Privacy Policy

Lummen LLC, a Colorado limited liability company doing business as Lummen ("Lummen," "we," "us," or "our"), operates lummen.io and its related website pages. You can contact us at hello@lummen.io.

This policy covers the website, walkthrough requests, public Survey Intelligence tools, fictional-data demonstrations, and associated website accounts. It does not authorize use of real resident information in a demonstration or create a facility subscription agreement.

A facility's use of the Lummen extension or other production services must be addressed in a separate written agreement and appropriate product-specific privacy information. Where Lummen acts as a business associate under HIPAA, the applicable Business Associate Agreement governs protected health information. This website policy is not a Business Associate Agreement or a healthcare provider's HIPAA Notice of Privacy Practices.

Information you provide. When you request a walkthrough or contact us, we collect your name, work email address, facility or organization, professional role, number of facilities, optional message, and correspondence with us. A request may also identify whether it came from the homepage or Survey Intelligence page. If you provide a phone number in correspondence, we receive it as part of that correspondence.

Account information. If you receive an invitation or use a website account, we process identifiers, contact details, authentication information, organization and facility memberships, permissions, and account activity needed to provide and secure access. We receive some of this information from your organization or its authorized administrator. Please do not share your password with us in an email or support message.

Technical and usage information. Our website and service providers may process your IP address, browser and device information, requested pages and URLs, referrer, request times, authentication events, and diagnostic or security logs. When you use Survey Intelligence, we process your search terms and selected facility identifiers to return results. IP addresses are also used for request-rate limits and abuse prevention.

Public information. Survey Intelligence uses publicly available CMS facility and inspection datasets, including facility names, locations, identifiers, and deficiency information. This information comes from public sources rather than private resident charts. Public-source records may contain organization or professional contact information.

Please provide only information needed for your business inquiry. Do not include resident names, clinical notes, medical record numbers, screenshots of resident charts, or other identifiable health information.

We use information to operate the website; answer inquiries; schedule and deliver walkthroughs; manage invitations, accounts, permissions, and organization access; retrieve and display public survey data; troubleshoot problems; prevent abuse; maintain security; and meet legal obligations.

We may use business contact details to follow up on your inquiry and discuss Lummen services relevant to your request. You can ask us to stop promotional follow-up at any time. Requesting a walkthrough does not enroll you in unrelated marketing or authorize disclosure of your information to another company's marketing list.

We may review operational information and feedback to improve the website and demonstrations. We do not use submitted personal information or clinical information to train general-purpose AI models. We do not use this website to build advertising profiles from resident information.

Service providers. We disclose information as needed to providers that help us host and secure the website, maintain databases, authenticate accounts, deliver email, schedule meetings, and provide support. The website uses Supabase for configured database and authentication functions and Resend for configured email delivery. A walkthrough request may be stored in our database and sent by email to our team; a confirmation may be emailed to you.

Organization administrators. If you use an organization-managed account, authorized administrators may access your profile, membership, role, and account or dashboard activity within their assigned permissions. Such information can be associated with an individual user and is not necessarily anonymous. Your organization's own policies govern how it uses information available to it.

Public-data requests. To return Survey Intelligence results, our server queries CMS public-data services using search criteria or facility identifiers. Do not enter personal or clinical information into facility-search fields.

Legal and safety matters. We may disclose information when required by law or valid legal process, or when reasonably necessary to protect rights, investigate fraud or security incidents, or protect people from harm, subject to applicable law.

Business transactions. Information may be disclosed to advisers or prospective or actual successors in a merger, financing, acquisition, or sale of business assets, subject to appropriate confidentiality and legal protections. We may also disclose information at your direction.

We do not sell personal information or share it for cross-context behavioral advertising. Providing information to a service provider to perform a service for us is distinct from giving that provider permission to use it for its own advertising.

Website account features use cookies and browser storage to maintain authentication and sessions. Technical request information also supports security and abuse prevention. Blocking or clearing cookies or stored session information may sign you out or prevent account features from working.

We do not use advertising pixels, cross-site advertising trackers, or session-replay tools on this website. Necessary service providers may process technical information to provide their services. Following an external link, including a scheduling link, takes you to a service with its own privacy practices.

Do Not Track. Our website does not change its necessary authentication, security, or request processing in response to a browser's Do Not Track signal. We do not track you across unrelated websites for advertising.

Global Privacy Control. We do not sell or share information for cross-context behavioral advertising regardless of whether your browser sends a Global Privacy Control signal. Where applicable law requires us to honor an opt-out preference signal for other processing, we will do so.

Public clinical examples and demonstration records are fictional. The public website, walkthrough form, facility-search tool, ordinary email, and public demos are not approved channels for resident information or other protected health information. Do not use a public demo to process a real resident chart.

If you accidentally submit resident information, contact hello@lummen.io promptly without repeating that information. We will assess the submission, restrict its handling as appropriate, and take corrective steps consistent with applicable law and any relevant agreement.

A product's local processing of clinical text does not, by itself, establish that every product data flow is local or that HIPAA requirements are satisfied. Any production deployment must describe clinical-text handling, operational events, user identifiers, storage, recipients, and permissions accurately. This policy does not promise that all future Lummen services are offline or that no information ever leaves a user's computer.

If you are a resident or representative seeking access to or correction of a healthcare record maintained by a facility, contact the facility. We will route requests concerning information handled on a facility's behalf as required by law and the applicable agreement.

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including responding to inquiries, maintaining authorized accounts, supporting business relationships, protecting security, and meeting legal obligations.

Retention depends on the type of information, whether an inquiry or account remains active, contractual and legal requirements, and any need to resolve disputes or investigate incidents. We delete or de-identify information when it is no longer needed, subject to these requirements. De-identification must address identifiability, not merely remove a name.

Information in restricted backups may remain until the applicable backup cycle expires. We may retain limited records needed to honor an opt-out request or document compliance with a legal obligation. You can request deletion using the contact details below; lawful exceptions may apply.

We use administrative and technical measures designed to protect personal information, appropriate to its nature and the website's functions. No website, transmission method, or storage system can guarantee absolute security. Contact us if you believe your account or information has been compromised; do not include passwords or resident information in your message.

Lummen is intended for United States business users. Information may be processed in the United States and other locations where our service providers operate, subject to applicable legal requirements. Using the website does not waive any privacy right or replace any legally required safeguards for a transfer.

You can choose not to submit an inquiry, limit optional information, manage cookies through your browser, and ask us to stop promotional communications by emailing hello@lummen.io or using an unsubscribe option where provided. We may still send necessary account, security, legal, or requested-service messages.

Contact hello@lummen.io to request access to, correction of, or deletion of personal information we hold about you. Identify the account or work email involved and describe your request. Do not send a government identification document or health information unless we arrange a secure method and explain why it is necessary.

Depending on your location and whether an applicable privacy law covers the processing, you may have rights to know or obtain a copy of information, correct inaccuracies, delete information, opt out of specified processing, limit certain uses of sensitive information, and appeal a denied request. These rights are subject to applicable exceptions. We will not unlawfully discriminate against you for exercising a privacy right.

We may need to verify your identity and, for an authorized-agent request, your agent's authority. We use information provided for verification only as needed to handle the request and meet related legal obligations. We respond within the deadlines required by applicable law. If you wish to appeal a denial where a right of appeal applies, email hello@lummen.io with the subject 'Privacy request appeal.' We will explain the outcome and any applicable complaint options.

For California residents, covered information can include business contact information. Where the CCPA applies, its rights and limits govern our response. We do not treat every business contact or every health-related record as automatically exempt from privacy law.

For Colorado residents, the Colorado Privacy Act protects covered personal data when a resident acts in an individual or household context; its consumer definition excludes commercial and employment contexts. Where that Act applies, the rights and request methods described above apply, subject to its exceptions. We still accept the website privacy requests described here, and other applicable laws may protect business contact information.

The website and demonstrations are intended for adults working in or evaluating skilled nursing services. They are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate.

Third-party websites and services linked from Lummen have their own privacy policies. This policy covers our handling of information and does not control those third parties' independent practices.

We will post updates on this page and revise the effective date. For material changes, we will provide additional notice appropriate to the change and obtain consent where required by law. A policy update does not retroactively authorize a use that was unlawful or inconsistent with required consent.

Privacy questions and requests: Lummen LLC Privacy Contact, hello@lummen.io. Please do not send resident information through ordinary email.