Privacy Policy
Last updated 13 September 2026
This policy explains how Lumi Clinique (“we”, “us”), based in Montreal, Quebec, Canada, handles personal information, both on this website and inside Lumi.
This website
This site has no forms, no analytics and no cookies. Our hosting provider keeps standard server logs, including IP addresses, to keep the site up and secure. If you write to us on WhatsApp or by email, we keep that conversation so we can reply.
Inside Lumi, your clinic is in charge
Your clinic decides what patient information goes into Lumi and why. Your clinic is the controller of that information. We hold and process it on your clinic’s instructions, as its processor. If you are a patient and you want to see, correct or delete your record, contact your clinic.
What Lumi holds
Patient contact details and identifiers, appointments, consultation notes, treatment and package history, invoices and receipts, and staff account details. Health information is sensitive and we treat it that way.
Messaging
When your clinic sends a confirmation or a reminder, the message and the patient’s phone number pass through WhatsApp, which handles them under its own terms. We send only what the message needs.
The AI assistant
Lumi’s assistant turns what a staff member types or says into a proposed action. To do that, the request and the clinic data needed to answer it are sent to our AI provider for processing. It is not used to train models.
If your clinic connects Lumi to your own ChatGPT or Claude account, what you ask for there is handled by that provider, under your account and their policy. Only staff accounts can connect, and each person still sees only what their role allows.
Who else sees data
Only the suppliers we need in order to run the service: hosting, database, messaging and AI processing. Each one is bound to use the data only to provide its part of the service. We do not sell data and we do not use it for advertising.
Where it is kept, and for how long
Data sits with our hosting provider and stays there for as long as your clinic’s account is open. After an account closes we delete or anonymise it within 90 days, except where the law requires us to keep a record for longer.
Security
Access follows each person’s role, traffic is encrypted in transit, and stored data is encrypted at rest. Clinics are separated from one another, so one clinic can never read another’s records.
Your rights
Depending on where you live, you may have the right to see, correct, export or delete your personal information, or to object to how it is used. Patients should ask their clinic, which holds the record. Clinic staff can write to us.
We are based in Quebec, so Quebec’s private-sector privacy law and Canada’s federal privacy law apply to how we handle personal information. Privacy questions and requests go to the address below, and we answer within the time the law allows.
Changes
We update this page when our practices change, and we change the date at the top when we do.
Contact
Lumi Clinique, Montreal, Quebec, Canada
hello@lumiclinique.com