Quality and safety
CLIA-validated labs, a HIPAA-compliant stack with a chain-hash audit log, weekly OIG screening, Anti-Kickback Statute safe compensation, and physician outreach on every critical result.
Lab quality
Your sample is processed by a CLIA-certified reference lab. Hormone markers are held to a higher bar: per-analyte validation for the collection method before any result clears into your trend chart.
All labs that process Pep Club samples are certified under the Clinical Laboratory Improvement Amendments, the federal standard for clinical lab testing.
Reference ranges, optimal ranges, and LOINC mapping are committed to the portal before results release.
At-home collection is not automatically equivalent to a conventional draw. For hormone panels, we require per-analyte validation on the collection method we ship before an assay is released against our optimal ranges.
Analytes that cannot be validated for at-home collection are routed to a conventional draw rather than reported with low confidence.
Privacy and security
Every PHI access is written to a chain-hashed audit log so any backfill or deletion is detectable. Protected health information is encrypted in transit and at rest, and row-level policies isolate one patient's records from another's.
Every read and write against protected health information is recorded to an append-only audit log. Each row hashes the row before it, so a tamper attempt anywhere in the chain surfaces the next time the chain is verified.
Verification runs on cadence internally; admins can re-verify on demand.
HIPAA requires a written Business Associate Agreement with each service provider that handles PHI on our behalf. We maintain an internal register of those providers, including our database, identity, hosting, email, cache, and observability providers, and the status of each agreement.
Data is encrypted in transit and at rest. Patient records are isolated at the application layer: every request is gated on the caller's role and on a verified relationship to that patient, and every read of a record is written to the audit log.
Authenticated portal sessions idle-time-out automatically. Sensitive actions require recent authentication.
The admin compliance log is visible internally to our compliance team. A third-party penetration test is planned ahead of full-scale launch.
Regulatory posture
Health platforms attract special scrutiny for good reasons. Here is how we handle the rules that matter most to patients.
Our physician roster is cross-checked against the OIG List of Excluded Individuals and Entities (LEIE) at onboarding and again weekly, on an automated cron that runs every Sunday at 03:00 UTC.
Any match results in an immediate scheduling block pending compliance review.
Physicians working with The Pep Club are compensated on an hourly or per-consult basis. Compensation is never tied to prescription volume, product mix, or pharmacy routing.
Arora Health and Aesthetics, LLC (the Group) is the separately owned professional entity, and the providers it engages deliver the clinical care. The Pep Club Inc. is the management services organization and provides no clinical service.
Warm-base outreach from our affiliated pharmacy to eligible patients requires the specific authorization described by 45 CFR 164.508(a)(3). A generic pharmacy relationship is not enough.
When a value comes back critical, it is routed to a licensed physician for outreach. Escalation workflows prioritise urgent findings.
SLA enforcement tooling and visible countdown timers land in the next milestone.
Every commitment on this page is enforced in code, not a PDF. We publish our posture so you can check it.
See panels and pricing