Privacy Policy

LUMENVITAL PRIVACY POLICY
Last Updated: April 27, 2026
Effective Date: April 27, 2026
This Privacy Policy (“Policy”) explains how Metric Views LLC, a Texas limited liability company doing business as LumenVital (“LumenVital,” “Company,” “we,” “us,” or “our”), collects, uses, shares, and protects your information when you access or use LumenVital.com, our mobile application, AI-powered tools, SaaS platform, or any related services (collectively, the “Services”).
This Policy is incorporated into and forms part of our User Agreement (available at LumenVital.com/terms). By using the Services, you consent to the practices described here. If you do not agree, you must not use the Services.
We are committed to transparency and compliance with applicable laws, including the Health Insurance Portability and Accountability Act of 1996 (as amended, “HIPAA”), the Texas Data Privacy and Security Act (“TDPSA”), and other relevant U.S. state and federal privacy laws. This Policy is designed to meet those requirements and to be enforceable in court.
1. INFORMATION WE COLLECT
We collect the following categories of information:
A. Personal Information You Provide

Account details (name, email, phone, date of birth, address).
Health and wellness data (self-reported symptoms, goals, medical history, lab results, wearable data from Apple Health/Oura/etc.).
Payment information (processed by Stripe; we do not store full card details).
Communications with us or our AI agents.

B. Automatically Collected Information

Device and usage data (IP address, browser type, device ID, operating system).
Interaction data (pages viewed, features used, session duration).
Cookies, pixels, and similar tracking technologies (see Section 10 below).

C. Sensitive Personal Information / Protected Health Information (PHI)
Under HIPAA and TDPSA, this includes health data, biometric data, and genetic data you upload or that is generated through the Services. We treat all health-related data as sensitive.
We do not knowingly collect data from children under 18. See Section 9.
2. HOW WE USE YOUR INFORMATION
We use your information only for the purposes disclosed in this Policy and as permitted by law (data minimization principle under TDPSA):

To provide, personalize, and improve the Services (including AI-generated longevity plans, insights, and recommendations).
To facilitate connections to third-party licensed telehealth providers, laboratories, and fulfillment partners for prescriptions, testing, supplements, or related services you request.
To process payments and subscriptions.
To communicate with you (account updates, AI nudges, marketing with your consent).
To comply with legal obligations, prevent fraud, and enforce our User Agreement.
To conduct internal analytics and service improvement (using only de-identified or aggregated data).

AI-Specific Use: Our AI analyzes your data to generate personalized recommendations. We do not use PHI to train or fine-tune our underlying AI models. Any AI outputs are informational only and do not create a doctor-patient relationship.
We do not sell your personal information or PHI for monetary consideration. We do not use your data for targeted advertising or profiling that produces legal or significant effects without your explicit consent.
3. HOW WE SHARE YOUR INFORMATION
We share information only as necessary and with your consent or as required by law:

Third-Party Service Partners: Telehealth networks, labs, pharmacies, and fulfillment providers (all of whom are Covered Entities or Business Associates under HIPAA and have executed Business Associate Agreements with us).
Service Providers: Vendors who help operate the Services (hosting, analytics, payment processing, AI infrastructure). These providers are contractually bound to protect your data and may not use it for their own purposes.
Legal Compliance: To law enforcement, regulators, or courts when required (e.g., subpoenas) or to protect rights, safety, or property.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred with appropriate protections.

We do not share PHI except with your explicit consent or as permitted under HIPAA and our Business Associate obligations.
4. HIPAA AND PROTECTED HEALTH INFORMATION
Where we handle PHI, we act as a Business Associate under HIPAA. We maintain appropriate administrative, physical, and technical safeguards.

PHI is used and disclosed only as necessary to provide the Services or as you direct.
We have Business Associate Agreements (BAAs) with all partners who receive PHI.
We do not use PHI for AI model training.
De-identified data (in accordance with HIPAA) may be used for analytics and product improvement.
If you are a Covered Entity and require a separate BAA with Metric Views LLC, contact us at legal@lumenVital.com.

In the event of a HIPAA breach, we will notify affected individuals and regulators as required by law.
5. DATA SECURITY
We implement reasonable and appropriate security measures (encryption in transit and at rest, access controls, regular audits) to protect your information. However, no system is 100% secure. We cannot guarantee absolute security, and you use the Services at your own risk.
We maintain a written information security program compliant with HIPAA and TDPSA.
6. DATA RETENTION
We retain your information only as long as necessary for the purposes outlined in this Policy, to comply with legal obligations, resolve disputes, or enforce agreements. PHI is retained in accordance with HIPAA requirements and our partner agreements. You may request deletion (subject to legal exceptions) as described in Section 7.
7. YOUR RIGHTS AND CHOICES (TDPSA and Other Privacy Rights)
As a Texas resident (or where applicable under other laws), you have the following rights under the TDPSA. We honor these rights for all users where required:

Access: Request confirmation of whether we process your data and obtain a copy.
Correction: Request correction of inaccurate data.
Deletion: Request deletion of your data (subject to exceptions).
Opt-Out: Opt out of (1) sale of personal data (we do not sell), (2) targeted advertising, (3) profiling that produces legal or significant effects.
Consent Withdrawal: Withdraw consent for processing sensitive data (including health data).
Appeal: Appeal any decision regarding your rights request.

To exercise these rights, submit a verifiable request via:

Email: privacy@lumenVital.com
Or the in-app “Privacy Rights” form (once live).

We respond within 45 days (extendable by another 45 days if needed). We do not discriminate against you for exercising your rights. Texas residents may also use the Global Privacy Control (GPC) signal for opt-outs.
For HIPAA rights (e.g., access to PHI), contact us or your healthcare provider directly.
8. COOKIES AND TRACKING TECHNOLOGIES
We use essential cookies for functionality and analytics cookies (with consent where required). You can manage preferences via your browser settings or our cookie consent banner (if implemented). We honor Do Not Track signals where applicable.
9. CHILDREN’S PRIVACY
The Services are not directed to children under 18. We do not knowingly collect data from children. If we learn we have collected such data, we will delete it.
10. INTERNATIONAL USERS
The Services are hosted in the United States. If you access from outside the U.S., your data is transferred to and processed in the U.S. under U.S. laws (which may differ from your local laws). By using the Services, you consent to this transfer.
11. CHANGES TO THIS POLICY
We may update this Policy. We will post the revised version with a new “Last Updated” date. Material changes will be notified via email or in-app notice. Your continued use after changes constitutes acceptance.
12. CONTACT US
For questions, rights requests, or to request a BAA:
Metric Views LLC
d/b/a LumenVital
legal@lumenVital.com or privacy@lumenVital.com
Sulphur Springs, Texas
You may also contact the Texas Attorney General for TDPSA complaints.
BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY, INCLUDING OUR HIPAA AND TDPSA COMPLIANCE PRACTICES.