Privacy Policy

1. Who we are and what this policy covers

Lumo is operated by Advanced Imagination Labs Inc. ("Lumo", "we", "us"). This policy explains how we handle personal information in the Lumo app for clients, the Lumo Portal for practitioners and clinics, and our website, including the waitlist.

Two roles. When you receive care from a dietitian or other nutrition professional who uses Lumo ("your practitioner"), the health information in your care is under your practitioner's (or their clinic's) responsibility. For that information, Lumo acts on their behalf, as a service provider, information manager, or agent, depending on the law that applies to them, and under an agreement with them. For your Lumo account, our website, and the waitlist, Lumo is responsible for your information directly.

2. Information we collect

Account and contact information

Your name, email address, password (stored only in hashed form), language, time zone, and the clinic or practitioner you are connected to.

Health and care information

• Information you or your practitioner add: care plans, goals, dietary needs and allergies, preferences, meal logs, check-ins, photos, and notes.
• Messages in your shared thread with your practitioner and Lumo, and your conversations with Lumo's AI assistant.
• Health data from connected apps, such as Apple Health, only if you choose to connect them.
• Documents your practitioner uploads, and session recordings and transcripts only if you give separate consent to recording.

Practitioner and clinic information

Professional details, clinic details, billing information (payments are handled by our payment processor; we do not store full card numbers), and activity in the Portal.

Technical and usage information

Device and app information, security logs, crash reports, and how features are used (for example, which screen was opened). We do not use session recording in the Lumo client app.

Website and waitlist

Your email address if you join the waitlist, and basic website analytics.

3. How we use information

• To provide Lumo to you and your practitioner: meal ideas, nutrition support, messaging, summaries, reminders, and the features you use.
• To power AI features within the plan and guardrails your practitioner sets (see section 4).
• For safety, for example to show safety information or surface a concern to your practitioner where configured.
• To keep Lumo secure: authentication, fraud and abuse prevention, access logging, and incident response.
• To support you when you contact us.
• To improve Lumo, using aggregated or de-identified information, or conversation content only if you choose to share it (see section 4).
• To communicate with you about your account, changes to our terms or this policy, and, if you agree, product news. You can unsubscribe from marketing email at any time.
• To meet legal obligations and enforce our terms.

We do not use your information to make decisions about you based exclusively on automated processing. If that ever changes, we will tell you and explain your rights.

4. Artificial intelligence and your information

How AI requests are processed

To answer a request, Lumo sends the relevant information to AI inference providers. We configure these providers for zero data retention: they process the request, return the result, and do not keep your information afterward. If a provider requires limited retention for security or abuse monitoring, it is limited to a short, fixed period (at most 30 days), and the information is not used for any other purpose.

No training of AI models

We never let AI providers use your information to train their models, and we do not use your identifiable health information to train foundation or third-party AI models.

Helping improve Lumo (optional)

You can choose to let us keep copies of your conversations with Lumo's AI to evaluate and improve its quality and safety. This is off unless you turn it on in Settings, and you can turn it off at any time. It does not affect your care or the features you can use. If you turn it on:

• before anyone uses a conversation, we remove or replace information that identifies you, such as names, contact details, addresses, dates, and ID numbers;
• the original copy is deleted automatically within 30 days, and the de-identified copy after 24 months;
• only authorized Lumo staff can access it, and every access is logged; and
• it is never sold, and never used to train other companies' AI models.

For practitioners, sharing is possible only when both your clinic and you have allowed it.

AI output

AI-generated content can be wrong or incomplete. Your practitioner remains responsible for your care. See our Terms and Conditions.

5. Consent and your choices

Health information is sensitive. We rely on your express consent, and on your practitioner's authority as the party responsible for your care, to process it. Optional uses, such as helping improve Lumo, product email, or session recording, are always separate choices that you can refuse or withdraw without affecting your care. You can withdraw consent at any time in the app or by contacting us. If withdrawing means a feature can no longer work, we will explain what changes.

6. Who we share information with

• Your practitioner and their clinic, as part of your care.
• Service providers who help us run Lumo, only as needed and under written agreements that require them to protect your information and use it only for our purposes:
  • cloud hosting and storage (Amazon Web Services);
  • AI inference, through an AI gateway (OpenRouter) and the model providers it routes to;
  • document text extraction for files your practitioner uploads (Google Cloud);
  • email delivery;
  • sign-in security and account protection (Better Auth), which processes sign-in and account events, including your email address, name, IP address and browser details;
  • sign-in with Google, and calendar sync for practitioners who connect their Google Calendar (Google);
  • push notifications to the Lumo app (Expo), which receives your device's notification token and the text of each notification;
  • product analytics (PostHog), limited to usage events and technical details, not your health information or message content;
  • error monitoring (Sentry), with personal information removed from error reports; and
  • payment processing for practitioners (Stripe).
• Tools your clinic connects. If your practitioner's clinic connects Lumo to another system it uses, such as its practice-management software, we send that system the information needed for the connection, at the clinic's direction.
• When required by law, or to protect someone's safety.
• In a business transfer, such as a merger or acquisition, under confidentiality commitments and only as the law allows.

We do not sell, rent, or trade personal information, and we do not share it with third parties for their marketing.

Google API data

Lumo follows the Google API Services User Data Policy and the Google Workspace API user data policy, including their Limited Use requirements, when using or transferring information received through Google APIs.

7. Where your information is stored

Lumo is operated from Quebec, Canada. Our servers are currently located in the United States (Amazon Web Services), and our AI and other service providers may process information in the United States. This means your information may be stored or processed outside Quebec and outside Canada, where it may be accessible to authorities under local law. Before transferring information, we assess whether it will be adequately protected, and our contracts require protections comparable to those in Canada.

8. How long we keep information

• Account and care information: while your account is active. When your access ends, you have 30 days to request an export. We then delete personal information from production systems within 90 days and from backups within 180 days, unless we or your practitioner must keep it longer by law.
• Optional improvement data: originals within 30 days; de-identified copies after 24 months.
• Security and access logs: up to 6 years, to meet security and legal obligations.
• Waitlist: until you ask us to remove you, or until we launch in your area.

Your practitioner may keep their own clinical records for as long as their profession requires.

9. How we protect information

We use encryption in transit and at rest, an additional layer of encryption for the most sensitive content, strict access controls on a need-to-know basis, access logging, and regular review of our safeguards. No system is perfectly secure, but we work to protect your information in proportion to its sensitivity.

If a confidentiality incident creates a risk of serious harm, we will notify you, your practitioner where applicable, and the relevant privacy regulators as the law requires, and we record every incident.

10. Your rights

Subject to the law that applies to you, you can:

• access the personal information we hold about you, and ask how it is used and shared;
• correct information that is inaccurate or incomplete;
• receive your information in a structured, commonly used technological format (portability);
• withdraw your consent;
• ask us to delete your information, subject to legal retention obligations; and
• file a complaint with a privacy regulator, for example the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or the commissioner in your province.

How to make a request. For health information connected to your care, you can contact your practitioner, and we will help them respond. For anything else, or if you're unsure, contact our Privacy Officer (section 13). We respond within 30 days and may need to confirm your identity first.

11. Children

Lumo is for people 18 and older. We do not knowingly collect information from minors. If you believe a minor has provided information to us, contact us and we will delete it.

12. Website analytics

Our website uses analytics to understand how pages are used. These analytics do not include health information. You can use your browser's settings to block or delete cookies.

13. Privacy Officer

Our Privacy Officer is responsible for protecting personal information at Lumo and for answering questions, requests, and complaints about this policy.

Privacy Officer, Advanced Imagination Labs Inc. (Lumo)
privacy@lumomeals.com

14. Changes to this policy

If we make a material change, we will tell you at least 30 days before it takes effect, in the app, by email, or by another reasonable method. The "Last updated" date above shows when this policy last changed.

15. Language

This policy is available in French and English.