Privacy Policy

Effective October 23, 2026

Luma Direct, a Utah nonprofit corporation, is tax-exempt under Section 501(c)(3) of the Internal Revenue Code (EIN 41-4875233) and is based in Highland, Utah. We run a 90-day education and navigation program for families who have recently received a Type 1 diabetes (T1D) diagnosis.

Luma Direct is not a medical provider. We do not provide medical care, medical advice, diagnosis, or treatment. We are not a HIPAA "covered entity," and we do not describe our program as HIPAA-compliant. We still treat the health-related information families share with us as sensitive, as described below.

This policy explains what we collect on lumadirect.org, why we collect it, who helps us process it, and the choices you have. Questions: support@lumadirect.org.

1. What we collect

We try to collect only what we need to run the program.

Signing in. You can sign in with Google or with a one-time code we email you. If you created your account with Google, you can also sign in with a code sent to the same verified email address. Each time someone signs in with a code, we email that address so you can sign out everywhere if it wasn't you.

Email code. We send a short code to your email address. The code expires in 10 minutes and works only once.
Google. Google confirms who you are and shares your name, email address, whether it's verified, and an account ID with us. We don't get your password or your contacts, and we don't post anything. Google can see that you signed in to Luma Direct. Its own privacy policy covers what it does with that.

Family program information. When you enroll, either for yourself (age 13 or older) or as a parent, guardian, or other adult enrolling someone else, we ask for:

your relationship to the person diagnosed (for example parent, legal guardian, grandparent, or "self");
the diagnosis date (you can change it in your profile; you and any parent or co-parent who can edit your family's account can see it, but read-only care-circle members can't; we use it in internal program reporting and never share it with partners; Day 1 of the 90-day program is the day you enroll);
a first name or family label for the person the program is for, whether that person is a minor, and an age range (not a birth date);
optional high-level profile choices, such as the kinds of care considerations to keep in mind (for example "food related" or "prefer not to say") and the topics you want help with (for example school or daycare, insurance and pharmacy);
optional contacts you choose to save, such as a care-team, educator, pharmacy, or nutritionist name and phone number, and support people (name, phone number, relationship);
program activity: steps and milestones completed, current phase and day, checklists, notes, and the outputs you save (for example visit-prep question lists or school packets);
check-in answers: on some program days we ask "How's it going?" We save the option you pick (for example "Going well"), whether you turned on "Contact me", and the date. There is no free-text box. Only Luma Direct staff see your answers; partners and supporters you invite do not.
for family members or supporters you invite: their relationship to the person diagnosed, any message you add to the invite, and the invite status.

Enrollment codes and partner referral. If you enroll with a code from a clinic, employer, or other partner, we record the code and which partner it belongs to. If you enroll with a partner's link or code, that partner sees only group totals for the families it referred, as described in 'Referral partners' below. We do not share your name, email, notes, the content of saved outputs, or care-team contacts with partners.

Donations. If you donate, we collect your name (optional), email address, the amount, whether the gift is one-time or monthly, and the payment status. Card details are entered on Stripe's checkout page and are handled by Stripe. Luma Direct does not receive or store your full card number.

Partner organizations. For clinics, employers, educators, and community organizations: organization name, contact name, email, phone, inquiry message, agreement acceptance, billing status, and invite activity (for example when an invite link was opened and accepted).

Contact form. Your name, email, topic, and message. We deliver contact messages to our support inbox by email; we do not store the message text in our program database.

Age question. When you create an account, we ask for your birth month and year. We use it only to decide which kind of account you can create, and we keep only the resulting age group (adult, 13 to 17, or under 13), not your birth date.

Educational resource activity. When signed-in participants open a resource in our library, we record which resource was opened and at what program phase, to improve the library.

Program emails. We keep a record of which program emails we sent you and when, and whether you unsubscribed. We don't track whether you open them.

Technical and error information. Our servers keep standard logs (such as IP address, browser type, pages requested, and errors) for security, debugging, and reliability. When something breaks, we send an error report to our error-monitoring provider (see Section 5). Error reports are set up to leave out email addresses, cookies, form contents, and web-address parameters. We keep server logs for 30 days.

Website analytics. On our public pages, we use Google Analytics to count visits and see which pages are useful. It uses cookies to collect things like pages viewed, device type and general location. It doesn't run on signed-in or enrollment pages, and we don't use it for advertising. You can block it with your browser settings or Google's opt-out tool.

2. Health information we treat as sensitive

Some of what families share relates to T1D, such as the diagnosis date, age range, care-consideration categories, and care-team contacts. We treat this as sensitive information. We:

use it only to deliver education and navigation support to your family and to operate and improve the program;
never sell it, and never use it for advertising;
do not ask for, and our tools are built to block, detailed medical data such as glucose readings, insulin doses, device data, or lab results. If you type that kind of detail into notes, we may refuse to save it and ask you to rephrase.

Please do not send detailed medical information through Luma Direct. Your care team is the right place for it.

3. How we use information

To deliver the 90-day program: your dashboard, phases, checklists, saved outputs, and family/supporter access.
To send program and account emails. Program emails follow your 90-day program: a welcome, the start of each phase, a reminder when a template is due and one more if it's 3 days overdue, check-in prompts, and a Day 90 wrap-up. Account emails include enrollment confirmation, invites, billing and payment notices for partners, and replies to your messages. We don't put donation requests or ads in program emails.
To follow up when you ask for a person to reach out, and to see which families might want a reminder. Each day, Luma Direct staff receive a short internal summary. It contains only an internal ID and program status (phase and day, the check-in choice or overdue item, and the date). It has no names, contact details, or children's information.
To process donations and partner payments and keep financial records.
To attribute enrollments to referring partners and report program usage to them, as described above.
To keep the service secure, find and fix errors, and prevent misuse.
To improve content quality, safety, and usability, using aggregated or de-identified information where we can.
To meet legal, tax, and accounting obligations.

We do not sell personal information, and we do not use it for targeted advertising.

4. AI-assisted tools

Our AI-assisted tools are not turned on right now. If we turn them on, they will be educational only (for example explaining terms in plain language or helping you prepare questions for your care team) and not medical advice, and only adults (18 and older) will be able to use them. Before we turn them on, we will update this policy to name the AI provider and explain what is sent to it. We do not store the raw text of AI conversations.

We share personal information only with service providers that help us run Luma Direct, only for that purpose, and as required by law:

Provider	What it does for us	Information involved
Stripe	Donation and partner payment processing	Name, email, amount, payment details (card data entered with Stripe)
Google (Google sign-in)	Sign-in	Google account ID, email, verified-email status, name
Google Workspace	Our email: sending program emails (from no-reply@lumadirect.org), account emails, and our internal staff summary through Google's mail relay, and our support, partner, and billing inboxes	Recipient name and email, email content, messages you send us
DigitalOcean	Hosting and database	All information stored by the service
Sentry	Error monitoring	Technical error details (error message, page or app route, browser and device type). Set up to leave out email addresses, cookies, form contents, and web-address parameters; no screen recording

We may also share information:

Referral partners: group progress totals only, with any total under 11 hidden (see 'Referral partners').
with family members or supporters you invite to your program, at the access level you choose;
if required by law, subpoena, or court order, or to protect someone's safety or the security of the service;
with a successor organization if Luma Direct merges or transfers its program, subject to this policy.

Referral partners

If you enroll through a link or code from a clinic, school, employer or other organization ("referral partner"), that partner can see progress totals for the families it referred. These totals include how many families enrolled, are working through the program, finished it, or haven't been active recently, plus which phase families are in and the completion rate. Partners see totals only. They never see your name, email address, contact details, care circle, or anything you write or save in Luma, and we hide any total under 11 so no one family can be picked out. Partners do not send us your health information; you enroll yourself. We do not sell your information or share it with partners for marketing.

6. Cookies, local storage, and analytics

We use a small number of cookies that are needed for the site to work:

Sign-in session cookie (app_session_id): keeps you signed in; expires after 7 days.
Sign-in security cookie (__Host-luma_google_challenge): protects the Google sign-in step; expires after 10 minutes.
Layout preference (sidebar_state): remembers whether a dashboard sidebar is open; 7 days.
Age question result (luma_age_gate): remembers the age group from the age question so it is not asked again; ends when you close your browser (at most 12 hours). It does not hold a birth date.

We do not use advertising or cross-site tracking cookies. Our error-monitoring tool does not set cookies.

Your browser's local storage keeps some items on your device for convenience: your display theme, your signed-in profile (name and email) for faster page loads, an enrollment code you started with, and draft checklists and notes in some workspace tools. These stay on your device until you clear them. If you use a shared computer, clear your browser data after signing out.

7. Retention

We keep information only as long as we need it for the purposes above.

Program and family account information: while your account is active and for 12 months after your account closes, unless you ask us to delete it sooner.
Check-in answers and program email records: kept with your program and family account information (12 months after your account closes).
Donation and payment records: 7 years for tax and accounting obligations.
Partner records: for the length of the partnership and 7 years after.
Server logs: 30 days. Error reports: 30 days in Sentry.
Expired sign-in sessions and sign-in security records: deleted 30 days after they expire.

8. Security

We use reasonable administrative, technical, and physical safeguards, including encrypted connections (HTTPS), restricted staff access, and limits on what health detail our tools will store. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach that affects your information, we will notify you as required by law.

9. Your choices and rights

You can ask us to:

give you a copy of your information (access);
correct information that is wrong;
delete your information or your child's information;
stop program emails at any time, using the one-click unsubscribe link in any program email or by emailing support@lumadirect.org. We stop within 2 days. We will still send emails needed for your account, such as enrollment confirmation, invites, and donation receipts.

Email support@lumadirect.org from the address on your account. We may need to verify your identity. We will respond within 10 business days. Some records (such as donation records) may be kept where the law requires it.

State privacy rights. Depending on where you live (for example California, Washington, Colorado, Utah, or other states with privacy or consumer-health-data laws), you may have additional rights to access, correct, delete, or limit use of your personal or health-related information. We honor those requests through the same email address.

10. Changes to this policy

We may update this policy. We will post the new version here with a new effective date. If we make a material change to how we use family or health-related information, we will notify account holders by email or on the site before it takes effect.

11. Contact

Contact us. Luma Direct is a 501(c)(3) nonprofit, EIN 41-4875233 (Verify with the IRS). Email us at support@lumadirect.org.