Effective date: July 18, 2026
Last updated: July 18, 2026

Applies to: All Luma Educational Apps iOS applications published by CE HALO LLC, including without limitation Luma Anesthesia, Luma Nurse, Luma NP, Luma ICU, and any other current or future Luma-branded iOS apps that link to this statement (each, an “app,” and together, the “apps”).

CE HALO LLC (“we,” “us,” “our”) provides this Data Protection & HIPAA Statement to explain how the apps relate to Protected Health Information (PHI), clinical use, and the limited non-PHI data we handle. This statement works together with our Privacy Policy, Medical Disclaimers, and Terms of Use / EULA.

The apps are educational reference and study tools. They are not designed to collect, store, transmit, or process Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) and related regulations.

We do not want, expect, or accept PHI. The apps are not electronic health records, not clinical documentation systems, and not intended for patient charting or care coordination workflows that involve identifiable patient data.

You must not enter, upload, paste, dictate, photograph, or otherwise input any patient-identifiable information into any field or feature of any app, including but not limited to:

• Account profile fields
• Community posts, comments, or shared content
• Notes, checklists, bookmarks, or custom content fields
• Search fields
• AI assistant / chat prompts
• Support emails or in-app feedback (do not include patient identifiers)
• Screenshots or attachments that contain patient data

Patient-identifiable information includes, without limitation: names, medical record numbers, dates of birth, addresses, phone numbers, full-face photos, device serial numbers tied to a patient, precise locations, and any other data that could reasonably identify a patient alone or in combination with other information.

If you enter patient information despite this warning, you do so entirely at your own professional and legal risk. CE HALO LLC cannot protect information it never intended to receive and does not operate the apps as a PHI repository.

For learning scenarios, use only de-identified, hypothetical examples.

For ordinary use of the apps as educational/reference products:

• CE HALO LLC is not acting as a HIPAA-covered entity in providing the apps
• CE HALO LLC is not your HIPAA business associate for routine app use
• The apps are not represented as a HIPAA-compliant clinical environment
• The apps must not be used in place of your institution’s Electronic Health Record (EHR) or approved clinical systems

If a separate written Business Associate Agreement (BAA) is ever required for a different CE HALO LLC product or service, that would be documented in a signed contract. No BAA is created by downloading, installing, or using the consumer/professional Luma Educational Apps.

The apps may handle the following categories of data. None of these are intended to be PHI. Full details are in the Privacy Policy.

The apps require an account. We maintain a server-side User record that may include:

• Email address
• Account / user identifier
• Name or display name (if provided)
• Authentication provider (email/password, Sign in with Apple, and/or Google where enabled)
• Hashed password credentials (email/password accounts)
• Profile fields you choose to add (for example clinical role or institution)
• Preferences, onboarding status, saved items (such as favorites or history), and feature settings
• Subscription / entitlement status linked to your account

• Managed through Apple’s App Store and RevenueCat
• Purchase events, product identifiers, expiration/renewal status, and app user identifiers used to deliver entitlements
• We do not receive or store your full payment card number; Apple handles payment processing

• Cached reference content, session/auth tokens, onboarding flags, and similar on-device storage for performance and offline use

• App version, device/OS information as needed to operate the service
• Optional Apple crash/performance diagnostics if you enable Share App Analytics

• Text you voluntarily type into AI assistant features may be sent to third-party AI processors (such as Perplexity AI and/or OpenAI) to generate a response
• Never include PHI in AI prompts

• Emails or messages you send to support@lumaeducationalapps.com

We apply reasonable administrative, technical, and physical safeguards appropriate to an educational app that handles account and subscription data (not a clinical PHI system), including:

• HTTPS/TLS for server communication
• Secure password hashing for email/password accounts (no plain-text password storage)
• Payment card data handled by Apple only
• Access to production systems limited to personnel who need it for operations and support
• No third-party advertising SDKs or cross-app advertising trackers on iOS
• Analytics practices configured to avoid unnecessary collection on iOS builds where feasible

No security measure is perfect. The apps are not warranted as a HIPAA-compliant or zero-risk environment. Do not use them to store or transmit PHI.

You are solely responsible for complying with:

• Your employer’s and institution’s policies on third-party apps, mobile devices, and clinical settings
• Your professional licensing board rules and ethical obligations
• Applicable privacy and confidentiality laws in your jurisdiction
• Any prohibition on using unaffiliated apps on institution-issued devices or networks

If your workplace restricts or bans these apps in clinical areas, follow those rules. Educational reference use does not override institutional policy.

Because the apps are not designed to collect PHI, a security incident involving our systems should not expose patient health information unless a user improperly entered PHI contrary to this statement.

In the event of a security incident affecting personal data we do handle (for example account data, subscription-related identifiers, or AI prompt content we process), we will investigate and notify affected users as required by applicable law, which may include notice in the app and/or by email when we have a valid contact address.

Improper user entry of PHI does not convert the apps into a HIPAA service or create a business associate relationship.

Because we maintain server-side User accounts, you may request access to, correction of, or deletion of your account personal data as described in the Privacy Policy (including in-app account deletion where implemented, or email to support@lumaeducationalapps.com with subject line “Privacy Request”).

Deleting your app account does not automatically cancel an Apple subscription; manage subscriptions in iOS Settings.

DocumentWhat it coversPrivacy PolicyAccount data, subscriptions, third parties, retention, GDPR/CCPA rightsMedical DisclaimersEducational-only use, clinical judgment, no medical device claimsTerms of Use / EULALicense, acceptable use, accounts, paymentsThis statementPHI prohibition, HIPAA posture, clinical-setting responsibilities

If documents conflict on a privacy detail, the Privacy Policy controls for data practices. If they conflict on clinical use, the Medical Disclaimers control.

We may update this statement from time to time. The “Last updated” date will change when we do. Material changes may be surfaced in the apps. Continued use after an update constitutes acceptance, except where applicable law requires additional consent.

Questions about data protection or this HIPAA statement:

Email: support@lumaeducationalapps.com
Company: CE HALO LLC
Location: Rochester, New York, United States

By creating an account, using any app, or checking the “Data Protection & HIPAA” box on the Terms & Agreements screen, you confirm that you understand and agree that:

1. The apps are not HIPAA-compliant clinical systems
2. The apps do not accept PHI and are not intended to receive PHI
3. You will not enter patient-identifiable information into any feature of any app
4. You will follow your institution’s rules on third-party app use
5. Account and related non-PHI data are handled as described in the Privacy Policy

If you do not agree, do not use the apps.