Privacy policy

Lumati Life Privacy Policy

Last Updated: August 6, 2026
Effective Date: August 6, 2026

Table of Contents

1. Information We Collect

2. How We Use Your Personal Information

3. Communications

4. Automated Processing and Artificial Intelligence

5. How We Disclose Personal Information

6. Cookies and Similar Technologies

7. Data Security

8. Data Retention and Deletion

9. Your Privacy Rights

10. Children's Privacy

11. International Data Transfers

12. Changes to This Privacy Policy

13. Contact Us

Introduction

LUMATI LIFE ("Lumati," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you access or use our Services.

This Privacy Policy applies to the following:

  • Lumati websites, including lumati.com and shop.lumati.com

  • Lumati mobile applications for iOS and Android

  • Lumati Team administrative portal and Lumati Kiosk

  • Customer support services

  • Email, SMS, and push notifications

  • Wellness programs and practitioner tools

  • Our online store


Collectively, these are referred to as the "Services."

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Services.

We may update this Privacy Policy from time to time to reflect changes in our business, technology, legal requirements, or privacy practices. When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy and provide any additional notice required by applicable law.

1. Information We Collect

The personal information we collect depends on how you interact with our Services. "Personal Information" means information that identifies, relates to, describes, or can reasonably be linked to an individual, as defined by applicable law.

Information You Provide

We collect personal information that you voluntarily provide when you use our Services, including:

  • Contact Information, such as your name, mailing address, email address, and telephone number.

  • Account Information, including your username, password, profile information, and security credentials.

  • Date of Birth, where necessary to verify eligibility or comply with legal requirements.

  • Order and Transaction Information, including billing and shipping addresses, order history, subscription information, returns, refunds, promotional codes, and payment confirmations.

  • Shopping Information, such as products you view, add to your cart or wishlist, purchases, returns, refunds, gift cards, promotional codes, and subscription information, where applicable.

  • Appointment Information, including appointments you schedule, session details, preferences, and related communications.

  • Practitioner Information, including the practitioner or clinic associated with your account.

  • Customer Support Information, including information you choose to provide when contacting us.


Providing certain information may be necessary to access or use specific features of our Services. If you choose not to provide required information, some features may not function properly.

Wellness Information

Depending on the Services you use, we may collect wellness-related information necessary to provide the services requested by you or your practitioner, including:

  • Wellness assessments

  • Appointment history

  • Recharge session history

  • Nutrition information

  • Wellness plans

  • Test kit registration information and results

  • Wellness information and content you voluntarily submit


We use this information to provide and support the Services you request and retain it as described in the Data Retention and Deletion section below.

Lumati does not provide medical advice, diagnosis, or treatment. Information processed through the Services is not a medical record, and use of the Services does not create a physician-patient relationship.

Information Collected Automatically

When you use our Site, App, or Kiosk, we automatically collect certain information, including:

  • Device identifiers

  • IP address

  • Browser type and operating system

  • Device model and application version

  • Language settings

  • Mobile network information

  • Usage information, such as pages viewed, features used, and session duration

  • Diagnostic information, including crash reports, error logs, and performance data

  • Push notification tokens, where you enable notifications


We use this information to operate, secure, maintain, troubleshoot, and improve our Services.

Mobile App Permissions

Depending on the features you choose to use, our App may request permission to access:

  • Camera, to scan QR codes, support meal analysis, and complete test kit workflows.

  • Photos, to upload images you choose to share.

  • Notifications, to deliver appointment reminders, wellness reminders, account alerts, and other notifications.


You may grant or revoke these permissions at any time through your device settings. Disabling certain permissions may limit the functionality of some features.


Information We Receive from Third Parties

We may receive personal information about you from third parties that support the operation of our Services, including:

  • Service providers

  • Payment processors

  • Practitioners and clinics

  • Business partners

  • Technologies used on our Site and App


This information may include details needed to process payments, fulfill orders, schedule appointments, authenticate users, provide wellness services, process assessments and test kit information, analyze usage, and maintain the security and operation of our Services.

We treat information received from third parties in accordance with this Privacy Policy. We are not responsible for the accuracy of information provided by third parties or for their privacy practices.

2. How We Use Your Personal Information

We use your personal information to provide, maintain, improve, and protect our Services, communicate with you, fulfill our legal obligations, and operate our business.

Providing Our Services

  • Create and manage your account.

  • Process payments and complete transactions.

  • Fulfill orders, including shipping, returns, and exchanges.

  • Schedule and manage appointments.

  • Deliver wellness services and support practitioner relationships.

  • Process test kit registrations and related services.

  • Provide customer support.

  • Communicate with you about your account, orders, appointments, and Services.

  • Send transactional communications, including order confirmations, shipping updates, appointment reminders, wellness reminders, test kit notifications, product recall notices, and security alerts.

Improving Our Services

We use personal information to improve the performance, reliability, functionality, and security of our Services. This includes monitoring usage, analyzing trends, troubleshooting technical issues, conducting research and analytics, and developing new features and functionality.

Marketing and Personalization

Where permitted by law, we may use your personal information to:

  • Send promotional communications by email, SMS, or other permitted channels.

  • Inform you about products, services, promotions, and events.

  • Personalize your experience with our Services.

  • Measure the effectiveness of our marketing and advertising.

  • Display relevant advertisements on our Services and, where permitted, on third-party websites and platforms.


You may opt out of marketing communications at any time as described in the Communications section below.

Security and Fraud Prevention

  • Detect, prevent, and investigate fraud, unauthorized access, and other illegal or malicious activity.

  • Verify user identities and secure accounts.

  • Enforce our Terms of Service and other agreements.

  • Protect the rights, safety, security, and property of Lumati, our users, practitioners, and others.


You are responsible for maintaining the confidentiality of your account credentials and should notify us immediately if you believe your account has been compromised.

Legal and Business Purposes

  • Comply with applicable laws, regulations, court orders, and legal processes.

  • Meet tax, accounting, auditing, and reporting obligations.

  • Resolve disputes and enforce our legal rights.

  • Support business operations, including audits, corporate transactions, and internal administration.

  • Fulfill any other purpose disclosed at the time information is collected or with your consent where required by law.

3. Communications

We may communicate with you by email, SMS (text message), push notification, or other electronic means in connection with your account, orders, appointments, Services, and other interactions with Lumati.

Email and Other Communications

We may send you non-promotional communications that are necessary to provide and administer our Services, including:

  • Account verification and security alerts

  • Order confirmations and shipping updates

  • Appointment and recharge session reminders

  • Wellness reminders

  • Test kit notifications

  • Product recall notices

  • Customer support communications

  • Other messages related to your account or transactions

These communications are considered transactional or service-related and may continue even if you opt out of marketing communications.

Marketing Communications

Where permitted by law, we may send you promotional communications about Lumati products, services, events, and offers by email, SMS, or other permitted channels.

You may unsubscribe from marketing emails at any time by using the unsubscribe link included in the email. You may also manage push notifications through your device settings.

Opting out of marketing communications does not affect your receipt of necessary non-promotional communications related to your account, appointments, orders, security, or Services.

SMS Messaging

If you provide your mobile number and consent where required by law, or where otherwise permitted based on your relationship with Lumati or a participating practitioner, we may send you SMS messages related to your account, appointments, orders, wellness services, and, where applicable, marketing.

SMS messages may include:

  • Account verification

  • Appointment and recharge session reminders

  • Wellness reminders

  • Order confirmations and shipping updates

  • Test kit notifications

  • Product recall notices

  • Customer support communications

  • Marketing and promotional messages, where permitted by law


Message frequency varies. Message and data rates may apply.

You may opt out of SMS messages at any time by replying STOP. Reply HELP for assistance.

Opting out of marketing SMS messages does not prevent us from sending necessary transactional or service-related messages where permitted by law.

We do not sell your mobile phone number or share it with third parties for their own independent marketing purposes.

4. Automated Processing and Artificial Intelligence

We may use automated technologies and artificial intelligence ("AI") to enhance your experience with our Services. These technologies may be used to provide features such as wellness insights, personalized recommendations, meal analysis, educational content, summaries, and other wellness-related tools.

AI-generated content is intended to provide informational and educational support only. It is not medical advice, diagnosis, or treatment and should not be relied upon as a substitute for professional medical judgment. Where appropriate, you should consult a qualified healthcare professional before making health-related decisions.

Our AI features are designed to assist users and practitioners and are not used to make decisions that produce legal or similarly significant effects concerning you.

We do not use your personal information to train publicly available artificial intelligence models without your authorization or as otherwise permitted by applicable law.

5. How We Disclose Personal Information

We may disclose your personal information to third parties as necessary to operate our Services, fulfill your requests, communicate with you, comply with legal obligations, protect our business and users, and for the other purposes described in this Privacy Policy.

Service Providers

We work with trusted third-party service providers that perform services on our behalf. These providers support functions such as:

  • Website and application hosting

  • Payment processing

  • User authentication

  • Cloud infrastructure

  • Analytics and performance monitoring

  • Customer support

  • SMS, email, and push notifications

  • Image storage and delivery

  • Practitioner and appointment management

  • Order fulfillment and shipping


Our service providers may include Shopify, Google Firebase, Stripe, Twilio, Practice Better, Cloudinary, shipping and fulfillment providers, analytics providers, and other vendors that help us operate and improve our Services.

These providers process personal information only as necessary to provide services on our behalf and are contractually required to safeguard personal information in accordance with applicable law. We do not authorize them to use your personal information for their own independent marketing purposes.

Practitioners and Clinics

Where applicable, we may disclose your personal information to the practitioner or clinic associated with your account to provide the wellness services, appointments, assessments, wellness plans, recharge sessions, or test kit services you request.

Business and Marketing Partners

We may disclose personal information to business and marketing partners to support our Services, measure and improve our marketing efforts, and, where permitted by applicable law, provide advertising and promotional activities.

Affiliates and Corporate Transactions

We may disclose personal information within our corporate family to support our business operations.

If Lumati is involved in a merger, acquisition, financing, corporate reorganization, sale of assets, bankruptcy, or similar business transaction, your personal information may be disclosed as part of that transaction, subject to applicable law.

Legal and Safety Disclosures

  • Comply with applicable laws, regulations, legal process, or governmental requests.

  • Enforce our Terms of Service and other agreements.

  • Detect, investigate, or prevent fraud, security incidents, or other unlawful activity.

  • Protect the rights, property, safety, and security of Lumati, our users, practitioners, employees, or others.

Disclosures Made at Your Direction

We may disclose personal information when you request or authorize us to do so, including when you choose to use third-party integrations, request product shipments, or otherwise direct us to share your information.

Categories of Personal Information We May Disclose

During the preceding twelve (12) months, we may have disclosed the following categories of personal information for the business purposes described above:

  • Identifiers, such as your name, contact information, account information, and order details.

  • Commercial Information, including purchases, subscriptions, transaction history, returns, refunds, and customer support records.

  • Internet or Other Electronic Network Activity, including device information, usage data, cookies, analytics, and diagnostic information.

  • Wellness Information, including wellness assessments, wellness plans, appointment history, recharge session history, nutrition information, and test kit information, where necessary to provide the Services.

  • Financial Information, including billing information and payment information processed through our payment service providers.

  • Other Information You Choose to Provide, including communications, reviews, survey responses, uploaded content, and customer support requests.

Sale and Use of Sensitive Personal Information

Lumati does not sell your personal information for monetary compensation.

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you.

6. Cookies and Similar Technologies

We use cookies and similar technologies, including pixels, software development kits (SDKs), web beacons, and local storage technologies, to operate, secure, and improve our Services.

These technologies help us:

  • Provide core functionality and maintain the security of our Services.

  • Remember your preferences and account settings.

  • Keep you signed in to your account.

  • Maintain shopping cart functionality.

  • Analyze how our Services are used and improve their performance.

  • Measure the effectiveness of our communications and marketing.

  • Personalize your experience and, where permitted by applicable law, deliver relevant advertising.

Types of Cookies We Use

  • Essential Cookies – Required for the operation and security of our Services.

  • Functional Cookies – Remember your preferences and personalize your experience.

  • Authentication Cookies – Keep you signed in to your account.

  • Shopping Cart Cookies – Remember items you add to your cart.

  • Analytics Cookies – Help us understand how visitors interact with our Services so we can improve performance and usability.

  • Advertising Cookies – Help us measure advertising effectiveness and, where permitted by law, deliver relevant advertisements.


We may also allow trusted third-party service providers and business partners to use cookies and similar technologies on our behalf to support analytics, communications, advertising, and other business operations.

Managing Cookies

Most web browsers automatically accept cookies, but you can modify your browser or device settings to remove, reject, or limit their use. Where required by applicable law, you may also manage your cookie preferences through the controls provided on our Services.

Please note that disabling certain cookies may affect the availability or functionality of some features of our Services.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction.

  • Encryption of personal information in transit using Transport Layer Security (TLS) and, where appropriate, encryption of data at rest.

  • Secure authentication and role-based access controls to limit access to authorized personnel.

  • Continuous monitoring, logging, and security measures designed to detect and respond to unauthorized access or suspicious activity.

  • Regular software updates, vulnerability management, and security practices intended to maintain the integrity and availability of our Services.

  • Secure cloud infrastructure and trusted third-party service providers that are contractually required to protect personal information.


While we strive to protect your personal information, no method of transmitting or storing data is completely secure. As a result, we cannot guarantee the absolute security of your personal information.

You are responsible for maintaining the confidentiality of your account credentials and should notify us immediately if you believe your account has been compromised.

8. Data Retention and Deletion

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, including providing our Services, maintaining your account, complying with legal obligations, resolving disputes, enforcing our agreements, and protecting our business and users.

The length of time we retain personal information depends on the type of information, the purpose for which it was collected, and applicable legal, regulatory, tax, accounting, and business requirements.

How Long We Retain Personal Information

  • Account Information: For as long as your account remains active, and for up to 24 months after account closure or your last activity, whichever occurs first. After that period, the record is deleted or anonymized.

  • Appointment History and Scheduling Records: For as long as your account remains active, and for up to 24 months after your last appointment, or longer where required to meet a legal or regulatory obligation.

  • Wellness Assessments, Recharge Session History, Nutrition Information, and Wellness Plans: For as long as your account remains active. You may request deletion at any time, and we will delete this information except where retention is required by law or by the practitioner of record.

  • Test Kit Registration and Results: For the period required by the ordering practitioner and applicable law, including where relevant the Clinical Laboratory Improvement Amendments (CLIA) and state laboratory recordkeeping requirements.

  • Orders and Invoices: 7 years from the date of the transaction, where required by applicable federal and state tax, accounting, and consumer-protection recordkeeping obligations.

  • Payment Information: We do not store full payment card numbers. Card details are collected and retained by our payment processors under their own retention policies. We retain only a payment token, card brand, and the last four digits, for the same period as the associated order record.

  • Communication History: Up to 7 years where required to meet a legal, regulatory, or contractual obligation, and otherwise 24 months from the date of the last message.

  • Customer Support Tickets: Up to 5 years from the date the ticket is closed.

  • Marketing and Communication Preferences: Until you unsubscribe, reply STOP, or otherwise withdraw consent. Following an opt-out, we retain a minimal suppression record, such as your email address or phone number in hashed form, indefinitely, solely to ensure we continue to honor your opt-out.

  • Diagnostic Logs and Crash Reports: Up to 24 months.

  • Usage Analytics and Device Identifiers: Up to 14 months in identifiable or pseudonymous form, after which the data is aggregated or permanently anonymized. Aggregated, anonymized analytics may be retained indefinitely and cannot be linked back to you.

  • Push Notification Tokens: Until you disable notifications, uninstall the App, or delete your account, whichever occurs first.

  • Cookies and Similar Technologies: For the lifespan of the individual cookie, up to a maximum of 13 months, or until you clear or reject them through your browser or device controls.

  • User-Generated Content: Until you or we remove it. Following account deletion, we may retain the content in anonymized form with author attribution removed.

  • Records Retained for Fraud Prevention, Security Investigations, or Legal Compliance: For as long as necessary for the specific investigation or obligation, and thereafter for 24 months.


Deleted personal information may remain in our routine encrypted backups for approximately 90 days after it is removed from our active systems, after which those backups are overwritten on a rolling schedule. Backups are not used to restore deleted records.

Where we are subject to a legal hold, subpoena, regulatory request, or ongoing legal proceeding, we will retain the relevant personal information for as long as required, notwithstanding the periods above.

Requesting Deletion of Your Personal Information

You may request deletion of your account and the personal information associated with it at any time through the App, on the web, or by contacting us by email or phone.

  • In the App: Settings → Account → Delete Account

  • On the Web: https://lumati.com/pages/delete-account

  • By Email or Phone: support@lumati.com, info@lumati.com, or +1 (858) 888-2424

We will acknowledge your request within 10 business days and, subject to applicable law, complete the deletion within 30 days. If applicable law permits a longer period, we will notify you.

Deletion removes your account, profile, usage history, wellness session history, and marketing records, subject to the exceptions described below.

Information We May Retain After Deletion

We may retain a limited subset of information after a deletion request when retention is required by law or necessary for a legitimate purpose that overrides the request. This may include:

  • Completed order and transaction records for the applicable tax and accounting retention period.

  • Test kit and laboratory records for the period required by applicable law.

  • Suppression records necessary to honor your marketing and SMS opt-out preferences.

  • Records of fraudulent or abusive activity where necessary to prevent or investigate fraud, misuse, or security incidents.

  • Information required to establish, exercise, or defend legal claims.

  • Retained information will not be used for other purposes except as necessary to satisfy the applicable legal or legitimate retention purpose.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the rights described below in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and may be subject to exceptions and limitations under applicable law.

Right to Access / Know

You may have the right to request access to the personal information we hold about you, including information about how we collect, use, and disclose it.

Right to Delete

You may have the right to request deletion of personal information we maintain about you, subject to applicable exceptions. See Requesting Deletion of Your Personal Information in the Data Retention and Deletion section above.

Right to Correct

You may have the right to request that we correct inaccurate or incomplete personal information we maintain about you.

Right to Portability

You may have the right to receive a copy of your personal information in a portable format and, in certain circumstances, request that we transfer it to another organization.

Restriction of Processing

Where provided by applicable law, you may have the right to request that we restrict or limit certain processing of your personal information.

Withdrawal of Consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before you withdrew your consent.

Appeal

Where provided by applicable law, you may have the right to appeal our decision if we decline to process your privacy request. You may submit an appeal by replying to our response or contacting us using the information in the Contact Us section.

Managing Communication Preferences

You may opt out of promotional emails at any time by using the unsubscribe link included in those emails. You may opt out of SMS messages by replying STOP. You may also manage push notifications through your device settings.

Opting out of marketing communications does not prevent us from sending necessary non-promotional communications, including messages about your account, appointments, orders, security, or other transactions.

Complaints

If you have concerns or complaints about how we process your personal information, please contact us using the information in the Contact Us section. If you are not satisfied with our response, you may have the right, depending on where you live, to appeal our decision or lodge a complaint with your local data protection or privacy authority.

Exercising Your Privacy Rights

You may exercise applicable privacy rights through the controls provided on our Site or App or by contacting us using the information provided in the Contact Us section.

We will not discriminate against you for exercising your privacy rights.

To protect your personal information, we may need to verify your identity before processing your request. We may request information such as your email address, account information, or other information reasonably necessary to verify your identity.

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. Before processing a request submitted by an authorized agent, we may require proof that you authorized the agent to act on your behalf and may require you to verify your identity directly with us.

We will respond to privacy requests within the timeframes required by applicable law.

Applicable Privacy Laws

Where applicable, Lumati honors privacy rights available under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), the General Data Protection Regulation (GDPR), and other applicable privacy laws.

10. Children's Privacy

Our Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent where required by applicable law.

If you are a parent or legal guardian and believe that your child has provided us with personal information in violation of this Privacy Policy, please contact us using the information provided in the Contact Us section. If we become aware that we have collected personal information from a child without the required consent, we will take reasonable steps to delete that information as required by applicable law.

If a higher minimum age applies in your jurisdiction, we will comply with the applicable legal requirements.

11. International Data Transfers

Because Lumati may serve users in multiple countries, your personal information may be transferred to, stored, and processed in countries other than the one in which you reside.

Where required by applicable law, we implement appropriate safeguards to protect personal information transferred internationally, including contractual protections and other legally recognized transfer mechanisms.

If we transfer your personal information out of Europe, we will rely on recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses, or equivalent mechanisms recognized by applicable law, unless the transfer is to a country that has been determined to provide an adequate level of protection.

By using our Services, where permitted by applicable law, you acknowledge that your personal information may be transferred to and processed in countries that may have different data protection laws than those in your jurisdiction.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, business practices, legal requirements, or other operational needs.

When we make material changes, we will update the "Last Updated" date at the top of this Privacy Policy and provide additional notice where required by applicable law.

Your continued use of the Services after an updated Privacy Policy becomes effective constitutes your acceptance of the revised Privacy Policy, to the extent permitted by applicable law.

13. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise your privacy rights, please contact us:

LUMATI LIFE

Email: privacy@lumati.com

Phone: +1 (858) 888-2424

Mailing Address: 613 Westlake Street, 125B, Encinitas, CA 92024, United States

For editorial inquiries please contact: pr@lumati.com