Privacy Policy

About This Policy

Blue Skies MD LLC DBA Lumora MD ("we," "us," or "our") provides clinical infrastructure and care coordination services connecting patients with licensed, independent healthcare providers. This Privacy Policy explains what information we collect, how we use and share it, the choices you have, and the rights you hold under applicable law.

This Policy applies to all information collected through our websites, mobile applications, patient portal, and related services (collectively, the "Services"). It is incorporated into our Terms of Service. Separately, our Notice of Privacy Practices governs protected health information (PHI) subject to HIPAA and applicable state health privacy laws.

Washington state residents: please also review our My Health My Data Privacy Policy.

PLEASE READ THIS POLICY CAREFULLY. BY USING THE SERVICES, YOU AGREE TO THE COLLECTION AND USE OF YOUR INFORMATION AS DESCRIBED HERE.

What Information We Collect and How

Information You Give Us Directly

When you register, complete intake forms, request a consultation, or otherwise interact with the Services, you may provide:

• Contact and identity information: name, date of birth, address, phone number, and email address.
• Health and clinical information: medical history, symptoms, medications, lab results, prescriptions, photos submitted for clinical review, and other information relevant to your care.
• Payment and billing information collected by our payment processors on our behalf, including credit or debit card details.
• Identity verification documents such as a government-issued ID where required.
• Communications you send us through message threads, support requests, or feedback forms.
• Any other information you choose to provide when using the Services.

Sensitive Personal Information

Some of the information we collect may qualify as "sensitive personal information" under applicable state law, including health and medical information, precise geolocation data, contents of communications, and financial account details. We collect and use sensitive personal information only as necessary to provide the Services or as otherwise permitted by law. We do not use sensitive personal information to infer characteristics about you beyond what is necessary to provide the Services.

Information We Collect Automatically

When you use the Services, our systems and third-party tools automatically collect:

• Device and browser information: IP address, browser type, operating system, device identifiers, and screen resolution.
• Usage data: pages visited, time spent on pages, links clicked, search terms entered, and session duration.
• General location information derived from your IP address or, with your permission, precise GPS coordinates.
• Cookie and tracking data as described in our Cookie Notice below.

Information We Receive From Third Parties

We may receive information about you from licensed healthcare providers, affiliated professional entities, pharmacies, and laboratory services involved in your care. We may also receive technical and usage information from analytics providers and advertising platforms.

How We Use Your Information

We use the information we collect to:

• Facilitate your access to licensed, independent healthcare providers and coordinate clinical consultations, Good Faith Examinations, and treatment clearances.
• Process prescriptions and coordinate medication fulfillment with licensed pharmacies and compounding facilities.
• Manage your account, verify your identity, process payments, and maintain accurate records.
• Communicate with you about your care, account activity, orders, and platform updates.
• Provide customer support and respond to your inquiries.
• Improve the platform through internal research, analytics, and product development.
• Comply with applicable federal and state laws, regulations, and professional standards.
• Detect, prevent, and respond to fraud, security incidents, and unauthorized use of the Services.
• Pursue or defend legal claims where necessary to protect our rights or the rights of others.
• For any additional purpose disclosed to you at the time of collection, or with your consent.

Where we handle PHI subject to HIPAA or applicable state health privacy laws, we will use and disclose that information only as permitted by our Notice of Privacy Practices and applicable law.

How We Share Your Information

NOTICE: In certain circumstances, we may share or sell personal data as described in this Policy. We do not sell protected health information or consumer health data as defined under applicable state law.

We share information only as necessary to deliver the Services, as permitted by law, or with your consent. We do not transfer your data internationally.

• Licensed healthcare providers and pharmacies: We share your health and personal information with independent providers and pharmacies involved in your care as necessary to facilitate consultations, issue prescriptions, and fulfill orders.
• Service providers and vendors: We share information with third-party vendors who help us operate the Services, including payment processors, cloud storage providers, analytics platforms, customer support tools, and security services. These vendors are contractually required to use your information only as directed by us.
• Affiliated professional entities: Lumora MD operates under a PC-MSO structure and shares data with affiliated professional corporations as necessary to support clinical operations and compliance.
• Legal and regulatory disclosures: We may disclose information when required by law, court order, regulatory inquiry, or government process, or when we believe disclosure is necessary to prevent harm, enforce these Terms, or protect the rights and safety of our users, staff, or the public.
• Business transactions: In connection with a merger, acquisition, financing, or sale of assets, your information may be transferred to relevant parties. We will notify you before your information becomes subject to a materially different privacy policy.
• Advertising networks: We may share de-identified or hashed information with advertising partners to deliver relevant content. We do not share PHI or consumer health data for advertising purposes.
• With your consent: We may share information for purposes not listed here when we have your express consent.

Online Analytics and Advertising

We use analytics tools — such as Google Analytics — to understand how the Services are used and to improve the platform. These tools collect information through cookies and similar technologies. To opt out of Google Analytics, install the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

We may work with third-party advertising partners to serve targeted advertisements. If you do not wish to receive interest-based advertising, update your preferences through our Cookie Consent tool or through your browser settings.

If you provide your phone number and opt in to SMS communications, you consent to receive recurring marketing and service-related text messages. Message and data rates may apply. Reply STOP at any time to opt out. Consent to receive marketing messages is never a condition of using the Services.

Your Choices and Rights

Depending on where you reside, you may have certain rights regarding your personal information. We will honor all valid rights requests within the timeframes required by applicable law. To exercise any of these rights, email Support@lumoramd.com with your full name, state of residence, and email address.

• Right to know/access: Request a copy of the personal information we hold about you and how we use and share it.
• Right to correction: Request that we update or correct inaccurate or incomplete information.
• Right to deletion: Request that we delete your personal information, subject to legal and operational exceptions.
• Right to restriction: Ask us to limit how we process your information in certain circumstances.
• Right to portability: Request your personal information in a structured, machine-readable format.
• Right to opt out of sale or sharing: You may direct us not to sell or share your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: Where applicable, you may direct us to limit our use of sensitive personal information to what is necessary to provide the Services.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to withdraw consent: Where we rely on consent to process information, you may withdraw that consent at any time.

If your request is denied, you may appeal by emailing privacy@lumoramd.com with the subject line "Privacy Rights Appeal." You also have the right to file a complaint with your state's attorney general.

Do Not Sell or Share My Personal Information: To opt out of the sale or sharing of your personal information, email privacy@lumoramd.com with the subject line "Do Not Sell or Share" or use our Cookie Consent tool to disable non-essential tracking.

 

Opt-Out of Marketing

To opt out of marketing emails, click "Unsubscribe" in any marketing email. To opt out of SMS marketing, reply STOP. Opting out of marketing does not affect service-related or transactional communications.

Cookies and Tracking Technologies

Manage cookie preferences through our Cookie Consent tool or your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

Do Not Track

We do not currently respond to browser-level "Do Not Track" signals because there is no consistent industry standard for how such signals should be interpreted.

How We Protect Your Information

We implement administrative, technical, and physical safeguards including access controls, encryption in transit and at rest, security monitoring, and regular risk assessments. No security measure is perfect — if you believe your account has been compromised, contact us immediately at support@lumoramd.com.

Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware of such a collection, we will take steps to delete it promptly. If you believe a minor has provided us with their information, contact us at support@lumoramd.com.

Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations (including applicable medical record retention requirements), resolve disputes, and enforce our agreements. Medical records are retained in accordance with state-specific medical record retention laws, which typically require retention for a minimum of 7–10 years depending on jurisdiction.

State-Specific Privacy Disclosures

California Residents — CCPA/CPRA

California residents have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know, right to delete, right to correct, right to opt out of sale or sharing, and right to limit use of sensitive personal information. California residents may also designate an authorized agent to make requests on their behalf. We respond to verifiable consumer requests within 45 days.

California's "Shine the Light" law (Civil Code § 1798.83) also permits California residents to request information about personal information shared with third parties for their direct marketing purposes. Submit requests to support@lumoramd.com.

Colorado, Connecticut, Virginia, and Texas Residents

Residents of Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), and Texas (TDPSA) have rights to access, correct, delete, and port their personal data, and to opt out of processing for targeted advertising, sale of personal data, and profiling. To exercise these rights, contact support@lumoramd.com. Appeals may be submitted to support@lumoramd.com with subject line "State Privacy Appeal."

Nevada Residents

Nevada residents may request that we not sell their personal information as defined under NRS Chapter 603A by contacting privacy@lumoramd.com.

Washington State Residents

Washington state residents have additional rights regarding consumer health data under the My Health My Data Act. Please refer to our separate My Health My Data Privacy Policy.

Policy Updates

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this document. Material changes will be communicated by email or through a prominent notice on the Services. Your continued use of the Services after any update constitutes acceptance of the revised Policy.

Cookie Notice

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies to keep you signed in, remember your preferences, understand usage patterns, and deliver relevant content and advertising. We use the following categories of cookies:

• Strictly necessary cookies: Required for the Services to function. Cannot be disabled without affecting core functionality.
• Functional cookies: Enable enhanced features such as saved preferences, language settings, and session continuity.
• Analytics cookies: Help us understand how users interact with the Services. Information is aggregated and does not identify individual users.
• Marketing and advertising cookies: Used to deliver advertising relevant to your interests and to measure campaign effectiveness.

Manage your cookie preferences through our Cookie Consent tool accessible from the footer of our website, or through your browser settings.

How to Contact Us

For questions about this Privacy Policy or to submit a data rights request:

Privacy@lumoramd.com / Keith Swider