Effective date: July 18, 2026
Last updated: July 18, 2026
Applies to: All Luma Educational Apps iOS applications published by CE HALO LLC, including without limitation Luma Anesthesia, Luma Nurse, Luma NP, Luma ICU, and any other current or future Luma-branded iOS apps that link to this Privacy Policy (each, an “app,” and together, the “apps”).

CE HALO LLC (“we,” “us,” “our”) builds Luma Educational Apps for licensed healthcare professionals, students, and adult learners. This Privacy Policy explains what data the apps handle, how it is used, how it is shared, and your rights.

Important: The apps require an account. They are not designed for anonymous use. Creating an account stores a server-side User record associated with your login credentials or sign-in provider.

We do not collect, store, or transmit any patient health data or Protected Health Information (PHI). The apps are educational and clinical-reference tools only. They are not electronic health records and are not intended for entering patient-identifiable information.

To use the apps, you must create or sign in to an account. We support one or more of the following methods (availability may vary by app):

• Email and password — you provide an email address and password
• Sign in with Apple — authentication through your Apple ID
• Google sign-in — authentication through your Google account

When you create or sign in to an account, we create and maintain a server-side User record in our backend database. That record is required to authenticate you, sync your account across sessions and devices, manage access to free and premium features, and provide support.

Depending on the sign-in method and what you choose to provide, your User record may include:

• Email address
• Account / user identifier (assigned by us and/or the sign-in provider)
• Display name or name (if provided by you or the sign-in provider)
• Authentication provider (email/password, Apple, and/or Google)
• Password credentials (for email/password accounts: stored only as secure hashed credentials; we never store your plain-text password)
• Account creation date and last login / activity metadata
• Role or profile fields you choose to add (for example clinical role, institution, or short bio, where the app offers them)
• Subscription and entitlement status linked to your account
• Preferences, onboarding status, and feature settings associated with your account

If you use Sign in with Apple and choose “Hide My Email,” we receive Apple’s private relay email address rather than your personal email, and we store that relay address as your account email.

• Data described in Section 1 (account creation and authentication)
• Support communications you send us (for example emails to support@lumaeducationalapps.com)
• Account deletion and data requests you submit

• Optional profile fields (display name, clinical role, institution, bio, or similar), if offered
• Onboarding progress, preferences, and in-app settings
• Content you voluntarily create or save in the app (for example bookmarks, notes, progress, or community posts), where those features exist

Do not enter patient names, medical record numbers, or any other PHI into the apps.

Subscriptions are sold and managed through the Apple App Store. We do not see, store, or process your payment card details. Apple handles billing, renewal, refunds, and cancellation.

We use RevenueCat to receive subscription status from Apple and to grant access to premium features. In connection with subscriptions, we and/or RevenueCat may process:

• Purchase events and subscription status
• Product identifier and expiration / renewal dates
• An app user identifier used to link purchases to your account
• Restore-purchase and entitlement information

• Basic technical data needed to operate the service (for example app version, device type/OS version, and network requests over HTTPS)
• Crash reports and anonymized performance metrics via Apple, only if you opt in through iOS Settings → Privacy & Security → Analytics & Improvements → Share App Analytics (or the equivalent path on your iOS version)

Some data may also be cached on your device for performance and offline use (for example cached reference content, onboarding flags, or session tokens). Local caches do not replace your server-side User account.

We use the data described above to:

• Create and authenticate your account
• Operate, maintain, and improve the apps
• Deliver free and premium content and enforce subscription access
• Sync account-related settings and progress where applicable
• Provide customer support and respond to requests
• Secure the apps, prevent fraud/abuse, and troubleshoot issues
• Comply with law, enforce our terms, and protect our rights and users

We never sell your personal data. We never share your personal data for third-party advertising. We do not use third-party advertising SDKs in the iOS apps.

Depending on the app, local storage may include items such as:

• Profile or preference keys used for personalization
• Onboarding / terms-acceptance flags
• Cached clinical reference content for offline use (often with a short expiry, such as about 7 days)
• Authentication/session tokens needed to keep you signed in

You can remove local data by signing out (where available) and/or uninstalling the app. Uninstalling the app does not by itself delete your server-side User account or Apple subscription. See Section 9 for account deletion.

• Billing is handled exclusively by Apple
• Manage or cancel in the app (where a Manage Subscription control is provided) or in iOS Settings → [your name] → Subscriptions
• Refund requests go through Apple: https://reportaproblem.apple.com/
• We cannot issue App Store refunds directly

RevenueCat helps us verify entitlements and unlock premium features. RevenueCat’s processing is described in RevenueCat’s own privacy policy.

Unless a specific app’s listing or in-app prompt states otherwise, Luma Educational Apps iOS apps generally request no sensitive device permissions (camera, microphone, location, contacts, photo library, HealthKit, etc.) beyond standard internet access needed to authenticate, sync content, and process subscriptions.

If a future app feature requires a permission, iOS will prompt you at the time of use, and we will only use that permission for the stated feature.

The iOS apps may use the following categories of third parties:

ServicePurposeData involved (typical)Apple App Store / StoreKitSubscription billing, receipt validation, Sign in with ApplePurchase events; Apple ID token/email (or private relay) if you use Sign in with AppleGoogle Sign-In (if enabled in the app)Account authenticationGoogle account identifiers and email/name as permitted by Google and your settingsRevenueCatSubscription status and entitlementsApp user identifier, purchase/entitlement eventsOur app backend / hosting provider (including Base44 infrastructure where used)Account database, authentication, app content APIsUser account records and app data described in this policyApple (optional analytics)Crash and performance diagnostics if you opt inCrash logs / diagnostics

We select providers that support industry-standard security practices. Each provider processes data under its own terms and privacy policy in addition to this one.

We do not use advertising SDKs or cross-app tracking trackers in the iOS apps.

• Server communication uses HTTPS/TLS
• Passwords for email/password accounts are stored using secure hashing, not plain text
• Payment card data is handled by Apple only
• Access to production systems is limited to personnel who need it for operations and support

No method of transmission or storage is 100% secure. We work to protect your information, but we cannot guarantee absolute security.

Because we maintain a server-side User account, you may request:

• Access to personal information we hold about you
• Correction of inaccurate account information
• Deletion of your account and associated personal data we control

In-app account deletion: Where required by Apple and implemented in the app, you can delete your account from the app’s account/settings area. Account deletion removes or de-identifies your server-side User record and associated personal data we control, subject to limited retention needed for legal compliance, fraud prevention, dispute resolution, or backup integrity.

Email requests: You may also email support@lumaeducationalapps.com with the subject line “Privacy Request” and tell us whether you want access, correction, or deletion. We may need to verify that you control the account.

Deleting your app account does not automatically cancel an Apple subscription. Cancel separately in iOS Settings → [your name] → Subscriptions.

Uninstall the app to remove local caches and on-device data.

If GDPR applies to you, you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. Contact us to exercise these rights.

If CCPA/CPRA applies to you, you may have rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising.

• Account / User records: retained while your account is active. After deletion, we delete or de-identify personal data within a reasonable period, except where we must retain limited information for legal, security, accounting, or dispute-resolution purposes.
• Local device data: until you clear app data, sign out (where applicable), uninstall, or a cache entry expires.
• Apple subscription/billing data: retained by Apple under Apple’s policies.
• RevenueCat subscription events: retained by RevenueCat under RevenueCat’s policies.
• Support emails: retained as reasonably needed to handle your request and maintain business records.

The apps are intended for licensed healthcare professionals, students, and adults aged 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies). If you believe a minor has created an account, contact us and we will take appropriate steps, including deleting the account.

• Do not submit PHI or patient identifiers
• The apps provide educational and reference information only
• They are not a substitute for professional judgment, institutional protocol, or licensed clinical care
• They are not intended to diagnose, treat, cure, or prevent any disease

• We aim to comply with App Store privacy requirements (including Guideline 5.1.1)
• Account-based apps disclose account creation and the data collected
• Account deletion is offered in-app where required
• The App Privacy “nutrition labels” in App Store Connect should be kept consistent with this policy
• We do not track you across third-party apps and websites for advertising
• We do not use third-party advertising SDKs

We are based in the United States. If you use the apps from another country, your information may be processed in the United States and other locations where we or our providers operate. Those locations may have different data-protection laws than your home country.

We may update this policy from time to time. The “Last updated” date will change when we do. Material changes may also be surfaced in the apps. Continued use after an update means you accept the revised policy, except where applicable law requires additional consent.

For privacy concerns, data access/deletion requests, or questions:

Email: support@lumaeducationalapps.com
Company: CE HALO LLC
Location: Buffalo, New York, United States

This Privacy Policy governs the Luma Educational Apps iOS applications that link to it. Separate terms or notices may apply to specific websites, courses, or non-app products offered by CE HALO LLC or Luma Educational Apps.