Privacy Policy

1. Introduction

One Lumi LLC, a Georgia limited liability company that operates Lumi Health ("Lumi," "we," "us," or "our"), provides AI-powered fitness planning, tracking, and coaching tools (the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the rights and choices available to you. It applies to our websites, applications, and related services. By using the Service, you acknowledge this Privacy Policy. Where the law requires a specific legal basis or your consent, we rely on the bases described in Section 10 and the consent described in Section 3.

This Policy also serves as our Consumer Health Data Privacy Notice for residents of Washington, Nevada, and other states with consumer health data laws (see Section 11).

2. Information We Collect

Information you provide:

• Account information: name, email address, and password, or your Google account identifier if you sign in with Google.
• Profile information: age, sex or gender, height, weight, fitness goals, training experience, schedule, available equipment, and notes you add to your profile.
• Health and fitness information: injuries, physical limitations, medical conditions you choose to share, workout plans, logged workouts, sets, reps, weights, personal records, and related training history.
• Coaching conversations: messages you send to and receive from the AI coaching assistant, including any information you choose to include in them.
• Payment information: if you purchase a subscription, our payment processor (such as Stripe) collects your payment details. We receive limited information such as transaction status and the last digits of your card, and we do not store your full card number.
• Communications: information you provide when you contact us for support or feedback.

Information collected automatically:

• Device and log information: IP address, browser type, operating system, device identifiers, access times, pages viewed, referring URLs, and error logs.
• Usage information: features used, actions taken in the app, and interaction patterns, used to operate and improve the Service.
• Cookies and browser storage: we use cookies, local and session storage, IndexedDB, and Cache Storage to keep you signed in, remember preferences, support an in-progress workout when connectivity drops, and secure the Service (see Section 7).
• Push notification tokens: if you enable notifications, we store the token needed to deliver them. You can disable notifications at any time in your device or browser settings.

3. Health and Fitness Data: Your Consent

Much of the information described above relates to your health, fitness, and physical condition. Depending on where you live, this information may be treated as "consumer health data" or a special category of personal data under laws such as the EU and UK GDPR (Article 9) and the Washington My Health My Data Act.

• By creating an account and providing health and fitness information, you expressly consent to our collection and processing of that information for the purposes described in this Policy, including generating personalized workout plans and coaching responses.
• You may withdraw your consent at any time by deleting the relevant information, closing your account, or contacting us at hey@onelumi.ai. Withdrawing consent does not affect processing that occurred before withdrawal, and some features of the Service will not work without this information.
• Marketing firewall: we do not use or disclose your health and fitness data to third parties for advertising, marketing, or data-mining purposes unrelated to providing the Service.
• We do not sell your health data, and we do not share it for cross-context behavioral advertising.

4. How We Use Your Information

We use your information to:

• provide the Service, including generating personalized workout plans, coaching responses, and progress analytics;
• create and manage your account, authenticate you, and sync your data across devices;
• process payments and manage subscriptions and trials;
• communicate with you about your account, the Service, and updates to our terms and policies;
• monitor, secure, and debug the Service, prevent fraud and abuse, and enforce our Terms of Service;
• analyze usage in order to improve the Service, and develop new features, including using aggregated or de-identified data that does not identify you; and
• comply with legal obligations and protect the rights, safety, and property of you, us, and others.

5. How AI Processing Works

The coaching and program generation features of the Service are powered by large language models operated by third-party AI providers, currently OpenAI and Anthropic. When you use these features:

• your messages, along with relevant profile and workout information needed to produce a useful response, are transmitted to the AI provider to generate the response;
• we access these providers through their business API services, under terms that prohibit them from using our API data to train their models;
• these providers may retain API inputs and outputs for a limited period for abuse monitoring and safety purposes in accordance with their policies, after which the data is deleted;
• AI-generated responses are produced by software and are not reviewed by humans before being shown to you; and
• we may review conversations internally for safety, debugging, and quality purposes, and we may use aggregated or de-identified interaction data to improve the Service. We do not use your identifiable conversations to train third-party foundation models.

Please avoid including information in your messages that you do not want processed as described above, such as government identifiers or information about other people.

6. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers (processors): vendors that process data on our behalf under contractual confidentiality and data protection obligations, currently including Supabase (database, authentication, and storage), Vercel (application hosting), OpenAI and Anthropic (AI processing as described in Section 5), Google (if you sign in with Google), and Stripe (payment processing, when subscriptions are offered).
• Legal reasons: when we believe disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Lumi, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the recipient will be bound by obligations consistent with this Policy and you will be notified of any material change in how your data is handled.
• Aggregated or de-identified data: we may share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you, and we commit to not attempting to re-identify it.
• With your direction or consent: when you ask us to share information or otherwise consent to sharing.

7. Cookies and Similar Technologies

We use cookies and browser storage that are strictly necessary for the Service to function: keeping you signed in, maintaining your session securely, remembering preferences, protecting against fraud, and temporarily preserving an in-progress workout or queued set updates when connectivity drops. Workout caches and queued writes are scoped to the signed-in account and are cleared when you sign out, delete your account, or switch accounts on that browser. Anyone with access to an unlocked device may be able to access browser-resident data, so sign out on shared devices. We do not use third-party advertising cookies or cross-site tracking. If we introduce optional analytics cookies in the future, we will update this Policy and provide any legally required consent mechanism. You can control cookies through your browser settings, though disabling essential cookies may prevent the Service from working.

8. Data Retention

• We retain your account, profile, health and fitness, and conversation data for as long as your account is active, so that your training history and coaching context remain available to you.
• When you delete specific content (such as a conversation or workout), it is removed from active systems and purged from backups on our normal backup cycle.
• When you delete your account or ask us to delete your data, we delete or de-identify your personal information within a reasonable period, except where retention is required for legal compliance, dispute resolution, fraud prevention, or enforcement of our agreements.
• We may retain aggregated or de-identified data, which does not identify you, indefinitely.

9. Security

We use technical and organizational measures designed to protect your information, including encryption in transit and at rest, row-level access controls, authentication safeguards, and least-privilege access for our systems and personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access and portability: obtain a copy of your personal information in a portable format.
• Correction: correct inaccurate information. You can edit most profile information directly in the app.
• Deletion: request deletion of your personal information or your entire account.
• Objection and restriction: object to or request restriction of certain processing.
• Withdraw consent: where processing is based on consent, withdraw it at any time (see Section 3).
• Limit use of sensitive information: California residents may ask us to limit the use of sensitive personal information. We already use health data only to provide the Service and for the purposes permitted by California law, and we do not sell or share it for advertising.
• Non-discrimination: we will not discriminate against you for exercising your rights.
• Appeal: if we decline a request, you may appeal by replying to our decision, and we will respond as required by your state's law. You may also contact your state attorney general or data protection authority.

To exercise any of these rights, email hey@onelumi.ai with "Privacy Request" in the subject line, or use the export, consent-withdrawal, and permanent-deletion tools at Account privacy in the app. Those tools remain available if you decline or withdraw health and AI consent. We will verify your request using the email associated with your account, and we may ask for additional information where necessary. Authorized agents may submit requests on your behalf where permitted by law, with proof of authorization.

For users in the EEA, UK, and Switzerland: our legal bases for processing are performance of our contract with you (providing the Service), your explicit consent (health data and AI processing of health data), our legitimate interests (securing and improving the Service, preventing abuse), and compliance with legal obligations. You also have the right to lodge a complaint with your local supervisory authority.

Opt-out preference signals: because we do not sell personal information or share it for targeted advertising, there is no sale or sharing to opt out of; where the law requires, we treat recognized signals such as Global Privacy Control as a valid opt-out request.

11. Consumer Health Data Notice (Washington, Nevada, and Similar Laws)

For residents of states with consumer health data laws, including the Washington My Health My Data Act and Nevada SB 370:

• Categories collected: the health and fitness information described in Section 2, including physical measurements, fitness activity, injuries and limitations, and health-related information you share in coaching conversations.
• Sources: directly from you and from your use of the Service.
• Purposes: to provide the Service as described in Sections 4 and 5, with your consent.
• Sharing: only with the processors listed in Section 6, solely to provide the Service. We do not sell consumer health data, and no third party receives it for their own marketing purposes.
• Your rights: you may access your health data, withdraw consent, request deletion, and receive a list of the third parties with which we have shared it, by contacting hey@onelumi.ai. If we decline a request, you may appeal as described in Section 10 and may contact your state attorney general.

12. Children's Privacy

The Service is not intended for and may not be used by anyone under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a person under 18 has provided us personal information, contact us at hey@onelumi.ai.

13. International Data Transfers

We are based in the United States, and your information is processed and stored in the United States and in other countries where our service providers operate. These countries may have data protection laws different from those of your country. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and equivalent UK and Swiss mechanisms.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a new "Last updated" date, and if the changes are material, we will provide additional notice such as email or an in-app message, and where required by law, we will obtain your consent. Your continued use of the Service after an update takes effect indicates your acknowledgment of the updated Policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, or want to exercise your rights, contact us at hey@onelumi.ai with "Privacy Request" in the subject line, or through our Contact page.