Effective Date: January 1, 2026

Last Updated: January 1, 2026

This Privacy Policy describes how LumaClaims, LLC ("Company," "we," "us," or "our") collects, uses, stores, and discloses information about users ("you" or "Subscriber") of the LumaClaims Platform (the "Platform") and our public website at www.lumaclaims.com (the "Site").

By accessing or using the Platform or Site, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use our services.

This Privacy Policy does not apply to the Medicare claims data itself, which originates from the Centers for Medicare & Medicaid Services ("CMS") and has been de-identified by CMS prior to our receipt. Please refer to our Data Disclosure for information about that dataset.

2.1 Information You Provide Directly

When you register for an account or purchase a subscription, we collect:

• Name and job title
• Business name and address
• Email address
• Phone number (if provided)
• Payment information (processed by our third-party payment processor; we do not store full payment card numbers — see Section 2.3)
• Subscription configuration selections (claim type and HCPCS codes)
• Communications you send to us (support requests, feedback)

2.2 Information Collected Automatically

When you access the Platform or Site, we and our service providers may automatically collect:

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps
• Usage data: Features accessed, queries run, data filters applied, export activity (file type, date/time), and configuration change history
• Device information: Hardware model, unique device identifiers, and connection information
• Cookies and similar tracking technologies (see Section 6 below)

2.3 Payment Information

We collect payment only by check.

2.4 Information We Do Not Collect

The Medicare claims data available through the Platform has been anonymized by CMS. We do not collect, receive, or store any Medicare beneficiary personally identifiable information (PII) or Protected Health Information (PHI) as part of the underlying dataset.

We use the information we collect for the following purposes:

3.1 Service Delivery

• Creating and managing your account
• Processing subscription payments and renewals
• Delivering the Platform features you have subscribed to
• Maintaining your configuration settings and enforcing configuration change limits
• Processing data export requests
• Sending subscription confirmation, renewal reminders, and receipts

3.2 Platform Improvement and Analytics

• Understanding how users interact with the Platform to improve features
• Identifying and diagnosing technical issues
• Conducting internal analytics on aggregate usage patterns
• Developing new features and analytics capabilities

3.3 Security and Compliance

• Monitoring for unauthorized access, fraud, or Terms of Service violations
• Investigating and responding to security incidents
• Enforcing our Terms of Service, including prohibited use restrictions
• Complying with legal obligations

3.4 Communications

• Responding to your support inquiries and feedback
• Sending service-related notices (e.g., maintenance, data updates, policy changes)

Marketing communications: We may send you information about updates, new features, or promotions. You may opt out of marketing emails at any time by clicking "unsubscribe" in any such email or by contacting us at https://lumaclaims.com/contact. We will not use your information for third-party marketing purposes.

We do not sell your personal information. We may share your information only as described below:

4.1 Service Providers

We share information with trusted vendors who help us operate the Platform, including:

• Cloud infrastructure and hosting providers
• Payment processors
• Analytics and monitoring tools
• Email delivery services
• Customer support software

These providers are contractually restricted from using your information for their own purposes and must implement appropriate security measures.

4.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, court order, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

4.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy. We will provide notice of any such transfer as required by law.

4.4 Aggregate and De-identified Data

We may share aggregated or de-identified information (which cannot reasonably be used to identify you) with third parties for research, marketing, or analytical purposes without restriction.

4.5 With Your Consent

We may share your information for any other purpose with your explicit consent.

We retain your personal information for as long as your account is active, as necessary to provide the Platform, and as required by law. Specifically:

• Account information: Retained for the duration of your subscription plus 3 years following expiration or termination
• Payment records: Retained as required by applicable tax and financial regulations (typically 7 years)
• Usage logs: Retained for 3 years
• Support communications: Retained for 3 years

Upon expiration of these periods, we will securely delete or anonymize your personal information.

We use cookies and similar technologies to operate and improve the Platform and Site. Cookies are small text files stored on your device.

6.1 Types of Cookies We Use

• Essential cookies: Required for the Platform to function (authentication, session management, security). These cannot be disabled.
• Functional cookies: Remember your preferences and settings.
• Analytics cookies: Help us understand how users interact with the Platform.

6.2 Your Cookie Choices

You can control cookies through your browser settings. Note that disabling essential cookies may impair your ability to use the Platform. 

We implement commercially reasonable technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Employee training on data security

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7.1 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you within 72 hours of discovery via email to the address on file with your account, and we will comply with all applicable breach notification laws.

Subject to applicable law, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information, subject to legal retention requirements
• Portability: Request a copy of your data in a structured, machine-readable format
• Opt-out: Unsubscribe from marketing communications at any time

To exercise these rights, please contact us immediately at https://lumaclaims.com/contact.

8.1 California Residents (CCPA/CPRA)

The categories of “personal information” collected are described above.  You have the right to know, delete, and correct this information.  We do not sell or share “personal information.”  You may have the right to limit the use of “sensitive personal information.” 

The Platform is intended for business users and is not directed to children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately at https://lumaclaims.com/contact and we will take steps to delete it.

Our Platform is operated in the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the U.S. 

The Platform or Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email, in-platform notice, or posting on our website at least 30 days before the changes become effective. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision.

Your continued use of the Platform after the effective date of the revised Privacy Policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact our Privacy team:

Attn: Privacy Officer

LumaClaims

8270 Woodland Ctr Blvd

Tampa, FL  33614

For EU/UK data subjects, you also have the right to lodge a complaint with your local supervisory authority.