Privacy policy

Last updated 20 October 2026 · Version 1.1 · Applies to lumii.com.au, the Lumii staff apps and web app, online booking, telehealth, Clinic Line, the myLumii patient app and portal, and the cloud services behind them.

This policy explains how Lumii Health Pty Ltd ("Lumii", "we", "us") handles personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Health information is sensitive information under the Act, and we treat all of it that way.

1. Who we are and who this policy covers

Lumii is practice-management and care software used by medical, allied-health, NDIS, DVA, WorkCover, aged-care and telehealth providers (each a "clinic"), and by the people they care for. Three privacy relationships exist, and which one applies to you decides who answers for your information.

• Website visitors, clinic owners and clinic staff. Lumii is the organisation responsible for the personal information we collect about you.
• Patients of a clinic. Your clinic decides what it collects about you and why, and is the organisation responsible for your health records. Lumii holds and processes that information as the clinic's service provider, on its instructions and under our agreement with it. Read your clinic's privacy policy first; this policy explains what Lumii does with the information it holds for the clinic. Clinics in New South Wales, Victoria and the ACT are also bound by their state or territory health records laws.
• People using myLumii for themselves. Readings, journal entries and other information you record in myLumii that you have not shared with a clinic are held by Lumii for you, and Lumii is responsible for them.

2. What personal information we collect

2.1 From this website

If you request access, we collect your name, email address, which kind of Lumii you are interested in (practice, practitioner or personal), and any practice name, role or message you add, together with the site language you were using. The form runs a Cloudflare bot check, which sends your IP address and a challenge token to Cloudflare. The site sets no cookies. It keeps your light-or-dark theme choice in your browser's local storage, and Cloudflare produces aggregate, cookieless visitor statistics for us.

2.2 From clinic owners and staff

• Name, email address, mobile number, role and the clinic you belong to.
• Sign-in credentials. Passwords are hashed by Firebase Authentication and we never see them. Every staff account uses multi-factor authentication, so we hold the enrolment for your authenticator app and any trusted devices.
• Provider numbers, AHPRA registration, bank details and identity documents where you supply them for claiming, payouts or Stripe Connect onboarding.
• Subscription and billing details, support conversations, and your in-app preferences and devices.
• An audit trail of significant actions you take in Lumii (what you opened, created, changed, deleted, sent, signed in and out of), kept for security and compliance.

2.3 About patients, on behalf of a clinic

When you book, register, fill in a form, message your clinic, join a telehealth call or use the patient portal, we collect the following for your clinic. Not every item applies to every clinic; it depends on the services you use and the fields your clinic turns on.

• Identity and contact details: name, date of birth, sex and gender, email, mobile and other phone numbers, residential and postal address, occupation, a profile photo if you add one, emergency contact, and preferred language.
• Family links: the name, date of birth and contact details of family members you book for or link to, and the relationship between you.
• Government and funding identifiers (see section 9): Medicare card number and reference number, DVA file number and card colour, private health fund membership, NDIS participant number and plan details, WorkCover, TAC, Comcare or icare claim numbers, and concession or pension card details.
• Health information: the reason for your visit and anything you write when booking; your answers to intake, screening, consent and outcome questionnaires; documents, images and referrals you upload; and the clinical records your clinic keeps about you, including notes, measurements, treatment plans, letters, prescriptions, care plans and invoices.
• Account and activity: your portal password (hashed) and optional multi-factor authentication; booking history; payments and payment plans; saved payment methods held as Stripe tokens; signed forms and agreements; orders you place with the clinic and their delivery address; and your reminder and marketing preferences.
• Messages and calls: SMS, email and portal messages between you and your clinic, with timestamps and delivery status. Calls through Clinic Line are not recorded; we keep the number, time and outcome of the call.
• Telehealth: room identifiers, timestamps, connection-quality readings and the consent you give before a call. Audio and video are relayed live and are not stored unless your clinic has recording turned on and you have consented, in which case the recording, and any transcript or live captions the clinic turns on, are stored with your clinical record.

We never collect your card number. Card entry happens on Stripe's or Tyro's hosted checkout and the number goes directly to them.

2.4 From you directly, in myLumii

myLumii lets you record information for yourself: readings imported from Apple Health, Health Connect, Garmin, Oura or Fitbit if you connect them (heart rate, sleep, steps and similar), exercise you log, food, mood and journal entries. Nothing you record in myLumii is shared with a clinic unless you choose to share a specific kind of information with a specific clinic, and journal, food and exercise entries can never be shared with a clinic. Unlinking a clinic withdraws everything you had shared with it. myLumii also asks, separately and optionally, whether de-identified information may be used for research; it starts as "no".

2.5 Collected automatically

• IP address with every request, used in hashed form to rate-limit sign-ups and bookings and to detect abuse.
• Bot-detection signals from Firebase App Check and Google reCAPTCHA Enterprise on the booking page and portal. The token carries no personal information.
• Browser storage in the booking page and web apps for your language, a "keep me signed in" choice, your sign-in session and a snapshot of an in-progress booking so you can resume it. Lumii sets no advertising or cross-site tracking cookies.
• Server logs of requests to our cloud functions, kept for 30 days for security and troubleshooting.
• Crash and diagnostic reports from the apps through Firebase Crashlytics: build, operating system and device details and non-fatal errors. No health information is included.
• Booking analytics only if your clinic turns on Google Analytics or the Meta Pixel on its booking page. They are off by default and run under the clinic's own configuration.

2.6 From other sources

We receive information about you from Tyro Health and the funders it connects to (eligibility and claim outcomes), from Xero when a clinic links its accounting, from other healthcare providers who send referrals through HealthLink, from NDIS plans a clinic uploads, from the social media accounts a clinic connects (account identifier and access token only, never followers or private messages), and from the address look-up we run against the national address file when you type an address.

3. How we collect it

We collect information directly from you when you use the website, an app, the booking page, a form, the portal or a telehealth call; from your clinic when it records information about you; and from the integrations above. When you deal with us as a clinic owner or staff member we tell you at the point of collection what is required and why. You can browse this website without identifying yourself. You cannot use Lumii's services anonymously or under a pseudonym, because bookings, claims and clinical records must be attributed to a real person. If we receive personal information we did not ask for and could not have collected ourselves, we delete or de-identify it.

4. How we use personal information

• To respond to your access request and talk to you about onboarding.
• To run the platform: accounts, bookings, waiting lists, reminders, forms, clinical records, invoicing, payments, claims, telehealth, messaging, phone calls, orders, reporting and compliance tracking.
• To help clinics meet their professional and legal obligations, including AHPRA, Medicare, DVA, NDIS, WorkCover and record-keeping laws.
• To match an online booking to an existing patient file so a clinic does not end up with duplicate records; guests are never matched on name and date of birth alone.
• To provide support, monitor security, investigate incidents and prevent fraud.
• To send service messages (password resets, security notices) and, for a clinic, appointment confirmations, reminders and recalls.
• To let a clinic that has opted in compare its own de-identified operational figures with aggregated figures from other opted-in clinics. No patient-level data and no clinic's identity leaves the benchmark.
• To improve Lumii, using de-identified or aggregated information only. We never use patient information for Lumii's own marketing and we do not sell personal information.

Lumii's team can reach platform data when that is needed for support, billing, incident response or security monitoring. Routine support tooling shows message-delivery logs, payment and claim event logs, usage statistics and function logs rather than clinical records. Any wider access is logged and reviewed. A clinic owner can also grant an outside organisation, such as a bookkeeper, a locum or an administration agency, access to the clinic; the owner chooses the scope, can hide patient names, and can see every read and write that organisation makes.

5. AI features

Lumii includes optional AI features: an ambient scribe that drafts a consultation note from a recorded session, drafts of patient replies and letters, summaries of reports and NDIS plans, interpretation of outcome measures, draft booking rules, draft social posts, live-caption translation, and Lumii Assist, which answers staff questions about using Lumii. Each clinic turns these on or off in Settings, and chooses the provider. Where a feature works on patient information, Lumii's managed provider is Google Vertex AI pinned to the Sydney region. A clinic can instead supply its own Anthropic or OpenAI account, or choose the automatic option, which uses Cloudflare Workers AI; those providers process text in the United States or wherever their nearest region is. Lumii Assist, report summaries and social-post drafts use Anthropic. Our agreements with every provider prohibit using Lumii data to train models. AI never sends a message, saves a note or makes a booking on its own: a person reviews every draft, and every AI use is listed in the clinic's AI activity log.

6. Automated decisions

Some things in Lumii happen without a person deciding them at the time, under rules a clinic has set up. The kinds of personal information these use are contact details, appointment history and preferences, the content of reminder replies, payment and funding information, account status and family links. The decisions are:

• Offering a freed appointment slot to people on the waiting list, and booking the first who accepts.
• Cancelling an appointment when a patient replies to a reminder text saying they will not attend.
• Holding or charging a late-cancellation fee under a clinic's stated policy, including charging a saved card.
• Automation rules a clinic writes that raise a fee, request payment or contact a patient when a condition is met.
• Sending recall reminders when a patient is due for a follow-up.
• Blocking online booking while an invoice is unpaid, or blocking portal sign-in for an inactive account.
• Ending a parent's access to a child's records when the child reaches the age the clinic sets.
• Applying per-patient booking rules and age-based fee categories.
• Charging the next instalment of a payment plan a patient agreed to.
• Scoring no-show risk, checking NDIS funding at booking, and checking Medicare or DVA eligibility, as prompts for staff.
• AI scribe drafts, AI outcome-measure interpretation and Practice Operator suggestions, which a person reviews before anything is saved or sent.

Each is off until a clinic turns it on, except the age-based fee category, which only ever adds a missing fee tier and never changes one already recorded. Each clinic keeps a register of the automated decisions it runs. If an automated decision affects you, ask your clinic to review it; a person can reverse any of them.

7. Who we share it with

Your clinic shares your information with the people and organisations involved in your care and funding, as its own policy describes. Lumii discloses personal information only to the service providers below, each bound by a data-processing agreement limiting it to acting on our instructions, and otherwise only where the law requires or authorises it or to protect someone's safety.

We tell clinic owners by email at least 30 days before we add a provider that will handle patient information, unless a security or legal emergency forces a shorter notice.

8. Overseas disclosure

Platform data lives in Google Cloud's Sydney region, and website enquiries are stored in Sydney. Some providers in the table process information outside Australia, mostly in the United States: Firebase Authentication (sign-in credentials), Cloudflare, Resend, Stripe, Twilio (metadata), LiveKit (media in transit), Google Workspace, Xero, Canva, the social media platforms, Apple, Google, the wearable platforms, and Anthropic, OpenAI or Cloudflare when a clinic chooses them for AI. Before disclosing to any of them we take reasonable steps, through contract and configuration, to make sure the information is handled consistently with the Australian Privacy Principles. Services Australia, the Department of Veterans' Affairs, the NDIA and health funds receive claims only in Australia, through Tyro Health.

9. Government identifiers

We hold Medicare, DVA, NDIS, WorkCover, Comcare and similar identifiers only so a clinic can verify eligibility and lodge claims with the body that issued them. We never use a government identifier as our own way of identifying you, and we never disclose one except to make that claim or where the law requires it.

10. Storage, security and retention

• Encryption in transit (TLS 1.2 or later) and at rest (Google-managed AES-256).
• Keys, payment-provider secrets and messaging tokens live in Google Secret Manager; third-party access tokens stored in our database are encrypted again at the field level.
• Role-based permissions on every screen, database rules that keep each clinic's records isolated from every other clinic, and an audit log of staff actions.
• Mandatory multi-factor authentication for staff, optional for patients, with fresh re-authentication for privileged actions, a server-enforced password policy and sign-up rate limiting.
• Daily database backups kept for 90 days in a Sydney storage bucket.

Our security page describes these controls in more detail, and security@lumii.com.au receives vulnerability reports.

We keep information for as long as the purpose it was collected for needs it:

• Website access requests: until we have answered and the onboarding conversation has ended, then deleted or de-identified, or sooner if you ask.
• Clinical and patient records: for as long as the clinic's record-keeping law requires, which in most Australian jurisdictions is at least seven years from the last contact, or until a child patient turns 25. The clinic sets the period and instructs us.
• Audit logs: at least seven years, in line with record-keeping norms.
• Server logs: 30 days. Backups: 90 days.
• A clinic that leaves Lumii can export its data, after which we delete what the law does not require us to keep, on the timetable in the clinic's agreement.

11. Access, correction and deletion

You can ask for a copy of the personal information we hold about you, ask us to correct it, and ask us to delete it. Email support@lumii.com.au from the address on your account. We will verify your identity, respond within 30 days, and give reasons if we cannot do what you ask. If you are a patient, contact your clinic first: it holds your records and can correct or release them, and we act on its instructions. Clinic staff can request deletion of their account by following the staff account deletion instructions; clinical, billing and audit records a clinic must keep are retained even after an account is deleted. Anyone who connected a social media account to Lumii can revoke that access in Lumii or on the platform itself, which deletes the stored token.

12. Marketing and communications

Service messages, such as appointment confirmations, reminders, password resets and security notices, are part of providing the service. Marketing from Lumii to clinic owners is opt-in and every message has an unsubscribe link. A clinic may send its own patients marketing or recall messages only where the patient has opted in, and every Lumii-sent SMS and email offers a way to opt out, including replying STOP to a text. We do not use patient information for Lumii's own marketing.

13. Data breaches

If personal information is lost or accessed or disclosed without authorisation, we contain the incident, assess it, and tell the affected clinic without delay so it can meet its own obligations. Where the breach is likely to cause serious harm to anyone, we notify the Office of the Australian Information Commissioner and the affected people as soon as practicable under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

14. Children and family access

Clinics treat patients of every age. We collect a child's information only on a clinic's instruction and under its consent process, normally through a parent or guardian. A parent or guardian can book for and view a child's record through a family link; a clinic can end that access automatically when the child reaches the age the clinic sets, and the young person can then hold their own account.

15. Complaints

If you think we have mishandled your personal information, email support@lumii.com.au with "Privacy complaint" in the subject. We acknowledge complaints within seven days, investigate, and reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992, or, for a clinic's health records in New South Wales, Victoria or the ACT, to that state or territory's health records regulator.

16. Changes to this policy

We update this policy when the service, our providers or the law change. The version and date at the top tell you which policy you are reading. We notify clinic owners of material changes by email and in the app, and we keep earlier versions available on request. This version supersedes the policy dated 13 June 2026.

17. Contact us

Our terms and security page sit alongside this policy.