Consumer health data.

Section 01What this policy covers.

This policy describes how Lumetrix Labs Limited collects, uses, shares, and protects consumer health data in the Lumi app, and the rights you have over it. It applies to all US users and satisfies the Washington My Health My Data Act's requirement for a distinct consumer-health-data privacy policy. It supplements our general US Privacy Policy.

Section 02What we treat as consumer health data.

We treat the following as consumer health data ("CHD"):

• Daily mood logs and their intensity;
• Weekly S8 wellbeing self-assessment item scores, totals, severity bands, and the anxiety flag;
• Medication names, doses, and timing you enter, and your side-effect notes;
• Free-text diary entries and your chat messages to the extent they reveal mental or physical health information;
• The fact that you use a mental-wellbeing app, which can itself indicate a health condition.

We do not collect biometric identifiers, precise location, or health data from any source other than what you choose to enter.

Section 03How we collect it.

We collect CHD only directly from you, when you log a mood, complete an S8 check-in, add a medication, write a note, or chat with Lumi. We do not buy CHD, scrape it, or infer it from third-party sources.

Section 04Consent.

Before we collect CHD, we ask for your affirmative, opt-in consent, separately from any other terms, with a clear description of the data and purpose. Each health feature is optional — you can use parts of Lumi without entering health data, and you can withdraw consent at any time by stopping use of those features and deleting your data in Settings. Withdrawing consent does not affect processing already carried out.

Section 05How we use consumer health data.

We use CHD solely to provide the features you ask for — showing your mood and S8 trends, keeping your medication diary, generating your self-report ("Doctor PDF Report") for you to share with a clinician of your choosing, giving Lumi context for supportive conversation, and surfacing region-appropriate crisis resources. We do not use CHD for advertising, marketing, or profiling, and we do not use it to train AI models.

Section 06Who we share it with.

We share CHD only with processors who help us run the service under contract and may use it only on our instructions:

A current list of processors with access to CHD is available on request at hello@talktolumi.app. We do not sell consumer health data. We will not sell CHD, and would never share it for cross-context behavioral advertising; if we ever needed to sell CHD we would first obtain the separate, MHMDA-compliant valid authorization the law requires. We may disclose CHD if compelled by valid legal process or to protect someone's safety.

Section 07Your rights over consumer health data.

You have the right to:

• Confirm whether we collect, share, or sell your CHD and access it (export as JSON in Settings);
• Obtain a list of the third parties and affiliates with whom we have shared your CHD;
• Withdraw consent to collection and sharing;
• Delete your CHD. Deleting your account in Settings erases your CHD from our active systems and instructs our processors to delete it; we honor deletion requests within the statutory timeframe.

To exercise these rights, use the in-app controls (Settings → Export all my data / Delete my account) or email hello@talktolumi.app. We will not discriminate against you for exercising them, and we will authenticate requests before acting. If we deny a request you may appeal by replying to our response.

Section 08Where CHD is stored and how it is protected.

CHD is stored on Supabase servers in the EU (Ireland), encrypted in transit and at rest, isolated per user by row-level security. AI and voice processing keys are held server-side and never shipped in the app. If you use Lumi in the US, your CHD is transferred to and processed in the EU and other countries where our processors operate, under contractual safeguards.

Section 09Geofencing.

Lumi does not use geofencing around any healthcare facility, and we do not build or use geofences to identify, track, or collect data about consumers seeking health services.

Section 10Data deletion.

You can permanently delete your CHD at any time: Settings → Delete my account → Delete everything. See also our data deletion page.

Section 11Children.

Lumi is for adults 18 and older and applies an age gate. We do not knowingly collect CHD from anyone under 18.

Section 12Changes and contact.

We will post changes here with a new effective date.