CareLumi Privacy Policy

Effective Date: December 8, 2025

This CareLumi Privacy Policy (“Policy”) describes how CareLumi (“CARELUMI,” “we,” “our,” or “us”) collects, uses, protects, and shares personal and organizational information (“Information”) obtained through your use of the CARELUMI platform, websites, applications, and services (“Services”).

1. Acceptance

BY USING OR ACCESSING OUR SERVICES, OR BY PROVIDING INFORMATION THROUGH THE SERVICES, YOU AGREE TO THE TERMS OF THIS POLICY. IF YOU DO NOT AGREE TO THIS POLICY, YOU MUST NOT USE OUR SERVICES.

2. Information We Collect

a. Information You Provide: We collect Information provided directly by you, including but not limited to:

Personal identification information (such as name, contact information, organization, and role).
Employee and organizational compliance records, credentials, certifications, and related documentation.
Information submitted via communications with CARELUMI customer support.

b. Information Collected Automatically: We automatically collect certain Information about your use of our Services, including but not limited to:

Device and browser details, IP addresses, and general location.
Usage information such as log files, page visits, and interactions.

c. Third-Party Sources: We may receive Information from third-party integrations or partners you authorize or link with our Services, to facilitate functionality such as payroll, compliance management, health claims, and administrative support.

3. Use of Your Information

We use the Information collected to:

Provide, maintain, and enhance our Services.
Process, track, and verify compliance documentation and certifications.
Support billing, reporting, claims processing, and analytics.
Communicate with you, including providing customer service and responding to your inquiries.
Ensure compliance with applicable laws and regulations.
Enhance the security and functionality of the Services.

4. Information Sharing and Disclosure

We do not sell your Information. However, we may share Information with:

Authorized users within your organization.
Third-party vendors, contractors, and service providers supporting our business operations.
Regulatory, legal, or governmental entities, if required by law or in response to a valid legal request.
Successors or affiliates in connection with mergers, acquisitions, or other organizational changes.

5. Data Security

We implement and maintain appropriate administrative, technical, and physical safeguards designed to protect your Information against unauthorized access, disclosure, alteration, or destruction. These include: AES-256 encryption for data at rest, TLS 1.3 encryption for data in transit, role-based access controls and multi-factor authentication, comprehensive audit logging of all data access, and 24/7 security monitoring and threat detection. For complete details on our security practices, please visit our Trust Center at carelumi.com/trust.

6. Data Retention

We retain Information as long as necessary to fulfill the purposes outlined in this Policy, to comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the nature of the Information and applicable regulations.

Upon account termination, we retain your data for 30 days to allow for data export. After this period, all customer data is securely deleted from our production systems and backups within 90 days. You can request immediate deletion at any time.

7. De-identification and Aggregated Data

We may create aggregated or de-identified Information by removing identifiers that could connect data to individuals. Aggregated data may be used for internal analysis, reporting, or to improve our Services and will not be re-associated with identifiable Information.

8. International Transfers

Our Services are hosted and operated in the United States. All customer data is stored in US-based AWS data centers. Information collected through the Services may be transferred, stored, and processed in the United States. By using our Services, you consent to such transfers.

9. GDPR and Other Regional Rights

Depending on your jurisdiction, you may have certain rights regarding your Information, including rights to access, correct, delete, or restrict processing of your data. To exercise these rights, please contact us at hello@carelumi.com.

10. Children's Privacy

Our Services are not intended for use by children under 13, and we do not knowingly collect Information directly from children without appropriate consent.

11. Updates to this Privacy Policy

We may update this Policy periodically to reflect changes in our practices, technology, or applicable laws. We will notify you of material changes through our Services or via email and update the “Effective Date” accordingly.

12. SMS and Text Messaging

CareLumi offers an optional text messaging program through our executive assistant, Lily, used for scheduling, coordination, and follow-ups connected to our Services. If you opt in to text messages from CareLumi:

Information collected: your mobile phone number, your opt-in and opt-out records, and the content of text messages you exchange with us.
How it is used: only to send and respond to coordination messages related to our Services, to maintain your opt-in/opt-out preferences, and to operate and secure the messaging program.
Opting out: reply STOP at any time to stop receiving text messages. Reply HELP for assistance.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

13. Contact Information

If you have any questions or concerns about this Policy, please contact us at:

CARELUMI, Inc.
Chicago, IL
Email: hello@carelumi.com
Security concerns: security@carelumi.com