LUMI · PIPPA LLC
Lumi Privacy Policy
Lumi is an app made by Pippa LLC. It helps you keep a record of meals, symptoms and bathroom notes for a gut condition and, if you choose, share that record with a care team. The short version: we use your data only to run the app, we share it with a care team only after you connect to one and agree, we never sell it, we show no ads, and we put no advertising or analytics tools in the app.
This is the App Family Privacy Policy written for Lumi alone. Almost everything you save in Lumi is consumer health data, so we also publish a Consumer Health Data Privacy Policy in the form Washington's My Health My Data Act and similar state laws require. If these documents ever differ, the one that protects you more applies.
Plain-words version: Lumi in plain words.
1. What Lumi lets you save
Lumi is for: Digestive health (IBS). You can save: Meals and portion size, symptoms such as bloating or pain, stool form and flags (including blood or black stool), food reintroduction results, context such as sleep or stress, and help requests.
You choose what to log; nothing is filled in for you from other sources.
2. Everything else we handle
| Data | What it includes | Why |
|---|---|---|
| Account | Your email address and password (handled by our sign-in provider; we never see the password itself) | Creating and securing your account. Lumi has its own separate account. |
| Age and Terms | Your date of birth from the age screen, and when and how the Terms were agreed (by you, or by a parent or guardian) | Blocking use under 13, asking a guardian to agree for 13 to 17, and keeping AI chat to adults. These are kept on your phone and are not sent to us. |
| Your entries | What you log, as listed above, with the time and day you chose | Saved on your phone first, then copied to our servers when you are signed in, so it is backed up and can reach a care team you connect |
| Care-team connection | The code or invite you used, the clinic, and the data-sharing agreement you signed, including when you signed or ended it | Letting a care team see your record only with your agreement, and keeping a record of that agreement |
| Messages and help requests | Messages between you and your care team, help requests you send, and any visit summary you choose to share | Talking with your care team |
| Plans from your care team | Plans, routines and reminders your care team sets for you | Showing you the plan your team made |
| Device | An installation identifier, the app and its version, platform, language, time zone, and a push notification token if you allow notifications | Sync, and notifications at sensible times. Notification text is kept general so it does not reveal health details on a lock screen. |
| Subscription status | Whether you have an active Pro subscription, confirmed through Apple or Google | Turning on Pro extras. Apple or Google takes the payment; we never see your card. |
| Network details | Your IP address when the app talks to our server | Security and daily limits on the AI features |
3. What stays on your phone
- Meal photos are kept on your phone. They are not uploaded to our servers.
- AI chat history is kept on your phone for your account, and you can clear it at any time. It is not shared with your care team.
- Your date of birth and Terms acceptance, as above.
4. Optional features that send something off your phone
- Photo naming. Off until you turn it on: the first time you take a meal photo, the app asks whether to turn it on, and you can change your answer in Settings at any time. When it is on, a copy of the meal photo is sent once, through our server, to our AI provider OpenAI, which replies with a short food name. We do not keep the photo or log it, and the reply never includes amounts or judgments. The original photo stays on your phone.
- Barcode lookup. Only the barcode number is sent, from our server, to Open Food Facts, a public food database, to find the product name and the label values the app shows. We do not log the barcode, and Open Food Facts does not receive your account or entries.
- AI chat (adults only). What you type is sent through our server to OpenAI (model gpt-4o-mini) to write a reply, and checked by OpenAI's moderation service. Our server does not store the conversation and does not log what you type. See AI chat safety.
OpenAI processes this content only to answer the request. Under our API terms it is not used to train their models, and we never use your data to train AI models.
5. What we never do
- We never sell your data.
- We show no ads and share nothing with advertisers or data brokers.
- The app contains no advertising or analytics tools from other companies.
- We never use your data to train AI models.
- We collect no precise location and do no facial recognition.
6. Who can see your data
- You.
- A care team you connect. Nothing reaches a care team until you connect to a participating program (with a code or an invite) and sign a data-sharing agreement. After that, the team can see what you log in Lumi, your help requests, messages, and anything you choose to share. You can end the agreement in the app, and the team's access stops. Every time the team reads your record, our server checks that the agreement is still in place.
- Crisis alerts. If AI chat detects that you may be in crisis and you have a connected, consented care team, a confidential alert goes to them. Without one, no one is alerted and the app shows crisis resources to you directly.
- Service providers that run the app for us, only on our instructions. See section 7.
- The law. We disclose data only when validly required, and only what is required.
7. Service providers
| Provider | What they do for us |
|---|---|
| Amazon Web Services | Database and sign-in |
| Cloudflare | Our application server |
| OpenAI | AI chat replies, safety moderation and photo naming |
| Open Food Facts | Barcode lookups (receives the barcode number only) |
| Apple and Google | Push notifications and app store subscriptions |
The full list is on our subprocessors page. We have no affiliates.
8. How long we keep it
- While your account is open: we keep your entries so the app works.
- When you delete your account: it is closed right away, you are signed out, any connected care team loses access, and the data on your phone for that account is erased. Your data on our servers is permanently erased within 30 days.
- What we must keep: records of the data-sharing agreements you signed or ended, the deletion itself, and any audit records of care-team access, for about six years, as the law requires. These are kept against an internal identifier, not your name or email.
How to delete: Delete your account.
9. Children and teens
- Under 13: Lumi is not for children under 13. It asks for a date of birth before anything else and stops there for anyone under 13.
- 13 to 17: a parent or legal guardian must agree to the Terms for the teen, and the teen confirms they want to use the app.
- AI chat is for adults only. Anyone the age screen shows as under 18 does not see the chat. Instead they see: "Chat with Lumi is for adults. Your care team is here for questions."
- A parent or guardian may ask what we have collected about their teen, withdraw consent, and ask us to delete it, at pippa.app.general@gmail.com.
10. Security
Data is encrypted in transit and stored in access-controlled cloud systems. Care-team access is checked against your data-sharing agreement on every read. No system is perfectly secure. If a breach affects your data we will tell you without unreasonable delay and within the time the law requires.
11. Your rights
Wherever you live, you can ask to see and get a copy of your data (the app also lets you export your record), correct it, delete it, and withdraw consent, including ending a care team's access. We respond within 45 days (extendable once by 45 days with notice). If we say no, you can appeal by replying, and we answer appeals within 45 days. We will never treat you differently for using these rights. Because we sell nothing and show no ads, there is nothing to opt out of under "do not sell or share" laws.
12. Changes
If we make a material change we will tell you in the app before it applies, and we will not use data already collected in a new way without your consent. The date at the top shows the current version.
13. Contact
Pippa LLC, pippa.app.general@gmail.com.