Privacy Policy

1. Introduction

Lumenality, operated by Lumenality ("we," "us," or "our"), is a practice management platform designed for healthcare organizations. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Lumenality platform ("Service").

2. Information We Collect

We collect information that you provide directly to us, including:

• Account Information: Name, email address, phone number, job title, and professional credentials.
• Organization Information: Practice name, NPI numbers, Tax ID, addresses, and contact details.
• Clinical Data: Patient demographics, clinical notes, treatment plans, diagnoses, and session documentation entered by authorized users.
• Billing Data: Insurance information, claims data, CPT codes, payment records, and revenue cycle information.
• Usage Data: Log files, IP addresses, browser type, device identifiers, access timestamps, and audit trail records.

3. How We Use Your Information

• Provide, operate, and maintain the Service.
• Process billing, claims, and payment transactions.
• Generate reports, analytics, and dashboards for your organization.
• Maintain audit trails and security logs as required by HIPAA and applicable regulations.
• Send administrative communications regarding the Service (e.g., updates, security alerts).
• Respond to support requests and provide technical assistance.
• Comply with legal obligations, including healthcare regulations.

4. HIPAA Compliance

Lumenality processes Protected Health Information (PHI) on behalf of covered entities. We act as a Business Associate under HIPAA and will enter into a Business Associate Agreement (BAA) with each covered entity customer. We implement administrative, physical, and technical safeguards to protect PHI in accordance with the HIPAA Security Rule, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls with multi-factor authentication.
• Comprehensive audit logging of all access to PHI.
• Regular security assessments and vulnerability scanning.
• Workforce training on privacy and security practices.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information or PHI. We may share information only:

• With Your Organization: Data is accessible to authorized users within your organization based on role-based permissions.
• Service Providers: Trusted third-party vendors who assist in operating the Service (e.g., cloud hosting, database management), bound by confidentiality obligations and BAAs where applicable.
• Legal Requirements: When required by law, subpoena, court order, or government regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with continued protection of your data.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Clinical and billing records are retained in accordance with applicable federal and state record retention requirements (minimum 7 years for medical records, or longer as required by state law). Upon account termination, we will provide data export capabilities and securely delete data in accordance with our data retention schedule and applicable regulations.

7. Data Security

We employ industry-standard security measures to protect your information, including encrypted database connections (SSL/TLS), secure authentication with MFA support, IP-based access logging, and regular security audits. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal information.
• Request a copy of your data in a portable format.
• Opt out of certain data processing activities.
• Lodge a complaint with a supervisory authority.

For PHI-related requests, please contact your healthcare provider directly, as they are the covered entity responsible for responding to individual rights requests under HIPAA.

9. Cookies and Tracking

Lumenality uses essential cookies for authentication and session management. We do not use third-party advertising cookies or tracking pixels. Session tokens are stored securely and expire after a configurable period of inactivity.

We use HeyCatch, a third-party analytics service, on our public marketing website (lumenality.app) to understand how visitors use it. It records pages viewed, clicks, that a form was submitted (not what you typed), device and browser type, and IP address, and it sets a cookie in your browser to recognize return visits. It is not used in the Lumenality application or any customer environment and never receives patient information. We do not respond to browser Do Not Track signals.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective Date." Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Lumenality
Email: privacy@lumenality.app
Web: lumenality.app