Last Revised: June 2026
PLEASE READ THIS PRIVACY POLICY CAREFULLY. This Privacy Policy describes how Luma Health LLC and its affiliates ("Luma Health," "we," "our," or "us") handle your information when you use our websites, mobile applications, telehealth platform, and related services (collectively, the "Services"). If you do not agree to this Privacy Policy, please do not use the Services.
This Privacy Policy describes the data protection practices of Luma Health LLC and its affiliates, including when you visit any Luma Health LLC website that links to this Privacy Policy, use any affiliated mobile applications, or otherwise provide data to Luma Health LLC. This Privacy Policy is incorporated into our Terms of Use. All capitalized terms used but not defined herein have the meanings assigned to them in the Terms of Use.
We need certain types of information to provide the Services to you. If you do not provide us with such information, or ask us to delete it, you may no longer be able to access or use part or all of our Services.
We collect a variety of information that you provide directly to us through account registration, product orders, form submissions, research and surveys, customer support requests (including online chat), and uploads or posts to the Services. The specific types of information collected depend on how you use the Services. This may include:
We collect certain information about your use of the Services and the devices used to access them. We and our service providers may use cookies, web beacons, SDKs, tracking pixels, and similar technologies to collect this information.
Our Websites. When you use our Websites, we collect and analyze information such as your IP address, browser type and language, operating system, state or country of access, device IDs, referring and exit URLs, pages viewed and order of pages, time spent on pages, search terms, and error logs.
Our Apps. When you use our Apps, we automatically receive information about the mobile phone, tablet, or computer used to access the Apps, including device identifiers, IP address, operating system, browser type, domain name, update history, and usage patterns.
Location Information. We and our service providers may automatically collect general location information (such as city/state or postal code associated with an IP address) to deliver location-appropriate content. We will ask your permission before collecting precise GPS location information. You may disable location features through your device settings.
Cookies and Similar Technologies. A web server log stores website activity. An SDK is a set of tools embedded in apps to allow data collection. A cookie is a small text file placed on your device to recognize it, store preferences, and personalize your experience. Tracking pixels are tiny electronic tags used to measure advertising and email effectiveness. You may manage cookies through your browser settings, though doing so may affect access to certain features.
When you interact with us on Facebook, Instagram, Twitter, or other social media platforms, we may collect your name, email address, and any content you post related to us. We also work closely with third parties — including physicians, pharmacies, advertising networks, analytics providers, and search information providers — who may provide us with additional information about you.
In connection with providing the Services, we may use your information to:
We may combine information collected through the Services with information from other sources, both online and offline, and use and share such combined information in accordance with this Privacy Policy. We may also aggregate and/or de-identify information so it can no longer be linked to you ("Aggregate/De-Identified Information") and use it for any purpose, including research and marketing.
We may use third-party web analytics services — such as Google Analytics (including Google Signals, Google User-ID, and other features) and MixPanel — to collect and analyze usage information, conduct research, assist with fraud prevention, and improve the Services. If you have a Google account with personalized advertising enabled, Google Signals may gather analytics across the various devices you use. To prevent Google from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on. To opt out of Google Signals, open your device Settings, select Google → Ads, and turn on "Opt out of Ads Personalization."
If you receive email from us, we may use analytics tools such as clear GIFs to capture data such as when you open our message or click links. This helps us gauge the effectiveness of our communications and marketing campaigns.
The Services may integrate third-party advertising technologies (such as ad networks including Facebook, Google Ads, Criteo, and others) that use cookies and other technologies to deliver relevant advertising for Luma Health products on the Services and on other websites you visit. Ads may be based on content of pages visited, searches, demographic data, and other information we collect. We sometimes provide customer information (such as email addresses) to service providers who match it in de-identified form to cookies or mobile ad identifiers to deliver relevant ads.
We do not control the use of cookies placed by non-affiliated advertising networks. To manage tailored browser advertising, you may visit the Network Advertising Initiative's Consumer Opt-Out, the Digital Advertising Alliance's Consumer Opt-Out, or Your Online Choices. To opt out of Google display advertising, visit the Google Ads Settings page. You will still see advertising after opting out — it will simply not be tailored to your online behavior.
When using mobile applications, you may receive tailored in-application advertisements. Each operating system — iOS, Android, and Windows — provides instructions on how to prevent delivery of tailored in-application advertisements. Please contact your platform provider for further details on opting out of tailored in-app advertisements.
Do Not Track ("DNT") is a privacy preference available in certain web browsers. We provide the opt-out mechanisms described above to give you meaningful choices. However, we do not currently recognize or respond to browser-initiated DNT signals.
We may share your information for our business purposes in the following ways:
We may share information within any Luma Health LLC member or group — including subsidiaries, affiliates, ultimate holding company, and its subsidiaries — to deliver products and services, ensure consistent service levels, and enhance our offerings.
We share your information with healthcare providers to schedule and fulfill appointments, provide healthcare services as part of the Services, facilitate messages you send through our Services, and for treatment, payment, or healthcare operations purposes including pharmacy services upon your request.
We provide access to or share your information with select third parties who perform services on our behalf, including billing, sales, marketing, advertising, analytics, research, customer service, shipping and fulfillment, data storage, IT and security, fraud prevention, payment processing, and auditing and legal services. These entities may include healthcare organizations, pharmacies, and other third parties that support our business or the administration and support of the Services.
By using the Services, you acknowledge and agree that we may access, retain, and disclose information about you if required by law or in a good faith belief that such action is reasonably necessary to: comply with legal process (such as a subpoena or court order); enforce our Terms of Use, this Privacy Policy, or other contracts; respond to claims that content violates third-party rights; respond to your customer service requests; or protect the rights, property, or personal safety of Luma Health LLC, its agents, affiliates, users, and the public. This includes exchanging information with other companies for fraud protection, spam and malware prevention, and similar purposes.
As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions, user information may be among the transferred assets. If a portion or all of our assets are sold or transferred to a third party, customer information including your email address would likely be one of the transferred business assets. We will comply with any mandatory restrictions applicable to such transfers under applicable law.
Certain features of our Services allow you to share comments publicly with other users. Information submitted through such features is not confidential and we may use it for any purpose, including testimonials or marketing materials. Information posted openly in these ways will be available to the public at large and potentially accessible through third-party search engines. Please take care when using these features.
We may disclose your information in other ways you direct us to and when we have your consent. We also reserve the right to create and share Aggregate/De-Identified Data from information collected through the Services at our discretion.
You may instruct us not to use your contact information to contact you by email, postal mail, or phone regarding products, services, promotions, and special events by contacting us using the information below. In commercial email messages, you may also opt out by following the unsubscribe instructions at the bottom of such emails.
Please note that regardless of your request, we may still use and share certain information as permitted by this Privacy Policy or as required by applicable law. For example, you may not opt out of certain operational emails reflecting our relationship or transactions with you.
This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including physicians and other healthcare providers using the Services, mobile device manufacturers, other IT hardware and software providers, or any third-party mobile application, website, or service to which our Services may link. These third parties may gather information from or about you. We have no control over their privacy practices. The collection, use, and disclosure of your information by such third parties will be subject to their own privacy policies, not this Privacy Policy. We urge you to read the privacy and security policies of these third parties.
Luma Health LLC maintains a variety of technical and organizational security measures to protect your information against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, or access. Security measures may include encryption, access controls, secure hosting environments, employee training, and monitoring systems.
However, no method of transmission over the Internet, and no means of electronic or physical storage, is absolutely secure. You acknowledge and accept that we cannot guarantee the security of information transmitted to, through, or on our Services or via the Internet, and that any such transmission is at your own risk.
Where we have given you a password that enables you to access the Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Information you share in public areas may be viewed by any user of the Services.
If you are a California resident, California law requires us to provide you with additional information regarding how we collect, use, and share your "personal information" as defined in the California Consumer Privacy Act ("CCPA"). Please note that some information we collect through the Services — such as medical information — is subject to various health data privacy laws and therefore may not be subject to the CCPA.
| Category of Personal Information | Categories of Third Parties to Whom We Disclose |
|---|---|
| Identifiers and contact information (e.g., name, address, email address, account names) | Service providers; our affiliates; healthcare providers and services; entities for legal and fraud prevention |
| Commercial and transactional information (e.g., information about your purchases) | Service providers; our affiliates; healthcare providers and services; entities for legal and fraud prevention |
| Financial information (e.g., credit card info collected by our payment processors) | Payment processors; service providers; our affiliates; entities for legal and fraud prevention |
| Internet or other network or device activity (e.g., IP address, browsing history, app usage) | Service providers; our affiliates; entities for legal and fraud prevention |
| Geolocation information (e.g., general location and precise location with your permission) | Service providers; our affiliates; entities for legal and fraud prevention |
| Demographic and statistical data (e.g., gender, interests based on products and services used) | Service providers; our affiliates; entities for legal and fraud prevention |
| Physical characteristics (e.g., photos of you) | Service providers; our affiliates |
| User-generated content (e.g., information you choose to post in our online forums) | Service providers; our affiliates; entities for legal and fraud prevention |
| Customer service data (e.g., information provided through chat or calls with Luma Health's Care Team) | Service providers; our affiliates; healthcare providers and services; entities for legal and fraud prevention |
The business purposes for which we use the personal information we collect are: managing, facilitating, and improving the Services; research, marketing, and analytics; communicating with users; technical support and customer service; security and fraud prevention; and legal compliance and defense. For more detailed information, see Sections 2 and 4 above.
If you are a California resident, the CCPA allows you to request that we:
The CCPA also provides you the right not to be discriminated against for exercising your rights. Please note that certain information may be exempt from such requests under California law. We will take reasonable steps to verify your identity before responding to any request.
To exercise your California privacy rights, please email us at [email protected]. Please include your full name, email address, and residential address associated with your use of our Services, along with the rights you would like to exercise. If you would like to receive a copy of your medical record, please indicate that in your message. By requesting your medical record in this way, you are agreeing to receive it in an unencrypted email message.
Luma Health LLC does not, and will not, sell information that identifies you such as your name, email address, phone number, or postal address. However, because of the CCPA's broad definitions of "sale" and "personal information," making certain online identifiers available to third-party advertising and marketing service providers may be considered a "sale" under the CCPA. To opt out of sharing your information with participating third parties for interest-based advertising, please visit the Network Advertising Initiative's Consumer Opt-Out, the Digital Advertising Alliance's Consumer Opt-Out, and Your Online Choices. These opt-outs are device- and browser-based, so you will need to opt out on each of your devices and browsers.
The California "Shine the Light" law gives residents of California the right under certain circumstances to request information regarding how we share certain categories of personal information with third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes.
Under Nevada law, certain Nevada consumers may opt out of the sale of "personally identifiable information" for monetary consideration to a person for that person to license or sell such information to additional persons. We do not engage in such activity; however, if you are a Nevada resident who has purchased services from us, you may submit a request to opt out of any potential future sales under Nevada law by emailing us at [email protected]. We will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.
We keep your information for no longer than necessary for the purposes for which it is processed. The length of time we retain information depends on the purposes for which we collected and use it, and as required to comply with applicable laws including healthcare record retention requirements under state and federal law.
We reserve the right to change this Privacy Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. We will make the revised Privacy Policy accessible through the Services, so you should review it periodically. The date this Privacy Policy was last revised is identified at the top of this document.
If we make a material change to the Privacy Policy, we will provide you with appropriate notice in accordance with legal requirements. Your continued use of our Websites or Apps after such amendments (and notice, where applicable) will be deemed your acknowledgment of these changes.
If you have any questions about this Privacy Policy or our privacy practices, please contact us: