Privacy Policy

Effective Date: September 3, 2026

This Privacy Policy (this “Policy”) describes how Vala, Inc., a Delaware corporation (“Vala”, “we”, “us”, “our”), collects, uses, discloses and otherwise processes the personal information described in this Policy, as well as the rights and choices individuals have regarding that personal information.

1. Introduction and Scope

This Policy applies when a person (“you” or “your”) visits our website at www.valaclaims.com (the “Site”), accesses or uses our web application (the “Application”), or otherwise interacts with us online or offline, including through our AI-enabled tools, subscription services, and other features or content available through the Site or Application (collectively, the “Services”).

Vala may process personal information in different capacities depending on the nature of the information and the circumstances in which it is processed. For example, Vala generally determines the purposes and means of processing personal information relating to its own business operations, such as account, billing, support, marketing, and Site information. By contrast, personal information submitted through the Services by or on behalf of a customer, including information relating to veterans, claimants, dependents, beneficiaries, or other individuals, may be processed by Vala on behalf of and at the direction of the applicable customer and subject to Vala’s agreement with that customer.

For users outside the UK and the EEA, your use of our Services and any dispute regarding our privacy practices are subject to this Policy and our Terms of Use, including the applicable provisions of our Terms of Use concerning limitations on liability and the resolution of disputes.

For information about the privacy choices you have regarding your personal information, please see Section 7, Your Privacy Choices, below.

If you are a resident of California, please also refer to Section 14, Additional Privacy Information for California Residents, for more information about the categories of personal information we collect and your rights under California privacy laws.

If you are a resident of Colorado, Connecticut, Utah, or Virginia, please also refer to Section 15. Additional Privacy Information for Colorado, Connecticut, Utah, and Virginia Residents below for more information about the categories of personal information we collect and your rights under these state privacy laws.

If you are located in the UK, EEA, or Switzerland, please also refer to Section 16, Additional Privacy Information for UK, EEA, and Swiss Residents, for more information about the personal information we process and your rights under GDPR.

Depending on how you interact or engage with us, we may provide you with other privacy notices containing additional details about our information practices. This Policy does not apply to personal information we process about our employees in the context of our employment relationship with them, where a separate privacy notice applies.

2. Personal Information We Collect

We collect personal information directly from you, automatically when you visit or use our Services, and from our business customers and other third-party sources. The personal information we collect varies depending on how you interact with us, your role in connection with the Services, and the information submitted to or processed through the Services.

a. Personal Information We Collect Directly from You.

In general, we may collect the following personal information from you:

Account and Business Contact Information. When you register for or use an account as an authorized user of one of our business customers, we may collect information such as your name, business email address, telephone number, organization, job title or role, account credentials, and account settings or preferences.

Subscription and Billing Information. When you or your organization purchases or subscribes to our Services, we may collect information such as your name, business contact information, billing address, subscription or plan information, transaction history, and other information relating to the customer account. Payment information may be collected and processed directly by our payment processing providers. We may receive information regarding a payment transaction, such as the amount, payment status, billing information, and the subscription or services purchased.

Communications and Support Information. When you contact us by email, telephone, text message, chat, or otherwise communicate with us, including to request technical or customer support, we may collect your contact information and the contents and records of those communications. We may also collect information you provide when responding to surveys or providing feedback about the Services.

Marketing and Newsletter Information. If you request information about Vala or our Services, subscribe to a newsletter or other marketing communications, register for a demonstration, or otherwise engage with our marketing activities, we may collect your name, business contact information, organization, job title or role, and information about your communications and marketing preferences.

b. Information Submitted to or Processed Through the Services.

Our business customers and their authorized users may submit the following personal information through the Services:

Claim and Claimant Information. When you use the Services to prepare, manage, or support claims for U.S. Department of Veterans Affairs benefits, you may enter or otherwise provide personal information relating to veterans, claimants, dependents, beneficiaries, or other individuals. This may include identification and contact information, military and service-related information, claims and benefits information, disability ratings, government identifiers, financial and household information, and other information relevant to a claim or benefit determination.

Uploading Documents and Records. When you upload documents or other materials to the Services, we may collect and process the personal information contained in those materials. Depending on the documents submitted, this may include military and service records, medical records, VA forms and correspondence, prior claims or decisions, supporting evidence, financial records, government identifiers, and other information relating to a veteran, claimant, dependent, beneficiary, or other individual.

Using AI-Enabled Features. When you use AI-enabled features of the Services, we may collect and process prompts, instructions, documents, records, and other information you submit or make available through the Services in order to provide the requested functionality and generate related outputs.

c. Personal Information We May Collect Automatically.

We automatically collect personal information related to your use of our Services, including from cookies, pixel tags, and other similar technologies, such as:

Device and Browsing Information. When you visit or use our Services, we may collect IP address, browser type, domain name, access times, date/time stamps, operating system, language, device type, unique ID, Internet service provider, phone carrier and manufacturer, application installations, mobile advertising identifiers, push notifications, referring and exiting URLs, clickstream data, and similar device and browsing information.

Activities and Usage. We may collect activity information related to your use of the Services, such as information about the links clicked, pages viewed, searches, features used, items viewed, time spent within the Services, keystrokes, mouse clicks, your interactions with us within the Services, and other activity and usage information. In addition, with your consent where required by applicable law, we may track information about the content that you view on our Services and we may share that with our vendors and others who perform services for us.

Location Information. We may collect or derive general location information about you, such as through your IP address.

For more information about our use of cookies and other similar technologies, please see Section 6. Cookies and Tracking below.

If you are a resident of the UK, EEA or Switzerland, please also see our UK/EEA/Swiss Cookie Policy here.

d. Personal Information We Collect from Other Sources.

Payment Information. When you make a purchase or payment through the Services, the vendors who we have engaged to perform payment processing services collect purchase and payment information from you to process your payment, such as your credit card number, information about your purchase and your payment history. These vendors in turn provide us certain information about your payment transaction and your purchase such as your name, the amount of your payment, the billing location and information about the plan you have chosen.

Government and Professional Credential Sources. We may receive personal information from government agencies, professional organizations, credential verification providers, and similar sources in connection with the Services. For example, we may receive information used to verify professional credentials or accreditation, or information accessed through authorized government data sources or integrations.

Other Sources. In addition, we may collect and receive personal information from other individuals, including customers, marketing and advertising agencies, analytics firms, social networks, telecommunications providers, and vendors who provide services to us. For example, we may receive personal information from our customers or from data analytics and marketing providers to reach prospective customers. In addition, if you log into our Services using any third-party credentials, we will receive from such third-party information about you, including your name, email address, profile picture and language preference.

3. How We Use Personal Information

We may collect, use, disclose and otherwise process the personal information that we have collected about you for the following purposes:

Services and Support. To allow you to create and maintain your account with us, provide, operate, maintain, and administer our Services, process information and materials submitted through the Services, communicate with you about your use of the Services, provide troubleshooting and technical support, respond to your inquiries and requests, and otherwise support your use of the Services.

Analytics and Improvement. To better understand how customers access and use the Services and our product and service offerings, and for other research and analytical purposes, such as to evaluate and improve our Services and business operations, to inform our marketing and promotion activities, to develop our Services and its features, and for internal quality control and training purposes.

Customization and Personalization. To tailor content we may send, suggest to you or display on the Services, including to offer location customization and personalized communications, help and instructions, and to otherwise personalize your experiences.

Communicate with You. To respond to your inquiries, send you requested materials and other information about our Services and offerings in which you think we may be interested, and to communicate about and as part of our Services. We may also use this information to send administrative information to you, for example, changes to our terms, conditions, and policies.

Marketing and Promotions. To send you newsletters and other marketing or promotional communications regarding Vala and our Services, events, or other offerings that may be of interest to you, and to measure and improve our marketing activities.

Research and Surveys. To administer surveys and questionnaires, such as for market research or user satisfaction purposes.

Security and Protection of Rights and Interests. To (i) protect the Services and our business operations, and to protect our rights or those of our stakeholders; (ii) manage and respond to actual and potential legal disputes and claims; (iii) prevent and detect fraud, unauthorized activities, unauthorized access, and other misuse; (iv) investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or unaffiliated entity, or violations of our Terms of Use, to the extent we believe necessary; and (v) otherwise establish, defend, or protect our rights or interests.

Compliance and Legal Process. To (i) comply with applicable legal or regulatory obligations, including as part of a judicial proceeding; or (ii) respond to a subpoena, warrant, court order, or other legal process. In addition, as part of an investigation or request, whether formal or informal, from law enforcement or a governmental authority.

Auditing, Reporting, and Other Internal Operations. To (i) conduct audits and assessments of our operations, privacy controls, security controls, financial controls, risk controls, and our compliance with legal obligations; (ii) conduct assessments of our general business and its operations, accounting, recordkeeping and legal functions; and (iii) maintain appropriate business records.

General Business and Operational Support. To (i) assess and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financings; (ii) administer our business, accounting, auditing, compliance, recordkeeping, and legal functions; and (iii) enforce company policies and procedures.

In addition, to the extent permitted by applicable law, we may combine the personal information we collect with information from publicly available and other sources for any of the purposes described above.

4. How We Disclose Personal Information

We may disclose the personal information we collect for the purposes described above and as follows:

Affiliates and Subsidiaries. We may disclose the personal information we collect to our corporate affiliates and subsidiaries.

Vendors and Services Providers. We may disclose the personal information we collect to vendors and to service providers who perform functions on our behalf, such as entities that provide payment processing, email transmission, survey administration, data hosting, analytics, marketing, and technical and customer support services.

Marketing and Analytics Providers. We may also disclose certain personal information, such as device and browsing history as well as activities and usage information, to marketing and advertising networks, data analytics providers, and other companies who provide marketing or analytics services on our behalf. For more information, please see Section 6. Cookies and Tracking below.

We may also disclose your personal information in the following circumstances:

Business Operations. We may disclose personal information to vendors and service providers that perform services on our behalf or support the operation of our business and Services, such as providers of cloud hosting and data storage, payment processing, communications, authentication, security, analytics, technical support, customer support, and other business and operational services.

AI and Technology Providers. We may disclose information submitted to or processed through the Services to technology providers that assist us in providing AI-enabled functionality, data processing, hosting, or other technical features of the Services. Information regarding certain service providers and subprocessors that support the Services may be made available upon request.

Business Transfers. If we or our affiliates are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may disclose or transfer the personal information we have collected from you to the other company. We may also disclose certain personal information as necessary prior to the completion of such a transaction, or other corporate transaction such as a financing or restructuring, to lenders, auditors, and external advisors, including attorneys and consultants.

Compliance and Legal Obligations. To comply with our legal and compliance obligations and to respond to legal process. For example, we may disclose personal information in response to subpoenas, court orders, and other lawful requests by government officials and law enforcement, including responding to national security or law enforcement disclosure requirements.

Security and Protection of Legal Rights and Interests. Where we believe doing so is necessary to protect the Services, our rights and property, or the rights, property, and safety of others. For example, we may disclose personal information (i) to prevent, detect, investigate, and respond to fraud, unauthorized activities, unauthorized access, illegal activities, and misuse of the Services, (ii) situations involving potential threats to the health, safety, or legal rights of any person or unaffiliated entity, or (iii) to enforce, detect, investigate, and take action in response to violations of our Terms of Use. We may also disclose personal information related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.

Other Customers or Authorized Recipients. We may disclose personal information to another customer or other recipient when directed or authorized by you, including where you transfer or share documents, records, or other information through the Services in connection with the transfer or management of a client matter.

5. Aggregate and Deidentified Information

Notwithstanding anything else in this Policy, we may use, disclose, and otherwise process aggregate and deidentified information related to our business and the Services with unaffiliated entities for quality control, analytics, research, development, and other purposes. Where we use, disclose or process de-identified data (data that is no longer reasonably linked or linkable to an identified or identifiable natural person, household, or personal or household device) we will maintain and use the information in deidentified form and not to attempt to reidentify the information, except in order to determine whether our deidentification processes are reasonable and adequate pursuant to applicable privacy laws.

6. Cookies and Tracking

We and our service providers use cookies, pixels, local storage objects, log files, APIs, and other technologies to automatically collect browsing, activity, device, usage and similar information. We use this information to, for example, analyze and understand how users of our Services access, use and interact with features of our Services, as well as to identify and resolve bugs and errors in our Services and to assess, secure, protect, optimize, and improve the performance of our Services. You have certain choices about our use of cookies and tracking within the Services, as described in this section. We may also aggregate such information to analyze trends and administer our Services. If you are located in the UK, EEA or Switzerland, more information regarding the information we collect through cookies and other tracking tools and how we use that information can be found in our UK/EEA/Swiss Cookie Policy here.

On the Public Site, Vala may use Meta Business Tools solely for optional advertising measurement. These technologies are not enabled unless you choose ‘Allow advertising measurement’ through Privacy Settings. You may change that choice through Privacy Settings at any time, and a browser Global Privacy Control signal suppresses optional advertising measurement. This implementation does not send veteran, claimant, medical, disability, benefits, claim-file, customer-record, form-content, free-text, or direct contact information to Meta, and does not use Meta Advanced Matching or hashed contact-data matching.

Cookies. “Cookies” are alphanumeric identifiers we transfer to your device through your web browser for tracking purposes. Some cookies allow us to make it easier for you to navigate our Services, while others are used to enable a faster log-in process, support the security and performance of the Services, or allow us to track activity and usage data within the Services.

Pixel Tags. Pixel tags (sometimes called web beacons or clear GIFs) are tiny graphics with a unique identifier, similar in function to cookies. While cookies are stored locally on your device, pixel tags are embedded invisibly within web pages and online content. We may use these, in connection with our Services to, among other things, track the activities of users of our Services, help us manage content, and compile usage statistics. We may also use these in our emails to let us know when they have been opened or forwarded, so we can track response rates and gauge the effectiveness of our communications.

Local Storage Objects. Local storage is a web storage mechanism that allows us to store data on a browser that persists even after the browser window is closed. Local storage may be used by our web servers to cache certain information in order enable faster loading of pages and content when you return to our websites and to associate your activity with your profile. You can clear data stored in local storage through your browser. Please consult your browser help menu for more information.

Analytics. We use tools operated by unaffiliated companies, such as Google Analytics, to evaluate usage of our Services. These unaffiliated analytics companies use cookies, pixel tags, and other tracking technologies to collect usage data about our Services to provide us with reports and metrics that help us evaluate usage of our Services, improve our Services, and enhance performance and user experiences.

To learn more about Google’s privacy practices, please review the Google Privacy Policy at https://policies.google.com/technologies/partner-sites. You can also download the Google Analytics Opt-out Browser Add-on to prevent your data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.

7. Your Privacy Choices

We make available several ways for you to manage your personal information, including choices regarding cookies, marketing and promotional communications, and your account information. Some of these choices are browser- or device-specific, which means you may need to set your preferences separately for each browser or device you use to access our Services. If you delete or block cookies, you may also need to reapply certain preferences.

Account Information. If you are a customer, you can review and update much of the personal information we maintain about you by emailing us at support@valaclaims.com.

Cookie Settings. To prevent cookies from tracking your activity on our Site or visits across multiple websites, you can set your browser to block certain cookies or notify you when a cookie is set; you can also delete cookies. The “Help” portion of the toolbar on most browsers will tell you how to prevent your device from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to delete cookies. Visitors to our Site who disable cookies will be able to browse the Site, but some features may not function. You can review or change your preferences for targeting cookies and tags on our websites by adjusting your cookie settings here

Marketing and Other Communications. You can opt out of receiving marketing emails from us by using the unsubscribe feature in any such email we send you.

Residents of California should read Section 14. Additional Privacy Information for California Residents below for information about additional rights under California privacy laws. Residents of Colorado, Connecticut, Utah, or Virginia, should also read Section 15. Additional Privacy Information for Colorado, Connecticut, Utah, and Virginia Residents below for more information about additional rights under relevant state privacy laws. UK, EEA and Swiss residents should read Section 16. Additional Privacy Information for UK, EEA and Swiss Residents below to learn about additional rights. For more information about our privacy practices and your privacy choices, you may contact us as set forth in the ‘Contact Us’ section below.

8. Use by Minors Not Permitted

Our Services are not directed to or intended for use by individuals under the age of eighteen (18), and we do not knowingly collect personal information directly from minors through their own use of the Services. However, our customers may submit personal information through the Services concerning minors, including dependents, beneficiaries, heirs, or other individuals, in connection with their use of the Services. We process such information as part of the information submitted to us through the Services and in accordance with our agreements with our business customers and applicable law. If you are a parent or legal guardian and believe that a minor has provided personal information directly to us through the Services in violation of applicable law, please contact us as described in Section 13, Contact Us.

9. External Links and Features

Our Services may contain links to unaffiliated websites or features. In addition, where permitted by applicable law, we may send you communications with links to unaffiliated third-party services or sites with content or information in which we think you may be interested. Any access to and use of such linked websites or features is not governed by this Policy, but instead is governed by the privacy policies of those unaffiliated entities. We are not responsible for the information practices of such unaffiliated entities, including their collection of your personal information. You should review the privacy policies and terms for any unaffiliated entities before using those websites or those features.

10. Security

We have implemented reasonable administrative, technical, and physical safeguards designed to protect the personal information we collect and process from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no security measures can guarantee absolute security.

You are also responsible for taking appropriate steps to protect the security of your account and your use of the Services, including maintaining the confidentiality of your account credentials, managing access to your account, using appropriate security controls for the devices and systems through which you access the Services, and ensuring that personal information is submitted to and accessed through the Services in a secure manner.

11. Protected Health Information and Other Regulated Information

Certain customers may use the Services to process information that constitutes protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). Where Vala processes PHI in a manner that causes Vala to act as a “business associate” under HIPAA, Vala’s processing of that PHI may be subject to one or more applicable business associate agreements (“BAAs”) with a customer or third parties. To the extent an applicable BAA governs Vala’s processing of PHI, that BAA will govern such processing and will control in the event of any conflict with this Policy regarding PHI.

Customers are responsible for determining whether HIPAA applies to their use of the Services, ensuring that their collection, use, disclosure, and submission of PHI through the Services complies with HIPAA and other applicable laws, and implementing appropriate administrative, technical, and physical safeguards in connection with their use of the Services. Customers are also responsible for managing access to PHI within their accounts and ensuring that their personnel use the Services in accordance with applicable legal and contractual requirements. To the extent a BAA to which Vala is bound requires a customer to enter into, comply with, or otherwise be bound by a BAA or corresponding HIPAA obligations in connection with its use of the Services, the customer agrees to do so.

Customers are responsible for ensuring that their collection, use, disclosure, submission, access, and other processing of information through the Services complies with all applicable privacy, confidentiality, and data-use requirements, including any requirements applicable to information obtained from the U.S. Department of Veterans Affairs or other government sources. Customers are also responsible for complying with any restrictions, authorizations, or other requirements applicable to their access to or use of such information.

12. Retention

Vala retains personal information we collect or process for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with our contractual and legal obligations, maintain the security and integrity of our Services, and establish, exercise, or defend our legal rights.

The period for which we retain personal information may vary depending on the nature of the information, the purposes for which it is processed, the terms of our agreements with our customers, applicable legal or regulatory requirements, and other relevant circumstances. Where personal information is subject to an applicable business associate agreement or other contractual retention or deletion requirements, our retention of that information will also be subject to those requirements.

We may retain certain information for additional periods where reasonably necessary to comply with tax, accounting, recordkeeping, or other legal obligations, to resolve disputes, prevent fraud or abuse, enforce our agreements, or establish, exercise, or defend legal claims.

Documents, records, and other materials submitted to, generated through, or otherwise processed using the Services, including claims documents and supporting records, may be retained for different periods depending on the applicable Service, account configuration, customer instructions, the nature of the materials, and the purposes for which they are processed. You are responsible for maintaining copies of any documents, records, or other materials that you are required to retain independently of the Services.

Where supported by the Services and subject to applicable contractual and legal requirements, customers may be able to access, download, or export certain documents, records, and other materials maintained through their accounts.

13. Changes to this Policy

This Policy is reviewed and updated periodically consistent with applicable law and to ensure it accurately describes our information practices. When we update this Policy, we will accordingly revise the “Last Updated” date at the top of this document.

If we make any changes to this Policy that materially affect our practices regarding use of personal information we previously collected, we will endeavor to provide users with notice, such as by posting prominent notice on our Services.

14. Contact Us

If you have questions or concerns regarding this Policy or the handling of your personal information, please contact us at support@valaclaims.com.

15. Additional Privacy Information for California Residents

This section of the Policy provides additional information for California residents and describes our information practices as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (“CCPA”). Depending on how you interact or engage with us, we may provide you with other privacy notices with additional details about our privacy practices.

Scope. This section applies to “personal information” as defined by the CCPA, whether collected online or offline. This section does not address or apply to our handling of personal information that is exempt under the CCPA, such as publicly available information or aggregated or de-identified information.

Categories of Personal Information Collected and Disclosed. While our processing of personal information varies based upon our relationship and interactions with you, the table below identifies, generally, the categories of personal information (as defined by the CCPA) that we have collected about California residents in the past twelve (12) months, as well as the categories of third parties to whom we may disclose this information for a business or commercial purpose.

[[VALA_PRIVACY_POLICY_TABLE]]

Sales and Sharing of Personal Information. California privacy laws define a “sale” as disclosing or making available personal information to a third party in exchange for monetary or other valuable consideration, and “sharing” as disclosing or making available personal information to a third party for cross-context behavioral advertising. Vala does not sell personal information. To the extent consented use of Meta Business Tools for advertising measurement on the Public Site is considered ‘sharing’ under the CCPA, you may opt out through Privacy Settings or a browser Global Privacy Control signal. We also do not use or disclose sensitive personal information for purposes that would require us to provide a right to limit such use or disclosure under the CCPA.

Sources of Personal Information. In general, we may collect personal information from the following sources:

From you;

From our customers and other users of the Services;

Internet service providers, operating systems and platforms;

Advertising networks, social networks, and data analytics providers; and

Government entities.

Purposes of Collection, Use, and Disclosure of Personal Information. As described in more detail in Section 3. How We Use Personal Information and Section 4. How We Disclose Personal Information, we collect, use, disclose and otherwise process the above personal information for the following business or commercial purposes and as otherwise directed or consented to by you:

services and support;

analytics and improvement;

customization and personalization

communicating with you;

marketing and promotions;

research and surveys;

security and protection of rights and interests;

compliance and legal process;

auditing, reporting, and other internal operations;

business transactions; and

and general business and operational support.

Sensitive Personal Information. Notwithstanding the purposes described above, we do not collect, use, or disclose sensitive personal information about you beyond the purposes authorized by the CCPA. We do not use or disclose your sensitive personal information other than as authorized pursuant to section 7027 of the CCPA regulations (Cal. Code. Regs., tit. 11, § 7027 (2022)).

Retention. For information regarding our retention practices related to your personal information, please see Section 11. Retention above.

Your Rights and Choices. The CCPA may provide you with specific rights regarding your personal information, subject to certain exceptions.

Know/Access: The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. The right to a copy of your personal data that we retain, in some cases in a portable (i.e., machine-readable, user-friendly) format.

Deletion: The right to the deletion of personal information that we have collected about you.

Correction: The right to correct inaccurate personal information that we maintain about you.

Opt-Out Rights: The right to opt out of the “sale” or “sharing” (as such terms are defined under the CCPA) of your personal information.

Limit Certain Uses and Disclosures of Sensitive Personal Information. The right to limit certain uses and disclosures of sensitive personal information; however, as noted above, we do not engage in uses or disclosures of “sensitive personal information” that would trigger such a right.

Right to Non-Discrimination: The right not to be subject to discriminatory treatment for exercising your rights under the CCPA.

Personal Information Processed on Behalf of Customers. Our customers may submit personal information through the Services concerning veterans, claimants, dependents, beneficiaries, or other individuals. To the extent we process such personal information solely on behalf of a customer as a service provider or contractor under the CCPA, the applicable customer is responsible for responding to requests to exercise CCPA rights with respect to that information. If you submit a request to us concerning personal information that we maintain solely on behalf of one of our customers, we may direct you to the applicable customer or assist that customer in responding to your request as required by applicable law.

Submitting CCPA Requests. California residents may exercise their CCPA privacy rights as provided below:

Requests to know/access, correct, and delete. You may submit a request to Vala to exercise your CCPA rights to know/access, to delete, and to correct your personal information held by us by submitting a privacy request to us via email at support@valaclaims.com.

We will take steps to verify your request by matching the information provided by you with the information we have in our records. You must complete all required fields on our webform (or otherwise provide us with this information via the above toll-free number). We will process your request based upon the personal information in our records that is linked or reasonably linkable to the information provided in your request. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual by contacting us via the above number or online using our webform. Authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

Requests to Opt Out. Our website responds to global privacy control—or “GPC”—signals, which means that if we detect that your browser is communicating a GPC signal, we will, subject to applicable law, process that as a request to opt that particular browser and device out of “sales” and “sharing” (i.e., via cookies and tracking tools) on our website. California residents may also opt out of any “sales” and “sharing” through cookies and other online tracking technologies on our website by adjusting your cookie privacy preferences for those technologies in our cookie preference manager, which you can access by clicking here. Note that if you come back to our website from a different device or use a different browser on the same device, you will need to enable GPC or set your cookie preferences for each browser and device you use to access our website. More information about GPC is available at: https://globalprivacycontrol.org/.

You may exercise the right to opt out of any “sales” and “sharing” in which we engage other than through cookies and online tracking technologies by submitting an opt out request via email at support@valaclaims.com.

Rights Under California Shine the Light Law. Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a “Shine the Light” request, email us at support@valaclaims.com and include in your request a current California address and your attestation that you are a California resident.

Contact Us. Please see the “Contact Us” section above.

14a. California Applicant Privacy Notice

This California Applicant Privacy Notice (the “Applicant Notice”) describes how Vala, Inc., a Delaware corporation (“Vala”, “we”, “our”, or “us”), collects and uses personal information relating to California residents who are external job applicants and potential candidates for positions with Vala (each an “Applicant”; “you” or “your”) and is intended to satisfy our notice and privacy policy requirements under the California Consumer Privacy Act (as amended, including by the California Privacy Rights Act)) and its implementing regulations (as amended) (together, the “CCPA”).

The information in this Applicant Notice is intended to provide an overall description of our processing of Applicant personal information. We may provide and make available to Applicants additional notices about our data practices, such as those covered by other laws (e.g., if we conduct a background check) and those that apply when Applicants browse and use the pages of our website. We encourage you to carefully read this Applicant Notice, together with any other privacy notice we may provide to you.

The personal information that we collect, and our use and disclosure of such personal information, may vary depending on the circumstances, such as the position(s) or location for which you apply, as well as the associated qualifications and responsibilities. In addition, if you visit one of our offices or locations, we may collect information as part of our onsite security.

a. Scope

This Applicant Notice applies, generally, to the Applicant personal information that we collect and otherwise process about Applicants in the context of reviewing, assessing, considering, managing, storing, or processing their applications or otherwise considering them for a position with us. Your use of our website, or submission of an application or other information through this website, is subject to our Privacy Policy and our Terms of Use, which include terms governing limitations on liability and the resolution of disputes; our Terms of Use are incorporated by reference into this Applicant Notice.

This Applicant Notice does not address or apply to our collection of personal information that is not subject to the CCPA, such as consumer credit reports and background checks, publicly available data, or other information that is exempt under the CCPA. This Applicant Notice also does not apply to the personal information we collect from contractors or employees, which is subject to different privacy notices.

b. Categories of Personal Information Collected and Disclosed

The table below generally identifies the categories of personal information about Applicants that we collect and have collected in the prior twelve (12) months, as well as the categories of other entities to whom we may disclose this information for a business or commercial purpose. In some cases (such as where required by law), we may ask for your consent or give you certain choices prior to collecting or using certain personal information.

Sales and Sharing of Personal Information. California privacy laws broadly define a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. We do not sell or share (as defined by the CCPA) personal information or sensitive personal information about Applicants that is the subject of this Applicant Notice, including those we know who are under the age of 18.

Sources of Personal Information. In general, we may collect the Applicant personal information identified in the table above from the following categories of sources:

Directly from you;

Recruiters and recruiting platforms;

Referrals and references;

Internet service providers;

Operating systems and platforms;

Government entities;

Social networks;

Publicly available information;

Service providers, representatives, and agents; and

Affiliates and subsidiaries.

Retention. Vala retains the personal information we collect only as reasonably necessary for the purposes described below or otherwise disclosed to you at the time of collection. For example, we will retain your information as necessary to comply with our tax, accounting, and recordkeeping obligations, or to consider you for additional positions (with your permission), as well as an additional period of time as necessary to protect, defend or establish our rights, defend against potential claims, and comply with our legal obligations.

c. Purposes for Collecting, Using, Disclosing and Processing Personal Information

Subject to applicable legal restrictions, generally we collect, use, disclose and process Applicant personal information as reasonably necessary for the following general purposes:

Recruiting, hiring, and managing, and evaluating Applicants. To review, assess, recruit, consider or otherwise manage Applicants, candidates, and job applications, including:

scheduling and conducting interviews;

identifying candidates, including by working with external recruiters;

reviewing, assessing, and verifying information provided, and otherwise screening or evaluating Applicants’ qualifications, suitability, and relevant characteristics;

extending offers, negotiating the terms of offers, and assessing salary and compensation matters;

satisfying legal and regulatory obligations;

communicating with Applicants regarding their applications and about other similar position(s) for which they may be interested;

maintaining Applicant personal information for future consideration; and

in support of our equal opportunity employment policy and practices.

Contacting You About Potential Positions. To identify other positions for which an Applicant may be suited or interested, and to contact Applicants about such positions. If you do not wish to be contacted about potential positions, please let us know using the contact information below.

Security and Monitoring. To monitor and secure our resources, network, premises, and assets, including:

to detect, prevent, investigate, and respond to security and privacy incidents;

managing physical and technical access controls;

maintaining and reviewing access and use in order to ensure the security and functioning of our systems and assets; and

to ensure the security and functioning of our systems and assets, and secure our offices, premises, and physical assets, including through the use of electronic access systems and video monitoring.

Health and Safety. For health and safety purposes, such as contact tracing or conducting appropriate screenings of Applicants prior to entering or accessing certain locations or premises.

Auditing, Accounting, and Corporate Governance: relating to financial, tax and accounting audits, and audits and assessments of our business operations, security controls, financial controls, or compliance with legal obligations, and for other internal business purposes.

M&A and Other Business Transactions. For planning, due diligence, and implementation of commercial transactions, e.g., mergers, acquisitions, asset sales or transfers, bankruptcy, reorganization, or other similar business transactions.

Defending and Protecting Rights. To protect and defend our rights and interests and those of third parties, including to manage and respond to job applicant and other legal disputes, to respond to legal claims or disputes, and to otherwise establish, defend, or protect our rights or interests, or the rights, interests, health, or safety of others, including in the context of anticipated or actual litigation with third parties.

Complying with Legal Obligations. Relating to compliance with applicable legal obligations (such as hiring eligibility, responding to subpoenas, and court orders) as well as assessments, reviews, and reporting relating to such legal obligations, including under employment and labor laws and regulations, Social Security and tax laws, environmental regulations, workplace safety laws and regulations, and other applicable laws, regulations, opinions, and guidance.

Sensitive Personal Information. Notwithstanding the purposes described above, we do not collect, use, or disclose sensitive personal information about Applicants beyond the purposes authorized by the CCPA (pursuant to Cal Civ. Code § 1798.121 and § 7027(m) of the CCPA regulations).

d. Your CCPA Rights

California Applicants have certain rights under the CCPA with respect to their personal information, subject to certain limitations and exceptions:

Know/access: the right to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.

Deletion: the right to request deletion of their personal information that we have collected about them.

Correction: the right to request correction of inaccurate personal information we maintain about them.

Opt Out of Sales and Sharing: the right to opt out of the sale and sharing of their personal information. However, as discussed above, we do not sell or share Applicant personal information that is the subject of this Applicant Notice, and so this right is not available to Applicants in relation to such information.

Limit Use or Disclosure of Sensitive Personal Information: the right to request to limit certain uses and disclosures of sensitive personal information. However, as discussed above, we do not use or disclose Applicant sensitive personal information beyond the purposes authorized by the CCPA, thus this right is not available to Applicants.

Non-Discrimination: the right not to be subject to discriminatory treatment for exercising their rights under the CCPA.

Submitting CCPA Requests. Applicants may exercise their CCPA privacy rights as set forth below:

Requests to Know/Access, Correct, and Delete. Applicants may submit a request to Vala to exercise their CCPA rights to know/access, to delete, and to correct their personal information held by us by submitting a privacy request via email at support@valaclaims.com.

We will take steps to verify your request by matching the information provided by you with the information we have in our records. Your request must:

Provide sufficient information that allows us to reasonably verify that you are either the person about whom we collected personal information or that you are an authorized representative (i.e., by completing all required fields on our webform, if you choose to submit a request in that manner).

Describe your request with sufficient detail, allowing us to properly understand, evaluate, and respond to the request.

In some cases, we may request additional information in order to verify your request or where necessary to process your request. Authorized agents may initiate a request on behalf of another individual through one of the above methods; authorized agents will be required to provide proof of their authorization and we may also require that the relevant Applicant directly verify with us their identity and the authority of the authorized agent.

e. Contact Us About This Applicant Notice

For additional details, or if you have questions regarding our use of your personal information as described in this Applicant Notice, you may contact us via email at support@valaclaims.com.

15. Additional Privacy Information for Colorado, Connecticut, Utah, and Virginia Residents

This section applies to the ColoPA, CPOMA, UCPA, and VCDPA (collectively, “State Privacy Laws”). For the purpose of this section, “Personal Data” means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal Data does not include de-identified data, publicly available information (as these terms are defined under the State Privacy Laws) or any other Personal Data otherwise excluded from the scope of the State Privacy Laws.

Please see Sections 2 (“Personal Information We Collect”) and 3 (“How We Use Personal Information”) for information about the categories of Personal Data we process as a controller and the purposes for processing such data. Additionally, please see Section 4 (“How We Disclose Personal Information”), for information about the categories of third parties to whom we disclose the categories of Personal Data described in Section 2.

If you are a Colorado, Connecticut, Utah, or Virginia resident, you may exercise the following rights with respect to your Personal Data (as this term is defined under the State Privacy Laws):

To confirm whether or not we process your Personal Data and request access to such data;

To delete Personal Data you have provided to us or that we have obtained about you;

To correct inaccuracies in your Personal Data;

To opt out of the sale of your Personal Data, and to opt out of the processing of your Personal Data: (i) for purposes of targeted advertising; and (ii) for certain types of profiling in furtherance of decisions that produce legal or similarly significant effect; and

To obtain a copy of your Personal Data in a portable and, to the extent technically feasible, readily usable format.

Please note that there are exceptions and limitations to each of the rights listed above. To exercise the right to know, correct, or delete, please contact us via email at support@valaclaims.com.

You may also opt out of any “sales” through cookies and other online tracking technologies on our website by adjusting your cookie privacy preferences for those technologies in our cookie preference manager, which you can access by clicking here. Note that if you come back to our website from a different device or use a different browser on the same device, you will need to enable GPC or set your cookie preferences for each browser and device you use to access our website. More information about GPC is available at: https://globalprivacycontrol.org/.

You may exercise the right to opt out of any “sales” in which we engage other than through cookies and online tracking technologies by submitting an opt out request to us via email at support@valaclaims.com.

Appeal Process

If you are a Colorado, Connecticut or Virginia resident and if we refuse to take action on your request, you may appeal this refusal within a reasonable period after you have received notice of the refusal. You may file an appeal by emailing us at support@valaclaims.com.

16. Additional Privacy Information for UK, EEA, and Swiss Residents

Why We Use Your Personal Information and Legal Basis. All processing and use of your personal information is justified by a ‘legal basis’ for processing. In addition, processing of sensitive personal information (such as health information) requires satisfying an additional condition, such as providing your explicit consent. In the majority of cases, processing will rely on one of the following legal bases:

Contract Performance: The processing is necessary to perform a contract with you or take steps to enter into a contract at your request, such as to enroll you as a member, fulfill a purchase order, perform our Services, or provide you our newsletter;

Legal Obligation: The processing is necessary for us to comply with a relevant UK, EEA or Swiss legal obligation;

Legitimate Interests: The processing is in our legitimate interests, which are not overridden by your interests and fundamental rights, such as to provide you with information and services requested by you on a non-contractual basis; or

Consent: You have consented to the processing.

We use your information, including your personal information, for the following purposes, relying on the legal bases set forth below:

Services and Support. To allow you to create and maintain your account with us, provide and operate our Services that you request, communicate with you about your use of the Services, including by text message or email, provide troubleshooting and technical support at your request, respond to your inquiries, and communicate with you about the Services at your request. Our legal basis is contract performance or taking pre-contractual steps at your request.

Analytics and Improvement. To better understand how individuals access and use the Services and our product and service offerings, and for other research and analytical purposes, such as to evaluate and improve our Services and business operations, to inform our marketing and promotion activities, to develop our Services and its features, and for internal quality control and training purposes. Our legal basis is our legitimate interests in improving our Services to boost audience engagement and sales, in order to grow our revenue.

Customization and Personalization. To tailor content we may send, suggest to you or display on the Services, including to offer location customization and personalized communications, help and instructions, and to otherwise personalize your experiences. Our legal basis is our legitimate interests in improving our Services to boost audience engagement and sales, in order to grow our revenue.

Communicate with You. To respond to your inquiries, send you requested materials and other information about our Services and offerings, and to communicate through text messages about and as part of our Services. We may also use this information to send administrative information to you, for example, changes to our terms, conditions, and policies. Our legal basis is contract performance or taking pre-contractual steps at your request.

Marketing and Promotions. For marketing and promotional purposes. For example, to send you promotional information about our Services, including by email, such as newsletters and other marketing content, and any other information you sign up to receive. We also may use certain information we collect to manage and improve our advertising campaigns so that we can better reach people with relevant content, for example through third-party platforms. If you have signed up to receive newsletters on our Site, our legal basis is consent. If you are a member or former member, our legal basis for processing your personal information is our legitimate interest in promoting our Services to boost audience engagement and sales, in order to grow our revenue.

Research and Surveys. To administer surveys and questionnaires, such as for market research or user satisfaction purposes. Our legal basis is our legitimate interests in improving our Services to boost audience engagement and sales, in order to grow our revenue.

Security and Protection of Rights and Interests. To (i) protect the Services and our business operations, and to protect our rights or those of our stakeholders; (ii) manage and respond to actual and potential legal disputes and claims; (iii) prevent and detect fraud, unauthorized activities, unauthorized access, and other misuse; (iv) investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or unaffiliated entity, or violations of our Terms of Use, where we believe necessary; and (v) otherwise establish, defend, or protect our rights or interests. Our legal basis is our legitimate interests in protecting our brand, reputation, and business, including by protecting our business and complying with applicable non-UK, EEA or Swiss laws at all times.

Compliance and Legal Process. To comply with applicable legal or regulatory obligations, including as part of a judicial proceeding; to respond to a subpoena, warrant, court order, or other legal process, or as part of an investigation or request, whether formal or informal, from law enforcement or a governmental authority. Our legal basis is our legitimate interests in protecting our brand, reputation, and business, including by complying with applicable non-UK, EEA or Swiss laws at all times. In the event that an obligation arises under UK, EEA or Swiss law, our legal basis is compliance with such UK, EEA or Swiss law.

Auditing, Reporting, and Other Internal Operations. To (i) conduct audits and assessments of our operations, privacy controls, security controls, financial controls, risk controls, and our compliance with legal obligations; (ii) conduct assessments of our general business and its operations, accounting, recordkeeping and legal functions; and (iii) maintain appropriate business records. Our legal basis is our legitimate interest in administering our business as effectively as possible, so as to maintain and improve profitability.

General Business and Operational Support. To (i) assess and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financings; (ii) administer our business, accounting, auditing, compliance, recordkeeping, and legal functions; and (iii) enforce company policies and procedures. Our legal basis is our legitimate interest in structuring and administering our business as effectively as possible, so as to maintain and improve profitability, and our interest in protecting our brand, reputation, and business, including by complying with applicable non-UK, EEA or Swiss laws at all times.

International Transfers of Personal Information. We are located in the United States of America. You may voluntarily provide your personal information to us via the Services, and the provision of your personal information to us in the United States is necessary for us to provide any Services, or take pre-contractual steps, that you request.

We may transfer or disclose your personal information to a recipient in a country outside the UK/EEA (third country), which may not offer a level of protection equivalent to that in the UK/EEA. In particular, we may transfer your personal information to service providers, or they may transfer personal information to us or to other service providers within the United States, which has not been deemed to provide adequate protection by the UK government, the European Commission or the Swiss data protection authority. Similarly, if you opt-in to cookies on our Site, your personal information will be shared with third parties in the United States. In such cases, we will take steps to ensure that appropriate safeguards have been taken (for example, by entering into data transfer agreements using the European Commission approved Standard Contractual Clauses and UK Information Commissioner (ICO) approved Addendum), to provide adequate protection for your personal information.

You have the right to request and receive a copy of documentation demonstrating that appropriate safeguards have been put in place in order to protect your personal information for transfer to a third country by contacting us at support@valaclaims.com.

Your Rights Regarding Your Personal Information.

Right to Access. You have the right to request access to and a copy of any of your personal information that we hold, and to obtain information about the processing of that data.

Right to Correct. We will take steps in accordance with applicable legislation to keep your personal information accurate, complete, and up to date. You are entitled to have any inadequate, incomplete, or incorrect personal information corrected (that is, rectified) or completed.

Right to Withdraw Consent. In the event your personal information is processed on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Data Portability. Where we are relying (as the legal basis for processing) upon your consent, or the fact that the processing is necessary to perform a contract to which you are party or to take steps at your request prior to entering a contract, and the personal information is processed by automated means, you have the right to receive all such personal information which you have provided us in a structured, commonly used, and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to Erasure. You are entitled to have your personal information erased under specific circumstances, such as where you have withdrawn your consent, where you object to processing based on legitimate interests and we have no overriding legitimate grounds (see below), or where personal information is unlawfully processed.

Right to restriction of processing. You have the right to restrict our processing of your personal information (that is, allow only its storage) where:

you contest the accuracy of the personal information, until we have taken sufficient steps to correct or verify its accuracy;

where the processing is unlawful but you do not want us to erase the personal information;

where we no longer need your personal information for the purposes of the processing, but you require such personal information for the establishment, exercise, or defence of legal claims; or

where you have objected to processing justified on legitimate interest grounds (see below), pending verification as to whether we have compelling legitimate grounds to continue processing.

Right to Object to Processing (Including Profiling) Based on Legitimate Interest Grounds. Where we are relying upon legitimate interests to process personal information, you have the right to object to that processing based on grounds related to your personal situation. If you object, we must stop that processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or we need to process the personal information for the establishment, exercise, or defense of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

Right to Object to Direct Marketing (Including Profiling). You have the right to object to our use of your personal information (including profiling) for direct marketing purposes, such as when we use your personal information to invite you to our promotional events.

You may opt out of receiving commercial emails from us by clicking on the opt-out or ‘unsubscribe’ link included in the marketing e-mails you receive. If you opt out of receiving promotional emails, we may still send you emails about your account, subscription, or any services you have requested or received from us.

Please contact us at support@valaclaims.com if you wish to exercise any of your rights, or if you have any enquiries or complaints regarding the processing of your personal information.

You also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of alleged infringement, if you consider that the processing of your personal information infringes applicable law. The authority for the UK is the ICO, available at https://ico.org.uk/global/contact-us/. A list of data protection supervisory authorities in the EEA is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

Contact Us

Our address is: 53325 Avenida Madero, La Quinta, CA 92253.

If you have questions or concerns regarding this Policy or the handling of your personal information, please contact us at support@valaclaims.com.

Our representative in the EEA is Data Protection Representative Limited (trading as DataRep). DataRep may be reached as follows:

Email: datarequest@datarep.com, quoting <Vala> in the subject line

Web: www.datarep.com/data-request

Mail: DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland 

You must address your letter to DataRep, not StapStyle, for the letter to reach our representative. Please refer clearly to Vala in your letter. 

Our representative in the UK is Data Protection Representative Limited (trading as DataRep). DataRep may be reached as follows:

Email: datarequest@datarep.com, quoting <Vala> in the subject line

Web: www.datarep.com/data-request

Mail: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom 

You must address your letter to DataRep, not Vala, for the letter to reach our representative. Please refer clearly to Vala in your letter.