CLIA-validated labs, chain-hash audit logging, weekly OIG screening, physician compensation never tied to prescription volume, and escalation of critical results.
Your sample is processed by a CLIA-certified reference lab. Hormone markers are held to a higher bar: per-analyte validation for the collection method before any result clears into your portal.
All labs that process Pep Club samples are certified under the Clinical Laboratory Improvement Amendments, the federal standard for clinical lab testing.
Each result shows the lab's own reference range, with LOINC mapping committed to the portal before results release. Any target for your hormone levels is one your clinician sets for you.
At-home collection is not automatically equivalent to a conventional draw. For hormone panels, we require per-analyte validation on the collection method we ship before an assay's results are released to you.
Analytes that cannot be validated for at-home collection are routed to a conventional draw rather than reported with low confidence.
Protected health information is encrypted in transit and at rest, and access to it is controlled in the application by the caller's role. The platform uses chain-hashed audit logging for tamper detection.
Read and write access against protected health information can be recorded to an append-only audit log. Each row hashes the row before it, so a tamper attempt anywhere in the chain surfaces the next time the chain is verified.
Verification runs on cadence internally; admins can re-verify on demand.
HIPAA requires a written Business Associate Agreement with each service provider that handles PHI on our behalf. We maintain an internal register of those providers, including our database, identity, hosting, email, cache, and observability providers, and the status of each agreement.
Data is encrypted in transit and at rest. Access to patient records is controlled at the application layer: every request is gated on the caller's role.
Authenticated portal sessions idle-time-out automatically. Sensitive actions require recent authentication.
The admin compliance log is visible internally to our compliance team. A third-party penetration test is planned ahead of full-scale launch.
Health platforms attract special scrutiny for good reasons. Here is how we handle the rules that matter most to patients.
Our physician roster is cross-checked against the OIG List of Excluded Individuals and Entities (LEIE) at onboarding and again weekly, on an automated cron that runs every Sunday at 03:00 UTC.
Any match results in an immediate scheduling block pending compliance review.
Physicians working with The Pep Club are compensated on a basis that is never tied to prescription volume, product mix, or pharmacy routing.
Arora Health (the Group) is the separately owned professional entity, and the providers it engages deliver the clinical care. The Pep Club Inc. is the management services organization and provides no clinical service.
Outreach from a pharmacy to its existing patients about The Pep Club requires the specific authorization described by 45 CFR 164.508(a)(3). A generic pharmacy relationship is not enough.
When a value comes back critical, it is escalated to our team for review. Escalation workflows prioritize urgent findings.
Every commitment on this page is enforced in code, not a PDF. We publish our posture so you can check it.
See panels and pricing