Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Astra Software Labs LLP, which operates LumaraRx (“Lumara,” “we,” “us”), handles “consumer health data” as defined by the Washington My Health My Data Act, Nevada Senate Bill 370, the consumer health data provisions of the Connecticut Data Privacy Act, and similar laws. It applies to the Lumara app, the clinic console, and lumararx.com. It supplements our Privacy Policy, which describes all of our practices; where this policy gives you more protection, it applies.

This policy does not cover protected health information that Lumara handles for a HIPAA covered-entity clinic as its business associate under a Business Associate Agreement; that information is governed by HIPAA and that agreement.

1. Consumer health data we collect

• Medications and treatment — the medications, supplements, and other products you track; doses, schedules, reminders, injection sites, and vials; and protocols a connected clinic assigns to you.
• Symptoms and check-ins — symptoms you log, and daily check-ins such as mood, energy, and sleep.
• Measurements — weight, lab values, and notes you enter.
• Reproductive health — menstrual cycle information, only if you turn cycle tracking on.
• Wearable data — if you connect Apple Health or Health Connect: heart rate variability, resting heart rate, steps, weight, and sleep (read-only).
• Profile details — date of birth, gender, and goals you choose to add.
• Care relationships — the clinics you connect to or share a report with.
• The fact that you use Lumara — because Lumara is a medication and health tracker, we treat your account and app activity as consumer health data, even when it contains no health values. That includes the record of which advertising campaign, if any, led you to install the app, which we keep in our own database and do not share with advertising partners.

We do not collect precise location, and we do not set up geofences (virtual boundaries) around hospitals, clinics, or other places where health care is provided.

2. Why we collect and use it

To provide the Service you ask for: storing and syncing your entries; reminders; showing your history, trends, and calculations; connecting you with a clinic and sharing what you authorize; delivering reports you choose to share; supporting you; keeping the Service secure and working; and meeting legal obligations. We do not use consumer health data for advertising, to build marketing profiles, or to decide your eligibility for insurance, credit, employment, or anything else.

3. Where it comes from

From you, from your device, from health platforms you connect (Apple Health, Health Connect), and from a clinic you connect to (for example, a protocol it assigns to you).

4. Who we share it with

• Service providers (processors) that host, store, and run Lumara for us under contracts that limit their use to our instructions: our database and sign-in provider, our hosting provider, and providers that deliver email and push notifications (which carry no health details). They are named, with what each receives, in the vendor list in our Privacy Policy.
• Clinics, at your direction — the information you authorize when you connect to a clinic, and a progress report you choose to share.
• For legal reasons — when the law requires it, or to protect the safety and security of people and the Service.
• In a corporate transaction — as part of a merger, acquisition, or sale of assets, subject to this policy.

We do not share consumer health data with advertising partners. Because the fact that someone uses Lumara is itself treated as consumer health data, we note one more service provider here: our servers forward a short list of sign-up and purchase step names (for example, that an account was set up or a subscription started), tied to pseudonymous codes, to Google Analytics, which processes them for us under Google’s data-processing terms with its advertising features switched off. No medication, dose, symptom, measurement, or other health value is ever included. The app’s optional sign-up measurement event, which tells Google and Meta only that a device created an account, is never sent for sign-ups from Washington, Nevada, or Connecticut, even if the optional box is ticked, and is not sent when we cannot tell where a sign-up comes from.

5. We do not sell consumer health data

We do not sell consumer health data, and we will not do so. We do not seek or accept anything of value in exchange for it.

6. Consent

We collect and use consumer health data only as necessary to provide the Service you request: each kind of information is something you choose to enter, or a health platform you choose to connect through your device’s own permission prompt. If we ever want to collect or use it for any other purpose, we will ask for your separate, express consent first, and we will not make that consent a condition of using Lumara. We share it beyond our service providers only when you direct us to — for example, by connecting to a clinic or sending a report — and each of those is a separate action you take for that purpose. You can withdraw at any time by disconnecting a clinic or health platform, deleting entries, withdrawing a shared report, or deleting your account.

The optional box on the app’s first screen, “Help measure Lumara’s ads (optional),” is separate from everything above, is not ticked unless you tick it, and does not apply to sign-ups from Washington, Nevada, or Connecticut.

7. Your rights

You have the right to:

• Know and access — confirm whether we collect, share, or sell your consumer health data, and get a copy of it.
• See who received it — a list of every third party and affiliate with whom we have shared your consumer health data, with their contact information.
• Delete it — we permanently erase your consumer health data from our live systems right away, tell our service providers and anyone we shared it with to delete it, and it rolls off our encrypted backups within no more than 30 days.
• Withdraw consent to our collection and sharing of your consumer health data.

You can do much of this in the app (More → Account to export or delete; Privacy & safety to manage sharing). Deleting your account erases your consumer health data — every medication, dose, check-in, reading, note, and other health entry — from our live systems right away, together with your identifiers; you do not need to ask separately. You can also ask by email at support@lumararx.com. Afterwards we keep only billing records and security records that contain no health information, plus a one-way code that stops a deleted sign-in from being reused. Copies a clinic made in its own records (for example, a report it downloaded) are the clinic’s own records, kept under its own legal obligations.

How to make a request

Email support@lumararx.com with the subject “Consumer health data request,” or write to Astra Software Labs LLP (a New Jersey limited liability partnership), mailing address 1280 Lexington Ave FRNT 2, New York, NY 10028, United States. We will verify your identity, usually by confirming control of your account’s email address. An authorized agent may make a request for you with your signed permission. We respond within 45 days of receiving your request. If we reasonably need more time, we may extend this once by up to 45 more days and will tell you why within the first 45 days. Requests are free, up to twice a year.

Appeals

If we decline your request, we will explain why. You can appeal within a reasonable time after our decision by replying to it, or by emailing support@lumararx.com with the subject “Consumer health data appeal.” Someone who did not make the original decision will review it, and we will respond in writing within 45 days of receiving your appeal, explaining what we did and why (we may extend this by up to 60 more days where the law allows, and will tell you if we do). If we deny your appeal, you may contact your state attorney general: in Washington, through the Washington State Office of the Attorney General’s online complaint form; in Nevada, the Nevada Attorney General; in Connecticut, the Connecticut Office of the Attorney General.

No discrimination

We will not deny you the Service, charge you a different price, or give you a lower quality of service because you exercised these rights.

8. How we protect consumer health data

We limit access to people who need it to run the Service, encrypt data in transit and at rest (including on your device), isolate each account’s data in our database, and keep health information out of logs, notifications, and analytics. More detail is in our Privacy Policy.

9. Changes and contact

We will update the date above when we change this policy, and give notice of material changes. We will ask for your consent before collecting or sharing consumer health data for a materially different purpose. Questions: support@lumararx.com, or Astra Software Labs LLP (a New Jersey limited liability partnership), mailing address 1280 Lexington Ave FRNT 2, New York, NY 10028, United States.