Privacy Policy

1. Overview

Audrova Health, a Drese Co. LLC Company (“Audrova,” “we,” “our,” or “us”), operates the audrova.com platform and related telehealth services.

This Privacy Policy applies to all information collected through our website, mobile applications, waitlist forms, intake questionnaires, and any other service we operate (“Services”).

2. Information We Collect

Information You Provide

• —Contact information — name, email address, phone number
• —Account credentials — encrypted password, account preferences
• —Intake questionnaire responses — symptoms, health history, medications
• —Demographic information — date of birth, sex assigned at birth, state of residence
• —Payment information — processed through Stripe; we do not store card numbers
• —Communications — messages you send to support or Clinicians through the platform

Information Collected Automatically

• —Device and browser type, operating system
• —IP address and approximate geographic location (city/region level)
• —Pages visited, time spent on pages, referral source
• —Cookies and similar tracking technologies (see Section 9)

Information From Third Parties

• —Lab results — from partner diagnostic labs, transmitted to your Clinician
• —Pharmacy data — fulfillment confirmations from compounding pharmacies
• —Identity verification — if required for controlled substance prescribing

3. How We Use Your Information

We use collected information to:

• —Operate and improve the Audrova Health platform
• —Match you with an appropriate licensed Clinician for evaluation
• —Facilitate clinical consultations, lab coordination, and treatment protocols
• —Process payments and manage your subscription
• —Communicate with you about your account, appointments, and lab results
• —Send health-related educational content and protocol updates (you can opt out)
• —Comply with legal obligations, including DEA and state medical board requirements
• —Detect and prevent fraud, abuse, and unauthorized access
• —Conduct internal analytics to improve the platform experience

4. When We Share Information

We do not sell your personal information. We share information only in the following circumstances:

5. Health Information

Health information you share with Audrova — including intake questionnaire responses, lab results, and clinical communications — is sensitive and treated with heightened protections.

HIPAA Compliance. Audrova is committed to implementing full HIPAA compliance — including the Privacy Rule, Security Rule, and Breach Notification Rule — before establishing any patient-provider treatment relationships. During the current pre-launch / waitlist phase, health information is collected solely for intake purposes and is stored with commercially reasonable security measures.

We are in the process of entering into Business Associate Agreements (BAAs) with all vendors who may handle Protected Health Information (PHI). We will migrate to HIPAA-compliant data infrastructure prior to clinical launch.

You have the right to request a copy of your health information, correct inaccuracies, and request deletion of your data (subject to legal retention requirements). See Section 8 for how to exercise these rights.

6. Data Security

We implement technical and organizational measures to protect your information, including encryption in transit (TLS), encryption at rest, access controls, and activity monitoring.

No method of transmission over the internet or electronic storage is 100% secure. While we take data security seriously and apply industry-standard practices, we cannot guarantee absolute security.

If we discover a data breach that affects your information, we will notify you and applicable regulatory authorities within the timeframes required by law.

7. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

Medical records and prescription-related information may be subject to minimum retention periods under federal and state law (typically 7–10 years depending on jurisdiction). Even if you cancel your account, we may be legally required to retain certain health records.

Waitlist-only information (email, intake responses) that has not been used for a clinical consultation may be deleted upon written request, subject to the exceptions above.

8. Your Rights

Depending on your state of residence, you may have the right to:

• —Access the personal information we hold about you
• —Correct inaccurate or incomplete information
• —Request deletion of your personal information (subject to legal exceptions)
• —Opt out of marketing communications at any time
• —Receive a copy of your information in a portable format
• —Withdraw consent where processing is based on consent

To exercise any of these rights, email privacy@audrova.com. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Cookies & Tracking

We use cookies and similar technologies to operate the platform, remember your preferences, and understand how visitors use the site.

You can control cookies through your browser settings. Disabling certain cookies may affect platform functionality.

10. Children's Privacy

Audrova Health services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information to us, contact us immediately at privacy@audrova.com and we will delete it promptly.

11. Policy Changes

We may update this Privacy Policy as our services evolve and as legal requirements change. When we make material changes, we will update the “Last Updated” date at the top of this page and notify you via email. We encourage you to review this policy periodically.

12. Contact & Complaints

Questions, concerns, or requests regarding this Privacy Policy:

If you are a California resident, you may also have the right to file a complaint with the California Privacy Protection Agency (CPPA). Residents of other states may contact their applicable state data protection authority.