not enough. Before we disclose it, we tell you about the request, unless the law or the court forbids us to. We refuse a request from outside the state you live in that seeks information about reproductive or sexual health care that was lawful where you received it. This rule follows California Civil Code section 56.108 and Washington's shield law, and we apply it to every member, wherever you live.

Business transfers. If Valdura is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require the successor to honor this policy, and we will notify you of any change in who controls your information or any material change in how it is handled.

We do not sell your personal or health data, we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA, and we run no third-party ad or analytics trackers.

5. Your privacy rights and how to exercise them

You have the following rights regarding your information. These rights apply to all Valdura members, and they include the rights granted by laws such as the Washington My Health My Data Act and the CCPA/CPRA.

• Access and a copy. You can ask to access the personal and health information we hold about you and to receive a copy of it.
• The list of who received it. You can ask for the list of the third parties and affiliated companies we have shared your personal or health information with, with a way to contact each one.
• Deletion. You can ask us to delete your information, or delete your account yourself in Settings. We honor deletion requests without undue delay: your account closes right away, and your account and the health information in it are permanently deleted within 31 days of your request. Our encrypted backups are overwritten within 35 days after that. We ask the service providers and affiliated companies that hold copies of what you sent us, such as our support mailbox, our phone system and the support queue Precision Pharma's staff work in, to delete them, consistent with the Washington My Health My Data Act and similar consumer health-data laws. Some records are kept: our payment processor's payment records and our own billing records of your invoices and subscriptions, which are financial records; a pharmacy's prescription records, which Florida law requires the pharmacy to keep; the test records of the laboratory that ran your sample, which federal laboratory rules require it to keep; the consent to testing and the authorization you signed for each collection kit, with the details recorded when you signed (your name, date of birth, state, kit code, the date and time, and the network address or device you used), which our lab partner's agreement requires us to keep for ten years after your last kit order; the records Crystal Clear and the medical group keep of a treatment request you made, under their own policies and the laws that apply to them; and a de-identified audit trail, which does not identify you. If you remain a member of one of our affiliated companies, such as Crystal Clear RX, LLC, that company keeps its own records and may send us your name and email address again to keep the Valdura access that comes with your membership there, unless you ask it to stop.
• Correction and amendment. You can ask us to correct or amend information about you that is inaccurate or incomplete.
• Withdraw an authorization. Where we rely on your authorization (for example, to receive data from a connected wearable or health app, to let the Valdura app read your phone's health store, to keep your Avellum account connected, or to collect or share consumer health data), you can withdraw that authorization at any time. Withdrawing an authorization does not affect processing that already took place while it was in effect.
• Opt out of marketing. You can opt out of marketing communications at any time, including by using the unsubscribe link in any marketing email.
• Data portability and export. You can ask us to export your data in a portable, machine-readable format.
• Non-discrimination. We will not discriminate or retaliate against you for exercising any of these rights. Exercising a right will not cause us to deny you service, charge you a different price, or provide you a different level of service, except where a feature genuinely cannot function without the data in question (for example, AI guidance that depends on lab results you have asked us to delete).

How to exercise your rights. Send your request to privacy@valdura.health, which is also the mailbox for our Privacy Officer. We will verify your identity before acting on a request, to protect your information. You may authorize an agent to make a request on your behalf, and we may ask the agent for proof of authorization. We do not charge a fee for most requests. We respond within 45 days of receiving your request. If we need longer, we may extend that once by up to 45 more days, and we will tell you why within the first 45 days.

Appeals. If we decline your request, in whole or in part, you can appeal by replying to our decision or by writing to privacy@valdura.health with "Appeal" in the subject line. We answer an appeal in writing within 45 days of receiving it, and we tell you what we did and why. If we deny your appeal, you can complain to the attorney general where you live; in Washington, at www.atg.wa.gov/file-complaint. You may also have the right to lodge a complaint with another regulator in your jurisdiction.

Sensitive personal information. Much of what we hold, your health information included, is sensitive personal information under the CCPA/CPRA. We use and disclose it only for the purposes the CCPA/CPRA permits without a right to limit: to provide the service you asked for, to keep it safe, secure and working, to prevent fraud, and as the law requires. Because we use it for nothing else, we do not offer a separate link to limit its use. Optional Consent 1 in our Member Authorization asks whether we may use your health information to personalize marketing, and it never covers the data the Valdura app reads from Apple Health or Health Connect; we do not use sensitive personal information for that today, and we will offer a way to limit it before we do.

Washington, Nevada and Connecticut. Our Consumer Health Data Privacy Policy describes your rights under the consumer health data laws of those states, and we honor them for every member, wherever you live.

6. Data security

We protect your information with administrative, technical, and physical safeguards designed for sensitive health data. Our controls include:

• Encryption in transit and at rest. All connections are encrypted using TLS, and your data is encrypted at rest in our database.
• Field-level encryption of sensitive tokens. OAuth tokens for connected devices are encrypted at the field level using AES-256-GCM, and session tokens are stored only in hashed form.
• Role-based access control with audit logging. Access to health data is restricted by role, and every read and write of health data is recorded in an audit log.
• No autonomous clinical decisions. The AI assistant provides general information and explanations and does not make clinical decisions. Medical decisions stay with you and your own clinician.
• Written agreements with our vendors. The agreements covering our production data vendors are in place: a Business Associate Agreement with each infrastructure vendor (Vercel, Neon, Paubox), with our AI provider (Anthropic), and with our support phone vendor (Quo), each held by Avellum Health Co LLC; a Business Associate Agreement with Google for our company email (Google Workspace), held by Valdura; and, for the pharmacy that ships your collection kit (Precision Pharma), the written business associate and data protection agreement described in Section 1.
• Secure deletion. A scheduled job permanently purges a deleted account, and the health information in it, within 31 days of the request, and our encrypted backups are overwritten within 35 days after that.

No system can be guaranteed perfectly secure, but we work continuously to protect your information and to improve our safeguards. If you discover a security issue, please report it to security@valdura.health.

7. Data retention

We keep your information for as long as your account is active and as long as we need it to provide the service, to meet our legal and compliance obligations, to resolve disputes, and to enforce our agreements. When information is no longer needed for these purposes, we delete or de-identify it.

How long we keep each main category:

• Your account and the health information in it, including everything you log, upload, publish or write in Valdura, your conversations with the assistant and the messages you send our support team: for as long as your account is open, then deleted within 31 days of a deletion request.
• The consent to testing and the authorization you sign for each collection kit, with the details recorded when you signed: ten years after your last kit order, including after you delete your account, because our lab partner's agreement requires it. They hold no result.
• Access to a device you connected directly: until you disconnect it or delete your account.
• Your Avellum medical intake answers, and the copy of your Avellum orders and visits: only while your Avellum account stays connected. We delete them when you delete them, when the accounts are disconnected, or when your account is deleted.
• Sign-in sessions: until they expire or you sign out, and deleted with your account.
• App usage and operational logs: up to 13 months.
• A season's day-by-day record of what you did: 120 days after the season ends. Your own season totals stay with your account.
• The daily count of crisis referrals: kept for the state reports it supports. It holds nothing about any person.
• Our encrypted backups: overwritten on a rolling cycle of up to 35 days.
• Billing records: our own invoices and subscriptions, and our payment processor's payment records, are kept as financial records after an account is deleted.
• The de-identified audit trail: at least six years. It cannot be used to identify you.
• Records under a legal hold: for as long as the hold lasts.

When you delete your account or ask us to delete your data, we follow the deletion process described in "Your privacy rights". Our internal data-retention policy sets the detailed periods, and we update it as our practices and legal obligations change.

8. Where your information is processed (US data location)

Valdura is operated from, and stores and processes your information in, the United States. Our production AI inference runs in United States regions on Anthropic's Claude API. If you access the service from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your location.

9. Children

Valdura is intended only for adults who are 18 years of age or older. We do not knowingly collect personal or health information from anyone under 18. We ask for your date of birth before you start. If a date of birth entered anywhere in Valdura is under 18, the account is closed to the app and the assistant at once, and we do not keep that date: we record only when the account was closed. From the screen that explains this, you can sign out or delete the account, and if the date was a mistake, you can write to support from the account's email address to have it reopened. If you believe a minor has provided us with information, please contact us at privacy@valdura.health, and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we make a material change, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email before the change takes effect. If a change would require your consent under applicable law, we will obtain it. Your continued use of Valdura after an update means you accept the revised policy, except where your consent is separately required.

11. How to contact us

If you have questions about this policy or about how we handle your information, or if you want to exercise a privacy right, please contact us:

• Privacy and data-rights requests (Privacy Officer): privacy@valdura.health
• Security and incident reports: security@valdura.health
• General support: support@valdura.health
• Website: www.valdura.health
• Mailing address: Valdura Health LLC, 2750 Taylor Avenue, STE A84, Orlando, FL 32806

Valdura Health, a limited liability company. This version of the policy is effective October 26, 2026.