Privacy Policy

Effective June 22, 2026 · Last updated September 10, 2026

LumaraRx (“Lumara,” “we,” “us,” or “our”) is operated by Astra Software Labs LLP. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have. It applies to the Lumara mobile app, the Lumara clinic console, and the marketing website at lumararx.com (together, the “Service”).

1. Who we are

The Service is provided by Astra Software Labs LLP, based in New Jersey, United States, which acts as the data controller for information processed through Lumara. If you have any questions about this policy or your data, contact us at support@lumararx.com.

2. How HIPAA applies to Lumara

When you use Lumara on your own as a consumer, your use is governed by consumer privacy laws (such as GDPR, CCPA/CPRA, and the New York SHIELD Act) rather than HIPAA, because we are not acting as a healthcare provider or health plan.

When you connect to a clinic or healthcare provider through Lumara, and that provider is a HIPAA “covered entity,” Lumara acts as that provider’s Business Associate. In those cases we handle protected health information (PHI) under a Business Associate Agreement (BAA) and apply the safeguards HIPAA requires.

3. Where this policy applies

This policy covers three parts of the Service, which handle data differently:

• Lumara mobile app — where you log medications, doses, schedules, lab values, symptoms, and related information. Health data is protected on your device and in our systems as described below.
• Lumara clinic console — used by connected clinics and providers to view patient-authorized information and manage protocols. Access is governed by the applicable BAA and clinic agreement.
• Marketing website (lumararx.com) — an informational site that does not collect health data. It uses privacy-respecting analytics and, on public pages, an advertising conversion-measurement tag (see “Cookies and analytics” below).

4. Key terms (plain English)

• Health data means information you enter or connect about your health — medications, doses and schedules, injection sites, symptoms, lab values, weight, and similar entries.
• Diagnostic data means anonymized, non-identifying technical information used to keep the app stable and secure (for example, crash reports and performance metrics).
• Aggregated or de-identified data means information that has been combined or stripped of identifiers so that it cannot reasonably be used to identify you.

5. Information we collect (and why)

• Account information (required) — your email address, used to create and secure your account and to send essential service communications.
• Profile information (optional) — a display name and similar profile details you choose to add.
• Health data (optional) — medications, doses, schedules, injection sites, symptoms, lab values, and related entries you choose to log. This data powers the Service’s core tracking, reminder, and trend features. You control what you enter.
• Apple Health / Health Connect (optional) — with your permission, Lumara reads selected data (such as weight and related metrics) from Apple Health or Health Connect on a read-only basis, solely to display observational trends inside the app. We do not write data back to these platforms. This data is never used for advertising, shared with third parties for marketing, used to determine eligibility for any product or service, or used to train AI models without your explicit consent.
• Clinic connection data (optional) — if you connect to a clinic or provider, we process the information needed to establish and maintain that connection and to share the data you authorize with your provider. This processing is governed by the applicable BAA.
• Payment and subscription information — subscriptions are processed by the Apple App Store (or another authorized payment processor). Lumara does not receive or store your full payment card details. We receive limited subscription status information needed to provide paid features.
• Device and diagnostic information — anonymized technical data such as device type, operating system version, app version, and crash and performance reports, used to keep the Service secure, stable, and functional.
• App interaction data (limited) — which general app screens you visit (for example, Home, Account, Billing, Settings) and that you logged a dose, completed a check-in, or asked our AI advisor a question. This is tied to a random identifier generated on your device, never to your name or email, and it never includes the content of what you logged — not which medication, not the dose, not any note or question text. Screens related to your medications, protocols, symptoms, cycle tracking, labs, or biometrics are never included in this data, and the underlying event (that you logged a dose, a check-in, or a question) is never sent outside Lumara at all — only the fact that a general app screen was visited. See “Cookies and analytics” below for who receives this.

6. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we process your information under one or more of the following legal bases: consent (for optional features such as health integrations), performance of a contract (to provide the Service you sign up for), legitimate interests (to keep the Service secure, prevent fraud, debug, and improve reliability), and legal obligations.

7. How we use your information

We use information to: provide and operate the Service; secure your account; deliver reminders and notifications you enable; display observational trends and calculations; provide customer support; develop and improve features; and comply with legal obligations.

We do not use your information for advertising, to build marketing profiles about you, or to sell your data. Calculators and insights are observational and educational only; they never make prescriptive medical recommendations.

8. Aggregated and de-identified data

We may create and use aggregated or de-identified data — for example, to publish general statistics or to support research — only where the data cannot reasonably be used to identify you.

9. How we protect your information

We apply administrative, technical, and organizational safeguards designed to protect your information, including:

• Encryption in transit using TLS 1.2 or higher, and encryption at rest.
• Device-level encryption of the local database using SQLCipher.
• Biometric app lock with automatic logout.
• Row-Level Security to isolate each user’s data.
• PHI scrubbing from application logs so health information does not appear in diagnostic records.

No method of transmission or storage is completely secure, but we work to protect your information using industry-recognized practices.

10. How long we keep your data

We retain your information for as long as your account is active. When you delete your account, we permanently delete your associated personal data within 30 days, except where we are required to retain limited information for legal or security reasons. Aggregated or de-identified data, which cannot identify you, may be retained.

11. How we share information

We share information only in these limited situations:

• With connected clinics or providers — only the information you authorize, when you choose to connect, under an applicable BAA.
• With vetted service providers (subprocessors) — who help us operate the Service (such as cloud hosting and infrastructure) and who are bound by contractual confidentiality and data-protection obligations, including BAAs where PHI is involved. This includes Google, which receives the limited app interaction data described in “Information we collect” above, for analytics purposes only, under Google's data-processing terms — see “Cookies and analytics” below for exactly what is and isn't included.
• For legal reasons — when required by law, subpoena, or valid legal process, or to protect the rights, safety, and security of our users and the Service.
• In a corporate transaction — if we are involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy and with notice where required.

We do not share your information with advertisers or data brokers.

12. We don’t sell your data — ever

We do not sell your personal information, and we do not share it for targeted advertising. Our revenue comes from subscriptions, not from your data.

13. Your privacy rights

Regardless of where you live, you can: access and export your data; correct inaccurate information; delete your account and associated data; opt out of non-essential communications; and disconnect health integrations at any time. You can manage most of these directly in the app, or contact support@lumararx.com. We respond to privacy requests within 30 days and may need to verify your identity before acting on a request.

14. California privacy rights (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request deletion or correction, and to opt out of the “sale” or “sharing” of personal information.

We do not sell your personal information, and we never share health information for advertising. Our public marketing pages do use one advertising conversion-measurement tag, which tells us when a visit that began with one of our ads led to someone creating an account. Because that tag reports to an advertising platform, California law treats it as sharing for cross-context behavioral advertising, and we disclose it as such rather than relying on a narrower reading. It reports that an account was created; it does not receive your name, your email address, or any health information, and it is never present in the Lumara app, anywhere in the clinic console, or on pages reached from a link in your email.

You can turn this off at any time: Do Not Sell or Share My Personal Information. We also honor Global Privacy Control signals automatically, and where a signal is present no advertising tag is loaded at all. You will not be discriminated against for exercising any of these rights. To make a request, contact support@lumararx.com.

15. International data transfers

We are based in New Jersey, United States, and may process information on servers located in the United States or with service providers globally. Where required, we use appropriate safeguards, such as Standard Contractual Clauses, for international transfers.

16. Cookies and analytics

The marketing website uses privacy-respecting analytics. The clinic console uses essential cookies needed to keep you signed in and to operate the console. The mobile app does not use browser cookies or any third-party analytics SDK — but it does send a limited set of first-party app-interaction data to our own servers, a narrow subset of which we in turn share with Google Analytics as described below. You can control browser cookies through your browser settings.

App analytics (mobile app). The Lumara app records, as first-party code with no third-party analytics or advertising SDK involved, which general app screens you visit and whether you logged a dose, completed a check-in, or asked our AI advisor a question — never the content of any of them. We use this ourselves to keep the app working well, and we also forward a narrower subset — general navigation screens only (for example, Home, Account, Billing, Settings), tied to a random per-install identifier and never to your name, email, or any health information — to Google Analytics for our own internal analytics. Screens related to your medications, protocols, symptoms, cycle tracking, labs, or biometrics are never included, and the fact that you logged a dose, a check-in, or a question is never sent to Google in any form. Google does not receive this data for advertising, does not combine it with its advertising identity graph (Google Signals is off for this data), and it is not linked to any Google Ads account. There is currently no in-app toggle to turn this off; we are adding one, and this policy will be updated when it ships.

Advertising measurement. Our public marketing pages at lumararx.com include a conversion-measurement tag from OpenAI, which tells us when a visit that began with one of our ads led to someone creating an account. It reports that an account was created; it does not receive your name, your email address, or any health information. This tag is deliberately not present on our password-reset, clinic-invite, or account pages while those pages carry a link from your email, and it is never present in the mobile app or anywhere in the clinic console. You can turn it off at any time via Do Not Sell or Share My Personal Information, and we honor Global Privacy Control signals automatically; either way, opting out does not affect your use of Lumara.

17. Children’s privacy

Lumara is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child, we will delete it.

18. Payments

Payments are handled by the Apple App Store, Google Play, or another authorized third-party payment processor. Lumara does not store your full payment card details. Your purchases are also subject to the applicable app store’s terms and privacy practices.

19. Medical disclaimer

Lumara is a tracking and education tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Calculators show how a value is derived; insights are observational, never prescriptive. Always consult a licensed healthcare provider before making any medical decision.

20. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last Updated” date above and, for material changes, provide notice in the app. The current version is always available at lumararx.com/privacy.

21. Contact us

Lumara is operated by Astra Software Labs LLP. For privacy questions or to exercise your rights, contact support@lumararx.com. We aim to respond within 30 days.