Privacy Policy

Effective June 22, 2026 · Last updated July 11, 2026

LumaraRx (“Lumara,” “we,” “us,” or “our”) is operated by Astra Software Labs LLP. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have. It applies to the Lumara mobile app, the Lumara clinic console, and the marketing website at lumararx.com (together, the “Service”).

1. Who we are

The Service is provided by Astra Software Labs LLP, based in New Jersey, United States, which acts as the data controller for information processed through Lumara. If you have any questions about this policy or your data, contact us at support@lumararx.com.

2. How HIPAA applies to Lumara

When you use Lumara on your own as a consumer, your use is governed by consumer privacy laws (such as GDPR, CCPA/CPRA, and the New York SHIELD Act) rather than HIPAA, because we are not acting as a healthcare provider or health plan.

When you connect to a clinic or healthcare provider through Lumara, and that provider is a HIPAA “covered entity,” Lumara acts as that provider’s Business Associate. In those cases we handle protected health information (PHI) under a Business Associate Agreement (BAA) and apply the safeguards HIPAA requires.

3. Where this policy applies

This policy covers three parts of the Service, which handle data differently:

• Lumara mobile app — where you log medications, doses, schedules, lab values, symptoms, and related information. Health data is protected on your device and in our systems as described below.
• Lumara clinic console — used by connected clinics and providers to view patient-authorized information and manage protocols. Access is governed by the applicable BAA and clinic agreement.
• Marketing website (lumararx.com) — an informational site that uses only privacy-respecting analytics and does not collect health data.

4. Key terms (plain English)

• Health data means information you enter or connect about your health — medications, doses and schedules, injection sites, symptoms, lab values, weight, and similar entries.
• Diagnostic data means anonymized, non-identifying technical information used to keep the app stable and secure (for example, crash reports and performance metrics).
• Aggregated or de-identified data means information that has been combined or stripped of identifiers so that it cannot reasonably be used to identify you.

5. Information we collect (and why)

• Account information (required) — your email address, used to create and secure your account and to send essential service communications.
• Profile information (optional) — a display name and similar profile details you choose to add.
• Health data (optional) — medications, doses, schedules, injection sites, symptoms, lab values, and related entries you choose to log. This data powers the Service’s core tracking, reminder, and trend features. You control what you enter.
• Apple Health / Health Connect (optional) — with your permission, Lumara reads selected data (such as weight and related metrics) from Apple Health or Health Connect on a read-only basis, solely to display observational trends inside the app. We do not write data back to these platforms. This data is never used for advertising, shared with third parties for marketing, used to determine eligibility for any product or service, or used to train AI models without your explicit consent.
• Clinic connection data (optional) — if you connect to a clinic or provider, we process the information needed to establish and maintain that connection and to share the data you authorize with your provider. This processing is governed by the applicable BAA.
• Payment and subscription information — subscriptions are processed by the Apple App Store (or another authorized payment processor). Lumara does not receive or store your full payment card details. We receive limited subscription status information needed to provide paid features.
• Device and diagnostic information — anonymized technical data such as device type, operating system version, app version, and crash and performance reports, used to keep the Service secure, stable, and functional.

6. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we process your information under one or more of the following legal bases: consent (for optional features such as health integrations), performance of a contract (to provide the Service you sign up for), legitimate interests (to keep the Service secure, prevent fraud, debug, and improve reliability), and legal obligations.

7. How we use your information

We use information to: provide and operate the Service; secure your account; deliver reminders and notifications you enable; display observational trends and calculations; provide customer support; develop and improve features; and comply with legal obligations.

We do not use your information for advertising, to build marketing profiles about you, or to sell your data. Calculators and insights are observational and educational only; they never make prescriptive medical recommendations.

8. Aggregated and de-identified data

We may create and use aggregated or de-identified data — for example, to publish general statistics or to support research — only where the data cannot reasonably be used to identify you.

9. How we protect your information

We apply administrative, technical, and organizational safeguards designed to protect your information, including:

• Encryption in transit using TLS 1.2 or higher, and encryption at rest.
• Device-level encryption of the local database using SQLCipher.
• Biometric app lock with automatic logout.
• Row-Level Security to isolate each user’s data.
• PHI scrubbing from application logs so health information does not appear in diagnostic records.

No method of transmission or storage is completely secure, but we work to protect your information using industry-recognized practices.

10. How long we keep your data

We retain your information for as long as your account is active. When you delete your account, we permanently delete your associated personal data within 30 days, except where we are required to retain limited information for legal or security reasons. Aggregated or de-identified data, which cannot identify you, may be retained.

11. How we share information

We share information only in these limited situations:

• With connected clinics or providers — only the information you authorize, when you choose to connect, under an applicable BAA.
• With vetted service providers (subprocessors) — who help us operate the Service (such as cloud hosting and infrastructure) and who are bound by contractual confidentiality and data-protection obligations, including BAAs where PHI is involved.
• For legal reasons — when required by law, subpoena, or valid legal process, or to protect the rights, safety, and security of our users and the Service.
• In a corporate transaction — if we are involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy and with notice where required.

We do not share your information with advertisers or data brokers.

12. We don’t sell your data — ever

We do not sell your personal information, and we do not share it for targeted advertising. Our revenue comes from subscriptions, not from your data.

13. Your privacy rights

Regardless of where you live, you can: access and export your data; correct inaccurate information; delete your account and associated data; opt out of non-essential communications; and disconnect health integrations at any time. You can manage most of these directly in the app, or contact support@lumararx.com. We respond to privacy requests within 30 days and may need to verify your identity before acting on a request.

14. California privacy rights (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request deletion or correction, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising. You will not be discriminated against for exercising your rights. To make a request, contact support@lumararx.com.

15. International data transfers

We are based in New Jersey, United States, and may process information on servers located in the United States or with service providers globally. Where required, we use appropriate safeguards, such as Standard Contractual Clauses, for international transfers.

16. Cookies and analytics

The marketing website uses privacy-respecting analytics. The clinic console uses essential cookies needed to keep you signed in and to operate the console. The mobile app does not use browser cookies. You can control cookies through your browser settings.

17. Children’s privacy

Lumara is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child, we will delete it.

18. Payments

Payments are handled by the Apple App Store, Google Play, or another authorized third-party payment processor. Lumara does not store your full payment card details. Your purchases are also subject to the applicable app store’s terms and privacy practices.

19. Medical disclaimer

Lumara is a tracking and education tool. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Calculators show how a value is derived; insights are observational, never prescriptive. Always consult a licensed healthcare provider before making any medical decision.

20. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last Updated” date above and, for material changes, provide notice in the app. The current version is always available at lumararx.com/privacy.

21. Contact us

Lumara is operated by Astra Software Labs LLP. For privacy questions or to exercise your rights, contact support@lumararx.com. We aim to respond within 30 days.