Consumer Health Data Privacy Policy

1. What consumer health data we collect, and why

Lumara is a private log. You enter the information that appears in your log.

Treatment records: treatment type and category, date, provider, notes, side effects, rating, recovery days, face-map zones and doses. We use these to show your log, history, reminders and insights to you.

Photos: before, after and recovery photos, and provider photos. We store them and show them back to you.

Daily Glow rating: a rating you enter each day. We use it to show your Glow trend to you.

Regimen items and reminders: products, routines and reminder times you add. We use them to run your reminders and show your regimen.

Appointments: visit date, time and provider. We use them to remind you and show your calendar.

Onboarding answers: goals, age range, routine and budget tier. We use them to set up and personalize the app for you.

Usage events: when the app opens, a treatment is logged, a recap is shared, the paywall is viewed or a plan is purchased. A treatment event includes its category, which can show the kind of care you log. We use these events to count how the app is used in general. They do not include your notes, costs, provider names or photos.

Subscription status: whether Lumara Elite is active. We use it to unlock paid features. Subscription status is not health data by itself.

Face ID is checked by iOS on your device. We never receive face data. Calendar links, widget data and pending photo uploads stay on your device.

We use consumer health data to provide the app you ask for. We do not use it for advertising, profiling or model training. Before we collect or use it for a new purpose, we will tell you and ask for your consent.

We do not use a geofence around a place that provides health care.

2. Sources of consumer health data

You enter information in the app and choose the photos to add. When you sign in, Apple gives us an account identifier and the name and email address you choose to share.

3. Whom we share consumer health data with

We do not sell consumer health data or share it for advertising. We use no third-party analytics or advertising service.

Supabase provides our database, file storage and sign-in on servers in the United States. It can process the categories listed in Section 1 to run the app.

RevenueCat manages subscriptions. It receives an account identifier, purchase receipt and basic device information. It does not receive your log or photos.

Apple provides Sign in with Apple and processes payments. It receives account identity and purchase information through those services. It does not receive your log or photos from us.

We do not share consumer health data with affiliates.

We may disclose information if the law requires it or to protect people's safety. If Lumara is sold or merged, we will tell you before your data is handled under a different policy.

4. Consent

We use consumer health data needed to provide the service you request. Before we collect or share consumer health data for another purpose, we will tell you what data is involved and ask for your consent. You can withdraw consent at any time as described in Section 5.

5. Your rights, and how to use them

You can ask us to confirm whether we collect, share or sell your consumer health data. You can ask to access it and learn which third parties and affiliates received it. You can withdraw consent to collection or sharing and ask us to delete your consumer health data.

In the app, open Profile, then Delete Account to remove your log and photos. You can view and edit your log at any time. “Share with my provider” makes a PDF of the records you choose. Deleting an entry withdraws consent for that entry.

You can also email support@lumaraelite.com from the address on your account. Tell us which right you want to use. We may need to confirm that you own the account. We will answer within the time the law requires and tell you if a lawful extension applies.

6. Deletion and how long we keep data

When you delete your account, we remove your photos and files first, then your log and account data. Our database provider keeps backups for a limited period. Deleted data leaves those backups when they expire.

We may keep limited records that the law requires, such as proof of a purchase. Apple and RevenueCat keep their own purchase records under their own policies; we cannot delete those records.

Deleting your account does not remove Lumara from the Sign in with Apple list in your Apple ID settings. You can remove it there.

7. If we refuse your request

If we do not act on your request, we will explain why in writing. You can appeal by emailing support@lumaraelite.com with “Appeal” in the subject line. We will answer your appeal within the time the law requires and explain our decision. If we deny your appeal, you may contact your state Attorney General.

8. Security

Your data is encrypted in transit. Photos are in private storage with short-lived links. Database rules limit access to your own account.

9. Children

Lumara is not for people under 18. We do not knowingly collect their data. If you think a person under 18 gave us data, email support@lumaraelite.com and we will delete it.

10. Changes

If we change this policy, we will change the effective date. Before we collect, use or share more categories of consumer health data, or use it for a new purpose, we will tell you and ask for your consent.

11. Contact

Alyara Apps Studio LLC, 1758 Heron Club Drive, Delray Beach, FL 33445. Email: support@lumaraelite.com.