Privacy Policy

Overview

Lumenly Health, Inc. (“Lumenly,” “we,” “us”) operates an AI-powered EMR downtime recovery platform. This Privacy Policy describes how we handle information collected through our platform and website.

HIPAA Compliance

Lumenly is designed for use with protected health information (PHI). We operate as a Business Associate under HIPAA and require a signed Business Associate Agreement (BAA) before any PHI enters our system. All PHI is processed exclusively for the purpose of EMR downtime recovery on behalf of your organization.

Data We Collect

We collect information you provide directly: account registration details (name, email, organization), uploaded documents (scanned paper charts during downtime recovery), and extracted clinical data. We also collect standard server logs (IP addresses, browser type, pages visited) for security and performance monitoring.

How We Use Your Data

We use your data solely to provide the Lumenly platform — document processing, AI extraction, clinician validation workflows, and HL7 export. We do not use your data to train AI models. We do not sell or share your data with third parties beyond your contracted cloud infrastructure (AWS).

Data Retention

Paid accounts: 7 years per CMS medical record retention requirements. Secure deletion certificates are provided on request. Demo accounts using synthetic data: 30-day automatic deletion.

Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Role-based access controls restrict data access within your organization. Complete audit trails are maintained for all access and actions.

Contact

Questions about this policy? Contact us at hello@lumenlyhealth.com.