Privacy Policy

LumaCare is a care coordination platform for families and caregivers of loved ones who need support. This privacy policy describes how we collect, use, and protect personal data when you use our service.

Data controller: Tvermose IT, Denmark.
Contact: info@lumacare.dk

We process the following categories of personal data:

• Account data – name, email address, and authentication identifiers provided during sign-up.
• Care recipient and family data – names, dates of birth, care notes, schedules, appointments, and event records you create.
• Health-related data – care notes and event records may contain health information about your care recipient (Article 9 GDPR). We only process this data on your explicit instruction.
• Usage data – anonymised logs of feature use for improving the platform. No personal identifiers are retained in logs.
• Media uploads – photos and audio clips you upload to Memory events.

• Contract – to deliver the service you have signed up for.
• Explicit consent – for processing special-category health data about your care recipient (Article 9(2)(a) GDPR).
• Legitimate interest – for platform security and abuse prevention.

All data is stored within the European Union on Microsoft Azure infrastructure. Data is encrypted at rest and in transit. Access is restricted to authenticated family members and their authorised helpers.

We use the following third-party processors:

• Microsoft Azure – cloud hosting, storage, and authentication (Microsoft Entra External ID).
• Azure OpenAI Service – voice-to-event transcription and AI assistant features. Transcripts are not retained by the AI service beyond the request.
• Stripe – payment processing. We do not store your payment card details. Stripe's privacy policy governs how Stripe processes your payment data.

Your data is retained for as long as your account is active. You can delete your account at any time from Account settings inside the app, or by contacting us at info@lumacare.dk.

When you delete your account it is locked immediately and permanently deleted 30 days later. During those 30 days you can restore it by signing in; afterwards it cannot be recovered. On deletion we erase your name, email address, profile picture, preferences and notification tokens.

Care records you created inside a family that continues to exist — care events, medication administration records, messages and posts — remain with that family as part of its shared care history, shown as written by a deleted user rather than by you. If a family is deleted along with your account, its data, including documents and photos in our storage, is deleted with it. Consent and audit records are retained without your personal identifiers, because we are required to be able to demonstrate that consent was given and withdrawn.

Your sign-in identity is held by Microsoft Entra External ID. Deleting your LumaCare account releases the link to it, but does not by itself delete the Microsoft account you signed in with.

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (without affecting prior processing)

You can exercise the right to erasure yourself at any time from Account settings inside the app — see "Data retention" above for exactly what is deleted and what is retained. To exercise any of the other rights, contact us at info@lumacare.dk.

LumaCare uses browser local storage and session state solely to maintain your authenticated session and UI preferences. No third-party advertising or tracking cookies are used.

We may update this policy from time to time. Significant changes will be communicated via the app or by email. The date at the top of this page indicates when it was last revised.

For any privacy-related queries contact info@lumacare.dk.

You also have the right to lodge a complaint with your national data protection authority. In Denmark: Datatilsynet.