Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to information collected:

• Through the public Website;
• Through Website contact, consultation, newsletter, and scheduling forms;
• Through email, telephone, text message, and other communications initiated through the Website; and
• From service providers connected to the Website, as described below.

This Website Privacy Policy does not replace Lumaire's Patient Privacy Notice, which describes how medical records and other identifiable healthcare information are maintained, used, and disclosed. The Patient Privacy Notice is provided to Lumaire patients and is available upon request.

Medical records and other healthcare information maintained by Lumaire are protected under applicable Maine healthcare-confidentiality law and any applicable federal privacy law. If information submitted through the Website becomes part of your medical record, it will be handled under Lumaire's patient privacy practices and applicable law. Where Lumaire's Patient Privacy Notice or applicable law provides greater protection, that notice or law will control.

2. Information We Collect

Information You Provide Directly

We may collect information that you voluntarily provide when you:

• Request information or submit a contact form;
• Request or schedule a consultation or appointment;
• Tell us about your health goals, symptoms, concerns, treatment interests, or previous care;
• Subscribe to the Lumaire Journal or other communications;
• Communicate with us by telephone, email, text message, or patient portal;
• Purchase or inquire about a product, service, program, membership, or gift certificate;
• Respond to a survey, promotion, or feedback request; or
• Otherwise interact with Lumaire.

Depending on the interaction, this information may include:

• Name;
• Email address;
• Telephone number;
• Mailing address;
• Date of birth or confirmation that you are at least 18;
• Appointment preferences;
• Health goals, symptoms, concerns, treatment interests, and other health-related information;
• Communication preferences;
• Records of correspondence; and
• Other information you choose to provide.

Please do not use a general Website form, ordinary email, text message, or voicemail to communicate an urgent medical concern. These channels are not continuously monitored and may not be secure. For a medical emergency, call 911 or go to the nearest emergency department.

Information Collected Automatically

When you visit the Website, Lumaire and its Website service providers may automatically collect limited technical and usage information, including:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Approximate geographic location derived from an Internet Protocol address;
• Date and time of access;
• Pages viewed and navigation patterns;
• Referring website, advertisement, or link;
• General campaign or referral information; and
• Information collected through cookies and similar technologies.

Lumaire does not authorize analytics or advertising providers to collect the contents of consultation forms, clinical forms, patient-portal communications, or medical records.

Information Received From Other Services

We may receive information from service providers when you interact with scheduling, patient portal, payment, newsletter, communications, social-media, or other services connected to the Website.

The information received depends on the service used and the permissions you provide. Independently operated services may also collect information under their own privacy policies.

Information Not Intentionally Collected Through the Public Website

Lumaire does not intentionally request Social Security numbers, government identification numbers, insurance-policy numbers, or complete payment-card information through general public Website forms.

If you make a payment through a secure payment service, payment-card information is processed by the applicable payment processor and is subject to that provider's privacy and security practices. Lumaire may receive limited transaction information, such as the payment date, amount, status, and payment method.

3. How We Use Information

Lumaire may use information collected through the Website to:

• Respond to questions, requests, and consultation inquiries;
• Determine which Lumaire clinician or service may be appropriate for your stated needs;
• Schedule and manage consultations and appointments;
• Prepare for a requested consultation or appointment;
• Provide requested products, services, programs, or information;
• Send appointment confirmations, reminders, and follow-up communications;
• Deliver the Lumaire Journal and other communications you request;
• Process and document transactions;
• Maintain business, healthcare, and communication records;
• Operate, maintain, secure, and improve the Website;
• Understand Website traffic and performance;
• Measure the general effectiveness of outreach and advertising without intentionally disclosing sensitive health information;
• Prevent spam, fraud, misuse, and security incidents;
• Comply with legal, licensing, tax, accounting, and professional obligations;
• Establish, exercise, or defend legal rights; and
• Protect the rights, health, safety, and property of Lumaire, our patients, Website visitors, and others.

Lumaire may create and use aggregated or deidentified information for operational planning, internal analysis, Website security, and service improvement, provided that the information does not reasonably identify an individual.

4. Healthcare and Patient Information

Information you submit through a general Website form does not automatically become part of your medical record. Information used in connection with consultation, assessment, diagnosis, treatment, prescribing, payment, or clinical follow-up may be added to your medical record.

Medical records and identifiable healthcare information are handled under Lumaire's patient privacy practices and applicable law.

Lumaire does not sell identifiable healthcare information. Lumaire does not disclose identifiable healthcare information for third-party marketing or sales without the authorization required by applicable law.

The patient portal is the preferred method for nonurgent clinical communications. Do not use the patient portal, Website, email, text messaging, or voicemail for emergencies.

5. Calls, Text Messages, and Email

Lumaire may use the contact information you provide to respond to your inquiry, manage appointments, provide requested information, and send service-related communications.

If you separately consent to receive text messages from Lumaire:

• Message frequency may vary;
• Message and data rates may apply;
• You may opt out by replying STOP;
• You may request assistance by replying HELP; and
• Consent to receive marketing text messages is not a condition of purchasing any product or receiving treatment.

Mobile telephone information, text-messaging opt-in data, and consent will not be sold or shared with third parties or affiliates for their own marketing or promotional purposes. This information may be provided to service providers only as necessary to deliver and support Lumaire's communications.

If you subscribe to the Lumaire Journal or other marketing emails, you may unsubscribe at any time using the unsubscribe link included in the message.

Opting out of marketing communications will not prevent Lumaire from sending appointment reminders, transaction confirmations, responses to your requests, safety information, or other communications reasonably necessary to provide requested services.

Email, text messaging, and voicemail may not be completely secure. Please avoid sending sensitive medical information through these channels unless a Lumaire team member has instructed you to do so.

6. Cookies, Analytics, and Similar Technologies

The Website may use cookies and similar technologies to support Website functionality, remember preferences, understand Website performance, protect against fraud and abuse, and measure general outreach effectiveness.

These technologies may include:

Essential Technologies

Essential technologies support Website security, form submission, navigation, and other basic functions. These technologies may operate automatically because the Website may not function properly without them.

Functional Technologies

Functional technologies remember choices and preferences and may provide enhanced Website features.

Analytics Technologies

Analytics technologies help Lumaire understand general Website traffic, performance, and navigation patterns.

Lumaire does not authorize analytics providers to collect information typed into Website forms, patient-portal activity, medical records, or other clinical communications.

Advertising and Attribution Technologies

Lumaire may use limited advertising-attribution technologies to understand whether a visitor arrived from an advertisement, email, search result, or other referral source.

Lumaire does not authorize advertising platforms to receive:

• Symptoms or health concerns;
• Treatment selections or health goals submitted through a form;
• Medical records or patient-portal information;
• Appointment details;
• Form-field contents; or
• Information identifying or reasonably revealing an individual's health interests for third-party targeted advertising.

Advertising or analytics technologies must not be placed on secure patient-portal pages or configured to collect information submitted through consultation, scheduling, or clinical forms.

Your Cookie Choices

Nonessential analytics and advertising technologies will not be activated until you make a cookie choice where consent is required or offered through the Website.

You may accept or decline nonessential technologies through the Website's cookie controls. You may also block or delete cookies through your browser settings, although doing so may affect Website functionality.

7. How We Disclose Information

Lumaire may disclose information:

• To Website hosting, security, scheduling, patient portal, communications, newsletter, analytics, payment, and other service providers that support Lumaire's operations;
• To healthcare professionals and service providers involved in your care when permitted by law;
• To fulfill the purpose for which you provided the information;
• At your direction or with your consent;
• When required by law, court order, subpoena, licensing authority, governmental request, or other legal process;
• When reasonably necessary to protect health, safety, legal rights, or property;
• To professional advisers, insurers, accountants, or attorneys when reasonably necessary and legally permitted; or
• In connection with a merger, financing, acquisition, reorganization, or transfer of some or all of Lumaire's business, subject to applicable confidentiality and legal requirements.

Service providers are authorized to use information only to provide services to Lumaire or as otherwise permitted by law.

Lumaire does not sell personal information for money. Lumaire does not authorize third parties to use identifiable healthcare information or text-messaging consent information for their own marketing.

Certain state laws may define advertising-related disclosures of online identifiers as a "sale," "sharing," or "targeted advertising" even when no money is exchanged. Where such laws apply, Lumaire will provide the choices and rights required by applicable law.

8. Third-Party Websites and Services

The Website may contain links to independently operated services, including scheduling, patient portal, payment, financing, pharmacy, laboratory, social-media, product, and retail services.

Lumaire does not control and is not responsible for the privacy, security, content, or practices of independently operated third parties. Please review their privacy policies before providing personal information.

A link to another service does not mean that Lumaire endorses or accepts responsibility for that service's privacy practices.

9. Data Retention

Lumaire retains information for as long as reasonably necessary to:

• Fulfill the purpose for which it was collected;
• Provide requested services;
• Maintain medical, business, payment, and communication records;
• Comply with legal, licensing, tax, accounting, and professional obligations;
• Resolve disputes;
• Prevent fraud or abuse;
• Protect legal rights; and
• Enforce agreements.

Medical records are retained according to applicable healthcare record-retention requirements.

Lumaire may retain backup, archived, transaction, or legally required information after a deletion request when retention is required or permitted by law.

10. Data Security and Incident Notification

Lumaire uses reasonable administrative, technical, and physical safeguards designed to protect personal and healthcare information against unauthorized access, alteration, disclosure, loss, or destruction.

The Website uses HTTPS encryption to protect information transmitted between your browser and the Website. Independently operated third-party services maintain their own security practices and safeguards.

No website, electronic transmission, or storage system can be guaranteed to be completely secure.

If Lumaire determines that a security incident requires notification under applicable law, Lumaire will notify affected individuals and applicable governmental authorities as required.

11. Your Choices and Privacy Requests

Subject to applicable law and appropriate verification, you may contact Lumaire to:

• Ask what personal information Lumaire maintains about you;
• Request correction of inaccurate personal information;
• Request deletion of information when deletion is legally and operationally permitted;
• Withdraw consent when processing is based on consent;
• Opt out of marketing emails or text messages;
• Manage nonessential cookies;
• Ask how information is used or disclosed; or
• Raise a concern about Lumaire's privacy practices.

Before completing a request, Lumaire may take reasonable steps to verify your identity and authority to make the request. Lumaire may deny or limit a request when identity cannot be verified or when retaining or using the information is required or permitted by law.

Certain information cannot be deleted if it is part of a medical record, payment record, legal obligation, security record, or other record Lumaire is required or permitted to retain.

Lumaire will not discriminate against you for making a good-faith privacy request or exercising a privacy right provided by applicable law.

12. Children's Privacy

Lumaire provides clinical services only to individuals who are at least 18 years old.

The Website and Lumaire's services are not directed to individuals under 18, and Lumaire does not knowingly solicit or collect personal information directly from individuals under 18.

If Lumaire learns that information has been submitted by an individual under 18, Lumaire may delete it when legally and operationally permitted.

13. Changes to This Policy

Lumaire may revise this Privacy Policy periodically. The revised policy will be posted on this page with an updated effective date.

Material changes will apply prospectively unless applicable law permits or requires otherwise. We encourage you to review this policy periodically.