Privacy Policy

This policy describes how Valor Veterans Services, a 501(c)(3) nonprofit organization (“VVS,” “we,” “us,” or “our”) handles information collected through this website. It applies to visitors who browse the site and to veterans and family members who contact us or submit records through our request form.

We handle two very different kinds of information, and we treat them differently throughout this policy:

• Contact information — your name, email address, phone number, and the subject and text of the message you send us.
• Health information — military service records, medical records, VA correspondence, and anything else you upload or describe about your conditions. We treat every one of these as protected health information and apply HIPAA-aligned safeguards to it, described in section 4.

Information you give us

When you use our request form, we collect your name, email address, phone number (optional), the subject you select, your message, and any files you choose to attach. Nothing on this site requires you to create an account, and we never ask for a Social Security number, VA file number, or payment card details through this website.

Information collected automatically

Our hosting provider records standard server logs — IP address, browser type, pages requested, and timestamps — as part of delivering and securing the site. We use these only to keep the site running and to investigate abuse or technical problems. We do not use them to build a profile of you, and we do not combine them with the health information you send us.

What we do not collect

This site runs no advertising networks, no third-party analytics, no social media tracking pixels, and no behavioral profiling of any kind. We do not buy information about you from data brokers.

We use what you send us only to:

• Respond to your request and discuss whether we can help with your claim.
• Review your service and medical history in order to prepare the documentation you have asked us for, such as a Nexus Letter or DBQ.
• Provide continuing support if you later need documentation for an appeal, a rating increase, or a new condition.
• Meet our legal, professional-licensure, and recordkeeping obligations.

We do not use your health information for marketing, and we do not sell it. We will not use or disclose it for any purpose beyond those listed above without your written authorization, except where the law requires or permits it.

The security of your records is a design decision, not an afterthought. Specifically:

• Files never pass through a shared folder. Uploads go directly from your browser into a private cloud storage bucket over an encrypted connection, using a one-time link that expires within minutes.
• Encrypted at rest. Every stored file and submission record is encrypted using managed encryption keys. Public access to the storage bucket is blocked entirely.
• Isolated per submission. Each request is written to its own folder with a server-generated identifier, so one submission can never reach or overwrite another.
• Staff access is authenticated and limited. Retrieving records requires a staff sign-in with multi-factor authentication, and staff credentials are scoped to read only what they need.
• Your records are never sent by email. When a request arrives, our staff notification contains only your name, the subject you chose, and a count of attached documents — no message text, no phone number, and no links to your files.
• Our storage provider is bound by agreement. We maintain a business associate agreement with the cloud provider that stores your records, and your data is kept in an environment dedicated to VVS rather than commingled with other organizations.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you as required by applicable law.

We do not sell, rent, or trade your information — ever. We share it only in these situations:

• With your direction. If you ask us to send documentation to the VA, an accredited representative, an attorney, or another provider, we do so at your request and, where required, with your written authorization.
• With service providers. A small number of vendors process information on our behalf under contract, and may use it only to provide services to us:

• When the law requires it. We may disclose information in response to a valid subpoena, court order, or other lawful process, or where disclosure is required to report suspected abuse or to prevent a serious and imminent threat to health or safety.

This site sets no advertising or analytics cookies. The only cookie we use is a sign-in session cookie for VVS staff accessing the internal submissions dashboard — it is never set for public visitors, and it holds no personal information about you.

Because we do not track visitors across sites, we have nothing to change in response to a browser “Do Not Track” signal.

You are in control of the information you have given us. You may ask us to:

• Provide a copy of the information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your information, subject to any records we are professionally or legally required to retain.
• Restrict how we use or disclose your information, or withdraw a consent you previously gave. Withdrawing consent does not affect anything already done under it, and may mean we can no longer complete your documentation.
• Receive an accounting of certain disclosures we have made.

To make a request, email us at VVSprovider@veteran-services.org or call (405) 653-0574. We will verify your identity before acting on a request and will respond within the timeframe required by applicable law. There is no charge for exercising these rights, and we will never retaliate against you for doing so.

We keep your records for as long as needed to provide the services you requested and to support any later appeal, rating increase, or follow-up claim — and after that, only as long as our professional and legal recordkeeping obligations require. Records that are no longer needed are securely destroyed. If you would like your information deleted sooner, contact us using section 12 and we will tell you what we can delete and what we are required to retain.

This website is intended for adults. We do not knowingly collect information from children under 13. If a child's health information is relevant to a veteran's claim, it should be provided by the parent or legal guardian. If you believe a child has sent us information directly, contact us and we will delete it.

Our site links to outside resources, including the payment platforms listed on our giving page and government resources such as VA.gov. Those services are operated by others and have their own privacy policies. When you donate through a third-party payment platform, your payment details go to that platform, not to us — we never receive or store your card or bank information.

We may update this policy as our services or legal obligations change. The “last updated” date at the top of this page always reflects the current version. If we make a material change to how we handle your health information, we will make a reasonable effort to notify you directly.

Questions about this policy, or about how your information is handled, go straight to us — not to a support queue.

• Email: VVSprovider@veteran-services.org
• Phone: (405) 653-0574

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.