Privacy Policy
This policy explains how we handle personal data of people who visit this site, create a Lumaclin account (as a clinic or as a patient) or use the system on behalf of a clinic. Lumaclin is operated from Brazil and follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). Where the EU or UK General Data Protection Regulation (GDPR) applies to you, sections 5 and 7 describe the additional information and rights you have.
Patient records kept by clinics. The records a clinic keeps about its patients inside Lumaclin are not covered by this policy. For that data the clinic is the controller and Lumaclin is the processor, under the Data Processing Agreement. If you are a patient, contact your clinic to exercise your rights over your clinical record.
United States (HIPAA). Lumaclin is not currently offered as a HIPAA-compliant service and we do not sign Business Associate Agreements. Practices that are HIPAA covered entities should not store protected health information in Lumaclin until we announce that this is available.
1. Who we are
- Controller
- Amanay Agency
- Privacy contact
- [email protected]
2. What data we handle
2.1. Clinic account
Clinic name, type, city, approximate number of practitioners, your name, email, phone (optional) and password, which is stored encrypted and which we cannot read. We also record the date and version of the terms you accepted and the referral code used, if any.
2.2. Plan payments
Plan chosen, amount, date and status of payments. Card details are handled by Stripe; we never receive them.
2.3. Patient account
If you create a patient account: your name, phone, email and encrypted password, and the appointments you book through Lumaclin (clinic, practitioner, date, time, status and whether it is a video visit). When you book, the clinic receives your name and phone to confirm the appointment. We do not ask for health information in the patient account.
2.4. Clinic directory
Clinics may choose to appear in the public directory. Only what the clinic publishes is shown: name, city, what it offers, logo and its practitioners' names, specialties and photos.
2.5. Use of the system and feedback
Access logs (IP address, date and time); activity logs on clinical data (which user created, changed or deleted a record and when, never the content); and the feedback and support requests you send us.
2.6. Support by WhatsApp
If you write to our WhatsApp support number, we keep the conversation to answer you. Replies may be drafted by an automated assistant; a person from our team takes over when needed. Please do not send patient data through this channel.
2.7. Demo
Data typed into the demo without an account stays in your browser only. It never reaches us.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and maintain your account, provide the service and the free trial, and book appointments you request. | Performance of a contract. |
| Process plan payments and issue invoices. | Performance of a contract and legal obligation. |
| Keep access logs for the period required by law. | Legal obligation. |
| Security, fraud prevention and activity logging. | Legitimate interest. |
| Review your feedback to improve Lumaclin. | Legitimate interest. You may object. |
| Send news and offers. | Consent, which you can withdraw at any time. |
We do not make automated decisions that affect your interests. The in-app assistant runs on simple rules inside your browser and does not send patient data to artificial intelligence services.
4. Who we share it with
We do not sell data. We share it only with the providers needed to run the service, under data protection terms:
| Provider | What for | Where the data is |
|---|---|---|
| Supabase, Inc. | Database, sign-in and access emails. | Servers in São Paulo, Brazil. |
| Cloudflare, Inc. | Hosting of the site pages. Does not store patient data. | Global network; company based in the USA. |
| Stripe | Plan payments by card. | USA and other countries. |
| 8x8, Inc. (Jitsi Meet) | Video room for video visits. We do not record calls. | Global network; company based in the USA. |
| Meta (WhatsApp) and Anthropic | Our WhatsApp support line and its automated assistant. They do not receive the clinics' patient records. | USA. |
| Google (Google Fonts) | Site fonts; receives your IP address when the page loads. | USA. |
We may also share data when the law requires it, by court order or at the request of a competent authority.
5. International transfers
The database is located in Brazil. Some providers are based in the United States and may access data to provide technical support. If you are in the European Economic Area or the United Kingdom, your data is therefore transferred outside your country. These transfers rely on the mechanisms allowed by the GDPR: an adequacy decision where one applies, or standard contractual clauses with our providers.
6. How long we keep it
- Clinic account: while the account is active. If the trial ends without a plan, for 30 days, so you can export your data.
- Patient account: while the account is active. You can ask us to delete it at any time.
- Access logs: 6 months.
- Payments and invoices: for the periods required by tax law (generally 5 years).
- Feedback and support conversations: up to 24 months; after that, only in anonymised form.
7. Your rights
You can ask us to confirm whether we handle your data, to access it, correct it, delete it, restrict or object to its use, receive it in a portable format and withdraw your consent. Write to [email protected]. We reply within 15 days (and within one month at the latest where the GDPR applies). You may also complain to your data protection authority: in Brazil, the ANPD (www.gov.br/anpd); in the EU or the UK, the supervisory authority of your country.
8. Security
We apply technical and organisational measures: encrypted connection (HTTPS), data encrypted on the server, isolation of each clinic's data in the database itself, encrypted passwords, automatic sign-out after a period without use, activity logs and team access limited to what is necessary. If a security incident creates a relevant risk, we will notify the competent authority and the people affected.
9. Other information
Lumaclin is intended for adults. We only use technical storage in the browser; see the cookie policy. If we change this policy, we will publish the new version here and notify you by email when the change is relevant. The Portuguese version of this policy is the reference text.