Privacy policy

Lumen and Lumen Health are service names. The full legal identity, service address and public privacy contact of the operator responsible for this service have not yet been confirmed for publication. Those details, and any required data-protection officer or local representative, must be identified before this draft is adopted or the service is opened to the public.

During an arranged preview, contact the person who invited you for privacy, access, correction, deletion or security requests. Do not send passwords or an entire medical report in an initial message. If you do not have a verified operator contact, do not submit additional sensitive information until one is supplied. This interim route is not a substitute for a legally required public contact.

This policy covers the Lumen website, account and personal-record features. A linked healthcare resource or other independent website has its own privacy practices. A preview label does not reduce the operator's legal obligations.

Account information: your email address, verification status, optional name, account identifiers and creation and update times. Passwords and full names are not required for onboarding. One-time email codes are stored as hashes with expiry and attempt information; email-delivery providers process the recipient, code, message and delivery metadata. A keyed identifier limits repeated sends without adding another plain-text copy of the address to the cooldown record. Older accounts may retain a historical password hash, but password sign-in is disabled. Sign-in records can contain session identifiers, expiry times, IP address and browser or device information used for authentication and security.

Optional passkeys: if you add one in Settings, Lumen stores its public key, credential identifier, chosen label, account association, creation time, signature counter and authenticator metadata. Lumen never receives your fingerprint, face scan, device PIN or the passkey's private key. Your device or password manager controls the private credential and any syncing under its own privacy practices. Passkeys are tied to the website address where they were added. A passkey made in Preview does not work on the live website's different address.

Optional profile information: full name, date of birth, sex, ethnicity, blood type and height, where you choose to provide them. Some of these fields, as well as the reports themselves, may be sensitive or specially protected personal data. They are not used to generate a diagnosis or biological-age estimate.

Record information: the original files you upload and their full contents; file names, types and sizes; provider names, report dates, titles and notes; measurements, qualitative results, units and reviewed reference limits; and draft AI extraction where requested. An original may contain identifiers, diagnoses, other people's details or file metadata that the app does not automatically remove.

Operational information: upload status, timestamps, per-document AI permission and its version, file-removal status, and AI usage records linking your account and upload to the model, token counts, timing, outcome and error category. The application's technical AI usage table does not contain report text or extracted values, but it is linked to your account and is not anonymous.

Most health information comes directly from what you upload, enter or confirm. Lumen does not automatically obtain records from a clinic, laboratory, insurer or national health portal. AI drafts are derived from the document you choose to send. Authentication and hosting systems also generate technical data when you use the service.

An account does not require a passport or national identity document number. Provide only information needed for your own record management. Remove unnecessary identifiers from a copy before uploading, without changing its clinical meaning, and keep the unchanged source separately. The current service does not offer automatic anonymisation or redaction before storage or AI processing.

Account and session data support account creation, sign-in, account-scoped access, security and abuse prevention. Record data supports private storage, displaying and downloading originals, saving the readings you confirm and showing recorded observations over time. Optional profile fields appear in your profile; leaving them blank does not prevent account creation.

Optional AI processing drafts measurements for your review. Permission and technical usage records support the requested processing, duplicate-request protection, troubleshooting and hourly abuse limits. File-removal records support deletion attempts. Relevant information may also be needed to answer your requests, investigate a security incident or meet a specific legal obligation.

The current service does not sell or rent personal health records, use them for targeted advertising, or train a Lumen model. It does not make automated decisions about your treatment, insurance or employment. A different purpose cannot be authorised merely by inserting broad wording into this policy.

The operator must identify an applicable legal basis for each purpose and any additional condition required for sensitive health or other specially protected data. Providing a requested service, consent, a legal obligation or another basis may be relevant under a particular law; none applies automatically everywhere. The market-specific basis and sensitive-data conditions remain outstanding review items for this draft.

Accepting terms or acknowledging this policy is not, by itself, explicit consent to every use of health data. Where consent is required, it must be appropriately informed, specific, recorded and capable of withdrawal. The current app separately records permission for requested AI reading; that record alone does not establish every permission needed for storage, other processing or international transfers.

Account details and essential session processing are necessary to operate the private account. Providing health records and optional profile information is your choice. Refusing optional AI does not prevent manual entry or document storage. Do not use this preview where the required legal basis, sensitive-data permission or transfer arrangement has not been established.

Uploading first stores the original privately and creates an unfinished upload. It does not automatically call an AI model or add readings to the saved timeline. Choosing Read with AI after the separate permission checkbox sends the selected document through Vercel AI Gateway to OpenAI GPT-5.2, the currently configured model. The full submitted document, not only the values later extracted, is processed.

The app records the upload's permission version and timestamp when an AI attempt starts. A returned draft is stored so you can resume review; only the entries you review and confirm become saved readings. AI can be wrong or incomplete, and there is no clinician review. Continue without AI remains available for manual review and entry.

The current model request disables storage of the generated response using the provider's request option. This is not a verified zero-data-retention agreement and does not establish the retention of all gateway, provider, security or backup systems. Provider terms, processing agreements, training restrictions and retention settings require verification; this policy does not promise that every provider retains nothing or that Lumen controls all of their operations.

The implementation uses Vercel for application hosting and private Blob file storage, Neon for the application and account database, Resend for sign-in emails sent by Lumen Health from login@adeventure.biz, and OpenAI through Vercel AI Gateway only for an AI reading you request. Sign-in emails contain a code, not health reports or profile details. Hosting, database, email and file services necessarily handle data for their functions. Their infrastructure and approved subprocessors may also process relevant operational information.

Records are not published as public links and the app does not offer routine sharing with a clinician, employer, insurer or other user. Private account access does not mean the data is inaccessible to authorised infrastructure operators. Any operator or provider access for support, security or administration must be justified, restricted and subject to appropriate safeguards, not used for unrelated browsing.

A disclosure to an authority, adviser or other recipient must have a lawful, necessary purpose, such as a valid legal demand or the protection of legal rights, with only appropriate information shared. A business transfer would require a separate lawful assessment, safeguards and any required notice or consent; it is not an unrestricted right to sell health records. The operator must verify provider roles, processing contracts and any required recipient details before release.

The active application database and private original-document store use the deployment's configured hosting region. They are not automatically relocated based on where you use Lumen. Records may be stored or processed outside your country of residence.

Vercel hosting, global delivery and support systems, email delivery through Resend and your mailbox provider, and AI providers may use different regions. Lumen does not guarantee storage or AI processing within any one country. Declining AI does not, by itself, establish local-only storage. Do not upload records that require an unverified local-only processing arrangement.

Before release in a market, the operator must document actual destinations and recipients and establish the transfer mechanism, contractual protections, assessments and disclosures required there. An overseas-processing warning or a checkbox alone is not a universal transfer safeguard. This notice does not establish compliance, regulatory certification or permission to operate worldwide.

Essential authentication cookies identify your signed-in session and support account security. Sessions are configured to expire after seven days and may be renewed during use. Signing out ends your current session; closing a tab or browser does not necessarily sign you out. Blocking required cookies may prevent sign-in or private-account features from working, including in an embedded preview.

No optional website analytics or marketing trackers are enabled by the current implementation. This does not mean that no technical information is processed: hosting, authentication, delivery and security providers can handle IP addresses, browser information, request metadata and operational logs. Any future non-essential tracking requires the applicable notice and choice before activation.

The application uses account-scoped database access, authenticated per-record file delivery, private file storage, hashed single-use email codes, expiry and attempt limits, send cooldowns and upload checks. These controls reduce unauthorised access; they are not a guarantee against every breach, device compromise or human error. The service is not end-to-end encrypted against the operator and all processing providers: the requested processing requires access to readable information.

Keep your mailbox secure, do not share sign-in codes, protect your device, sign out on shared devices and retain independent originals. Successful code sign-in verifies control of the mailbox, not a legal identity or age. An older unverified account's previous sessions and password credentials are invalidated when its mailbox is first verified through code sign-in. Do not send credentials or unnecessary health information to someone claiming to provide support. No security disclaimer removes the operator's duty to take legally required protective measures.

In the current implementation, saved reports and readings remain until you delete them. Unfinished uploads and AI drafts remain available to resume or discard; they do not automatically expire. Saving or discarding an upload clears its stored extraction draft. Stopping use, closing a browser or signing out does not erase the account or its records.

Report deletion and upload discard do not remove every related row. Upload metadata, which can include a sensitive file name, identifiers, timestamps and permission history, and account-linked technical AI usage records may remain. Pending file-removal records remain while cleanup is outstanding. These records are not all anonymous and are not covered by a complete automated expiry schedule in this preview.

A passkey's public credential remains in the account database until you remove it in Settings or the account is deleted through an authorised process. Removing a passkey from Lumen prevents new sign-ins with that credential; it does not delete its copy in your device or password manager, sign out existing sessions, or remove health records. Provider backups may retain earlier copies under their retention policies. Keep access to your email for recovery.

The operator must establish documented retention limits for account data, upload metadata, consent evidence, usage and security logs, requests, provider copies and backups, based on necessity and applicable law. Retention must not continue merely because storage is available. A specific legal preservation duty or dispute can justify retaining relevant information, not every record indefinitely. Exact provider and backup retention periods have not been verified for this draft.

Delete report removes the saved report and its readings from the active application tables, marks the related upload discarded, clears its extraction draft and queues the original file for removal. Discarding an unfinished upload removes it from the resumable workflow, clears its draft and also queues the original. The metadata and technical records described above can remain.

The app attempts private-file removal, but an unexpired upload permission or a storage failure can delay it. Reports then shows Retry file removal. Use that action after the delay clears and seek help from your verified preview contact if removal remains pending. This preview does not run an automatic background cleanup timer. These limitations do not reduce any legally required deletion duty or deadline.

Deleting a report is not the same as deleting an account, deleting a copy you downloaded, or instantly removing provider logs and backups. Account-wide deletion currently needs a verified operator request rather than a self-service button. The operator must resolve the outstanding retention and provider-deletion procedures before representing the service as ready for general use.

You can view your account's available records, edit optional profile information, review readings before saving, download originals, delete reports and discard unfinished uploads. A full account export, account closure and requests not supported by these controls require the verified operator contact described above. Do not assume that a missing self-service control removes a legal right.

Depending on the applicable law, you may have rights to information, access, correction, deletion, withdrawal of consent, restriction, objection or a portable copy, subject to lawful conditions and exceptions. Requests must be handled within the applicable legal time limits. Any identity check, refusal, extension or permitted fee must be necessary and legally justified; do not send an identity document or complete report unless a secure and proportionate check is actually needed.

You may complain to the relevant data-protection authority or seek another remedy available by law. You do not have to waive those rights or obtain the operator's permission. This draft does not claim that every listed right exists in every country, or that an existing interface already implements every right.

AI reading is not automatic. For a future document, leave the AI permission unchecked and choose Continue without AI. There is no account-wide AI permission toggle in this preview. A general privacy acknowledgement does not authorise future AI requests.

A request already sent to the provider may continue even if you close the page, uncheck a box or later decide not to save the readings. Withdrawal cannot recall completed processing or make earlier lawful processing unlawful. Discarding or deleting a document is a separate action with the retention limits described above. Contact the verified operator for a broader withdrawal or deletion request; where consent is the basis, future processing based on it must stop subject to applicable law.

This preview is for adults managing their own records, not children's records or family, carer or clinical accounts. Do not upload another person's records. The service does not provide an age-verification or guardianship-verification workflow, and the age statement at registration is not proof that those safeguards exist.

If an underage account or an unauthorised third-party record is discovered, notify the verified operator so that access, lawful preservation and deletion can be assessed. Avoid attaching the affected medical document to an unverified contact message.

A suspected data incident requires assessment, containment and any regulator or individual notifications required by the applicable law. Notification thresholds, recipients and deadlines differ by jurisdiction; this policy neither waives them nor substitutes for an operational response process. The operator must establish and test that process before broader release.

An adopted policy must identify its operator and effective date. Material changes to purposes, recipients, AI use or international transfers require appropriate advance notice and fresh consent where necessary, not merely a changed date. The operator must maintain the relevant notice and consent evidence. This draft does not authorise a new purpose, retrospectively expand earlier permission, or assert that a notification has already been sent.