Lumiel Privacy Policy

Last Updated: November 20th, 2025

Lumiel (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how Lumiel collects, uses, stores, and protects information when you use the Lumiel mobile application (the “App”).

Lumiel is a wellness application that provides sleep analytics, activity insights, daylight exposure tracking, and AI-generated wellness messages. Lumiel integrates with Apple HealthKit and uses your device’s health data solely to provide these features.

By using Lumiel, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Health Data (via Apple HealthKit)

With your permission, Lumiel accesses the following Apple Health data types:

• Sleep Analysis (start/end time, duration, sleep stages including core/deep/REM)
• Resting Heart Rate
• Active Energy Burned
• Distance Walking + Running
• Exercise Minutes
• Activity Summary (standing hours)
• Time in Daylight
• Date of Birth

What We Store on Our Servers

We do not store raw HealthKit samples. We store only aggregated or derived values, including:

• Sleep start and end timestamps
• Total minutes slept
• Minutes in each sleep stage
• Daily aggregated totals (energy, distance, exercise minutes, standing hours, daylight minutes)
• Derived analytics, such as sleep score, activity score, streaks, and trend calculations

No moment-by-moment heart rate data, raw samples, or raw HealthKit datasets are uploaded.

How We Use Health Data

Health data is used only to provide core app functionality:

• Calculating wellness metrics
• Generating AI-assisted daily messages
• Displaying trends and historical insights
• Personalizing reminders
• Providing age-appropriate benchmarks

Lumiel does not use HealthKit data for advertising, marketing, profiling, or data brokerage.

Per Apple’s HealthKit guidelines:

Lumiel does not use HealthKit data to build a user profile or share HealthKit data with third parties.

1.2 Account Information

Lumiel uses Sign in with Apple for authentication.

We store only the anonymous Apple user identifier required to maintain your account.

We do not receive or store your email address (real or relay).

1.3 Cloud Sync (Supabase)

Lumiel relies on secure cloud-based storage for analytics and account functionality.

Because of this, data syncing to our servers is required for the app to function. There is no local-only mode.

1.4 AI Message Generation

When generating AI-powered insights, Lumiel sends only aggregated wellness metrics to the OpenAI API.

We do not send:

• Name
• Email address
• Apple ID
• Any user identifiers
• Exact timestamps
• Location data
• Any raw HealthKit samples

OpenAI does not store API inputs.

AI-generated content is used for general wellness support only and does not provide medical advice.

2. How We Use Your Information

We use your information solely for:

• Computing wellness metrics
• Displaying insights and trends
• Generating daily messages
• Providing account access
• Maintaining secure authentication

We do not sell, rent, or share your personal data.

We do not use third-party analytics or advertising trackers.

We do not share data with advertisers or data brokers.

Under the CCPA, we do not “sell” or “share” personal data as those terms are defined under the CCPA.

3. Data Storage, Security & Location

Storage Location

All user data is stored in Supabase, hosted on AWS US-East.

Security Measures

Supabase provides:

• Encryption in transit (TLS)
• Encryption at rest
• Row-Level Security (RLS)
• Least-privilege access

We implement additional organizational and technical security controls.

4. Data Retention & Deletion

We retain your data until you delete your account.

When you delete your account:

• All data is permanently deleted within 30 days
• OpenAI does not retain data processed during message generation

You may also email us to request manual deletion.

5. Your Rights

Depending on your region, you may have rights to:

• Access your data
• Request a copy
• Correct inaccuracies
• Delete your data
• Withdraw consent
• Object to certain processing

To request an export: hello@lumiel.app

6. Children’s Privacy

Lumiel is not intended for users under 13 (or under 16 in the EU/EEA).

We do not knowingly collect personal information from children.

7. Third-Party Services

Lumiel uses only:

• Supabase — secure database & authentication
• OpenAI API — wellness insight generation (aggregated, non-identifying data)

No other third parties receive your data.

8. Data Sharing & Disclosure

We may disclose data only:

• To comply with laws
• To protect safety or rights
• With your explicit consent

We never sell or rent your data.

9. Security

We implement technical and organizational measures, including:

• Encryption
• RLS
• Secure authentication
• Limited access controls

No system is perfectly secure; you must keep your device secure.

10. International Users

Your data is processed in the United States.

EU/EEA users retain full GDPR rights.

11. Changes

We may update this Privacy Policy periodically.

Changes are effective when this page is updated.

12. Contact Us

If you have questions or requests:

hello@lumiel.app