Privacy you can verify, not just believe.

This page says exactly what Lumi's systems can and cannot do — in the same words our engineers use. We never claim ahead of the architecture.

Two ways to use Lumi

	Anonymous mode	With an account
Encryption	End-to-end — nothing leaves your device.	Encrypted in transit and at rest.
Identity	None. No email, no name, no account.	Personal details stored separately from health logs.
AI chat	Context assembled on your device.	Processed under strict no-training, no-resale terms.
Who can read your health logs	Only you.	No Lumi staff role can — it's blocked in the architecture, not just policy.

If you share with a clinician

Care summaries are built on your device and shared only by your explicit, scope-by-scope consent. You stay pseudonymous until you book. Every clinician view is logged and shown to you. Anonymous mode cannot be referred — by design.

If Lumi is ever acquired

You'll be notified before any data moves, with time to export or delete everything first. Our no-selling commitment is operational: not to advertisers, not to brokers, not to anyone.

← Back to the overview