Privacy Policy

1. Overview

Valaria is a product of Reflect Memory Inc. ("we," "our," or "us"). Valaria helps clinics collect protocol information before a visit. The patient-facing check-in is designed not to collect names, dates of birth, phone numbers, or email addresses. We do not sell, rent, or trade personal data.

2. Patient check-ins

On the patient form we collect:

• Age range (not date of birth)
• Peptide or protocol name, dosage, duration, and self-reported outcome
• Optional free-text notes
• If the clinic includes a recognition prompt, the answer is stored as a one-way hash so later visits can be grouped without storing a name

We do not ask for name, birthday, address, phone, email, Social Security number, insurance ID, or other direct identifiers on the patient form. Clinics should not enter identifying information in notes. Check-in submissions are visible to the clinic that issued the link or QR code.

3. Clinic accounts

If you create a clinic account, we collect:

• Account information via our authentication provider (Clerk), typically email address and sign-in events
• Clinic profile details you provide (name, slug, branding, form configuration)
• Check-in submissions associated with your clinic, including optional room assignments you enter
• Technical data such as IP address and request logs for security and abuse prevention

4. How we use data

• Provide the Valaria check-in form and clinic inbox
• Authenticate clinic users and prevent abuse
• Respond to support requests
• Improve reliability of the service
• Comply with law

We do not use check-in content to train AI models or for advertising. Product analytics (for example PostHog and Google Analytics on the marketing site) measure site usage, not patient form answers.

5. Storage and security

Data is hosted on infrastructure we operate. Transmission uses HTTPS/TLS. Clinic access requires authentication. Recognition prompt answers are hashed before storage. We retain check-ins until the clinic deletes them or asks us to delete the account, and retain security logs for a limited period needed for debugging and abuse prevention.

6. Your rights

Clinic account holders may access, correct, or delete clinic profile data and request deletion of associated check-ins. Patients who used a clinic's form should contact that clinic first; we can help the clinic fulfill a deletion request. To exercise rights, contact hello@valaria.health.

7. Third-party services

• Authentication (Clerk): sign-in for clinic accounts
• Hosting: servers and TLS termination we operate for valaria.health
• Analytics: PostHog, Google Analytics, and optional advertising pixels on marketing pages

Each provider has its own privacy policy. We do not share check-in content with advertisers.

8. Healthcare disclaimer

Valaria is not an electronic health record and is not a medical device. The patient form is designed to avoid collecting direct identifiers. This policy is not a claim that Valaria is a HIPAA covered entity or that a Business Associate Agreement is in place. See also our Terms of Service.

9. Children

Valaria clinic accounts are not intended for users under 16. The patient form is intended for adult patients of participating clinics.

10. Changes

We may update this policy. Material changes will be posted here with a new "Last updated" date. Continued use after changes constitutes acceptance.

11. Contact

hello@valaria.health
Valaria · Reflect Memory Inc.