Privacy Policy

We collect information you provide directly, such as your name, contact details, organization, role, account details, and the content of inquiries or support communications submitted through our website or platform.

Depending on your relationship with us and your use of the platform, we may also process customer account data, technical and access logs, and, where applicable, Protected Health Information (PHI/ePHI) processed on behalf of our customers under a Business Associate Agreement.

We use information to provide, maintain, secure, and improve the Luminate Software platform; to respond to inquiries and provide support; to administer customer accounts; to meet legal, regulatory, and contractual obligations; and to protect our platform, customers, and users.

Where we process PHI/ePHI on behalf of a customer, we do so as a Business Associate in accordance with HIPAA and the applicable Business Associate Agreement. The customer (covered entity) remains responsible for the lawful collection and use of that information. Our handling of PHI/ePHI is governed by that agreement and our internal privacy and security policies, which take precedence over this Policy for such data.

Access to customer data and PHI/ePHI is restricted to authorized U.S.-based personnel with a documented business need, granted on a least-privilege, role-based basis. Personnel without a need to access production data work within development or test environments using masked, de-identified, or synthetic data.

We share information with service providers and subprocessors who support the platform, including providers of cloud hosting and infrastructure, monitoring, source-code hosting, and communications services. Subprocessors are bound by contractual confidentiality and security obligations, and by Business Associate Agreements where they process PHI/ePHI. A current list of key subprocessors is available on request.

We may also disclose information where required by law or legal process, or to protect the rights, safety, and security of our customers, users, or platform.

We retain information for as long as needed to provide the platform and to meet our legal, regulatory, and contractual obligations. Specific retention periods are defined in our internal data-retention policies and vary by data type and applicable requirements. Customer account data is generally retained for up to 60 days following termination of the applicable agreement to allow for recovery and to meet contractual obligations, unless a longer period is required by law or a legal hold applies. PHI/ePHI is retained and disposed of in accordance with HIPAA and the applicable Business Associate Agreement.

We maintain administrative, technical, and physical safeguards designed to protect information, including access controls, authentication, encryption, logging, monitoring, secure development practices, and incident response. In the event of a breach of unsecured PHI/ePHI, we notify the affected customer (covered entity) without unreasonable delay and in accordance with HIPAA and the applicable Business Associate Agreement. No method of transmission or storage can be guaranteed completely secure.

Depending on your location and applicable law, you may have the right to request access to, correction of, or deletion of personal information we hold about you. Requests involving PHI or patient records should be directed to the relevant healthcare provider or covered entity, who controls that information; as a Business Associate, we support our covered entity customers in fulfilling individual rights requests (such as access, amendment, and an accounting of disclosures) as required under HIPAA and the applicable Business Associate Agreement.

Our website uses essential cookies and, where applicable, analytics and functional cookies. On your first visit, a cookie banner lets you accept or reject non-essential cookies. You can adjust your browser settings at any time.

We may update this Policy from time to time. The updated version will be posted with a revised effective date.