Privacy Policy

A note before the legal text

We wrote this to be readable. Each section opens with a plain-language summary in italics, followed by the full terms. Our core promises in one place:

• We will never sell your personal information.
• We will never use your grief or your loss to serve you advertising, and we do not allow advertising trackers anywhere on this website.
• We collect only what helps us support you, and we tell you why.
• When we cannot state a fact honestly, we leave it out rather than guess.

What exists today. LumenUs today is this website: the Library, the personalized path tool, and the forms through which you can contact us, request a demo, join the waitlist, or apply as a provider. There are no member accounts, no mobile app, no AI chatbot or AI conversation feature of any kind, no payments, and no subscriptions. Where this Policy describes the LumenUs platform, those sections are written for the platform's launch and take effect only if and when those features become available. Until then, no data described in those sections is collected, because the features that would collect it do not exist.

---

1. Who and what this Policy covers, and where it applies

This covers everyone who touches LumenUs: members, the supporters they invite, the people we serve information about, and website visitors. The Service is directed to users in the United States.

This Policy applies to four groups:

(a) Members who use the LumenUs platform and app for grief support. (b) Supporters whom a member invites into their Circle of Care. A Supporter is also a person with their own rights under this Policy. (c) Information about other people, including the person who died and other members of a member's Circle, which a member may provide. (d) Visitors to our website, lumenus.life.

Jurisdictional scope. LumenUs is operated from the United States and is directed to users located in the United States. We do not offer the Service to, or direct it at, individuals in the European Economic Area, the United Kingdom, or other jurisdictions outside the United States, and this Policy is written to United States law. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

---

2. Information we collect

We collect what you give us, what is created as you use the Service, and, for our partner and outreach programs, certain information from public sources. Before or at the point we collect, we give you notice of what we collect and why, consistent with the CCPA notice at collection.

We provide notice of the categories of personal information we collect and the purposes for which we use them at or before the point of collection, consistent with the California Consumer Privacy Act (CCPA) notice-at-collection requirement. This Section, together with Sections 3 and 4, serves as that notice.

2.1 Information you provide

On this website today:

If and when the LumenUs platform launches with member accounts, it may also collect, and this Policy will be updated before it does:

The platform will not include an AI chatbot, AI companion, or AI conversation feature, and no conversation data is collected. If that ever changes, this Policy will describe the feature, the provider, and the protections before the feature is available to anyone (Section 5).

2.2 Information created as you use the Service

2.3 Information from other sources

We may receive information from partners who refer you, and from service providers. We do not conduct automated outreach to bereaved people who are not users.

We may receive information from a partner who refers you (such as a hospice or employer benefit program) and from service providers. We do not conduct automated marketing outreach to bereaved non-users.

2.4 What we do not collect

We do not knowingly collect information from anyone under 18, and we do not collect biometric data. We do not use your grief, health, or loss to advertise to you. Our use of cookies and analytics, including limited analytics and advertising-measurement on our public marketing website, is described in Section 13 and in our Cookie Policy.

---

3. Sensitive and consumer health data

A lot of what you share with us is sensitive. We treat it that way, and we ask your consent before using it beyond the support you came for. We do not use it for purposes that would trigger the California right to limit its use.

Much of the information above is sensitive, including information that can reveal your mental or physical health, your religion, and the cause of a death (which may include suicide, overdose, or pregnancy and infant loss). This category also includes your responses to any grief reflection questions and any reflection we derive from them. These reflections are a self-reflection aid, developed by LumenUs. They are not a diagnostic tool, they are not a clinical assessment, and they do not diagnose any condition. Your consent to that reflection is obtained separately at the point of use, as described in the Consumer Health Data Privacy Policy. We treat all of this as sensitive personal information and, where it qualifies, as consumer health data under state law.

We will not use or disclose your sensitive information for any purpose other than providing the Service and the purposes you have consented to, and we obtain your affirmative, explicit consent before any use that requires it.

California right to limit the use of sensitive personal information. Under the California Privacy Rights Act (CPRA), a consumer may direct a business to limit its use of sensitive personal information to specified purposes. We use sensitive personal information only to perform the Service you have requested, to keep you safe, to maintain security and prevent fraud, and for the other purposes described in Section 4, all of which fall within the uses that the CPRA exempts from the right to limit (California Civil Code Section 1798.121 and its implementing regulations). We do not use or disclose sensitive personal information to infer characteristics about you, and we do not use it for advertising. Because our use is confined to these exempt purposes, the right to limit does not restrict any additional use, and there is no further use for you to limit.

Residents of Washington, Nevada, and Connecticut should also read our separate Consumer Health Data Privacy Policy, which describes our handling of consumer health data and the specific consents and authorizations involved.

---

4. How we use your information

We use your information to support you, keep you safe, and improve the Service. We never use it to advertise to you, and we never sell it.

We use information to:

1. Provide what you asked for: respond to your message, send the path you requested, review your application, or provide a demo.
2. Provide and improve the Library and the tools on this website.
3. Communicate with you about your request and, with your choices respected, optional updates.
4. Improve the Service using aggregated, de-identified data (Section 10).
5. Maintain security, prevent abuse, and comply with law.

If and when the platform launches, we will also use information to provide and personalize its grief support features, and this Policy will be updated first.

We will never: sell your personal information; use your grief or your loss for advertising; or place advertising trackers anywhere on the Service.

We will not use your personal content to train general-purpose AI models without your explicit, separate consent.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act.

---

5. Artificial intelligence

LumenUs has no AI chatbot, AI companion, or AI conversation feature, and we process no conversations. If that ever changes, this Policy will be updated before any such feature exists.

The Service does not include an AI chatbot, an AI companion, or any AI conversation feature, and we do not collect, process, or store any conversation with you, because no such feature exists. If we ever introduce a feature that uses artificial intelligence, it will be described here, with the provider named and the contractual protections stated, including a prohibition on training on your content, before it is available to you. Our standing commitments for any future use of AI are published in our AI Disclosure at lumenus.life/ai-disclosure.

---

6. How we share information

We share only with the vendors who run the Service for us, with people and providers you choose, and where law or safety requires. We do not sell or share your data for advertising.

6.1 Service providers (subprocessors)

We use a limited set of vendors who process data on our behalf under contract, restricted to providing their service to us:

We keep the list above current, and update it as our providers change. The current list is always available at lumenus.life/subprocessors.

6.2 At your direction (your Circle, when the platform launches)

If and when the platform's Circle feature launches: when you invite a Supporter, they will see only the specific information and permissions you grant. Your private content is not shared with Supporters unless you explicitly choose to share specific items.

6.3 Professionals and vendors you engage

If you choose to connect with a professional through LumenUs, we share only the limited information needed to make that connection. We do not share your private content or documents with professionals, partners, or employers.

6.4 Legal, safety, and business transfers

We may disclose information where required by law or legal process, or where we believe in good faith it is necessary to protect the safety of any person, prevent fraud or abuse, or protect our rights. We will notify you of legal requests for your data unless prohibited. If LumenUs is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this Policy.

6.5 Affiliates

We do not currently have corporate affiliates. If that changes, we will update this Policy, and we will not share your personal information with any affiliate for that affiliate's own purposes without a lawful basis and, where the information is consumer health data or sensitive personal information, your consent.

6.6 We do not sell or share for advertising

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. We do not sell or share personal information under any other state privacy law either. Because we do not, your opt-out right is satisfied by default.

---

7. Crisis and safety data

If you report a safety concern to us, we keep a record of it, and we keep it longer than ordinary data, on purpose. The retention period is set in Section 11.

If you report a safety concern to us, we retain a record of the report and our response. Safety records are used only to respond to the concern, investigate incidents, respond to legal obligations, and demonstrate reasonable care. They are never used for marketing or unrelated analytics. They are retained for the period stated in the retention schedule in Section 11 (three years, or longer if subject to a legal hold).

---

8. No automated safety monitoring

This website does not monitor you and has no automated crisis-detection feature. Crisis resources are published, always free, and never gated.

The Service does not include any automated safety-detection or crisis-monitoring feature, and we do not monitor visitors. We publish crisis resources (988 Suicide and Crisis Lifeline; Crisis Text Line, text HOME to 741741; and 911) on our Crisis Support Protocol page and in the footer of every page. They are always free and never gated. You must not rely on this website to detect or respond to an emergency. If and when the platform introduces any safety-related feature, this section will describe it, and its honest limits, before it operates. Please also read Section 5 of the Terms of Service.

---

9. Data about a person who died, and about other people

We hold information about the person you lost, and sometimes about others. You confirm you have the right to give it to us, and we handle it with dignity.

The Service is designed to hold information about the person who died and, at times, about other living people in your Circle. When you provide that information, you confirm you have the authority to do so. We handle information about a person who died with dignity and use it only to provide the Service. We do not conduct automated outreach to bereaved non-users.

---

10. Improvement, de-identification, research, and AI training

We learn from aggregated, de-identified data to improve grief support. We do not sell your personal information, and any research or model training uses de-identified data with the protections below.

We use aggregated and de-identified data to understand what helps during grief and to improve the Service. When we report or study outcomes, we apply de-identification and minimum-group thresholds so individuals cannot be re-identified (our standard floors are a minimum of ten individuals for cross-cohort aggregates and a minimum of five for finer views). Any research conducted with our research partners follows an appropriate review process, and any use of data to train models, or any licensing of de-identified data, is done only on de-identified data and, where personal content is involved, only with your explicit, separate consent. We disclose these uses here so there is no surprise.

---

11. Storage, security, and retention

We encrypt your data and limit who can reach it. Deletion is real but completes over a defined period, and backups exist. This Section is the single source of truth for retention across all of our policies.

Your data is stored in the United States via Supabase on AWS infrastructure, encrypted in transit (TLS) and at rest. We use database-level access controls so members reach only their own data, limited personnel access to production systems, and access controls such as a Vault PIN (which limits access within the Service and is not a representation of a specific encryption standard beyond what is stated here). We retain data while your account is active. When you delete your account, we remove personal content over a defined period; because we use soft-deletion and maintain backups for recovery and security, deletion may take time to propagate, and we may retain limited records as required by law or for safety (Section 7). In the event of a breach affecting your personal information, we will notify affected users and authorities as required by law.

Our standard retention periods, which govern for the entire LumenUs policy suite, are:

Where the law requires a longer or shorter period, or where data is subject to a legal hold, that period governs.

---

12. Your rights and choices

You can see, correct, export, and delete your data, withdraw consent, and appeal a decision. Here is how.

All members may: access and export your data; correct your profile; delete your account and content; opt out of non-essential communications; and withdraw consent for optional processing.

California residents (CCPA/CPRA) may: know what we collect and how it is used; access, correct, and delete personal information; limit the use of sensitive personal information (see Section 3 for our determination on this right); and opt out of sale or sharing (which we do not do). We honor the Global Privacy Control. You will not be discriminated against for exercising your rights.

California auto-renewal (Automatic Renewal Law). We do not offer paid subscriptions at this time, so nothing renews and nothing is charged. If and when we introduce a paid subscription, we will comply with the California Automatic Renewal Law (California Business and Professions Code Sections 17600 through 17606): the renewal terms will be presented clearly before you buy, we will obtain your affirmative consent, send an acknowledgment, and provide an easy online way to cancel, as set out in Section 14 of the Terms of Service.

Residents of Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws have analogous rights to access, correct, delete, and port personal data, to opt out of targeted advertising and sale (which we do not do), and to appeal a decision on a rights request. To appeal, reply to our response or contact hello@lumenus.life. We will respond to an appeal within forty-five days of receipt; where reasonably necessary, we may extend that period once by an additional sixty days and will tell you of the extension and the reason. If you have concerns about the outcome of an appeal, you may contact your state Attorney General to submit a complaint.

Residents of Washington, Nevada, and Connecticut have specific rights regarding consumer health data described in our Consumer Health Data Privacy Policy.

How to exercise rights: by email to hello@lumenus.life (and, when the platform launches, in-app under Settings). You may use an authorized agent. We will verify your identity and respond within the time the law requires (generally 45 days, extendable with notice).

---

13. Cookies and tracking

We use what the Service needs, and we measure website usage without cookies. We do not place advertising trackers anywhere, and we do not use your grief or health data for advertising.

We use cookies and similar technologies that are necessary for the Service to function, plus preference technologies stored in your own browser that you can clear at any time. Our website analytics are cookieless and aggregate: they set no cookies and store no personal identifiers, so no consent banner is required and none is shown. Because we set no non-essential cookies and do not sell or share personal information for advertising, the protection a Global Privacy Control signal requests is already our default for every visitor. We hold a firm line where it matters most: we do not place advertising trackers, ad pixels, or cross-site tracking technologies anywhere on the Service, and we do not use your grief, your health, or your loss to target advertising to you. We do not sell your personal information. Full detail is in our Cookie Policy.

---

14. Children

LumenUs is for adults.

LumenUs is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect from children under 13. If we learn we have, we will delete it. Contact hello@lumenus.life with any concern.

---

15. Changes to this Policy

We may update this Policy. For material changes we will provide notice by email or in-app at least 30 days before they take effect, and we will note the update date above.

For any material change that affects how we collect, use, or disclose sensitive personal information or consumer health data, we will not rely on your continued use as acceptance. Instead, we will obtain your fresh affirmative consent before the change applies to that data. For other changes, continued use after the changes take effect constitutes acceptance.

---

16. Governing law

This Policy and any dispute arising out of or relating to it or to our processing of your personal information are governed by the laws of the State of California and applicable United States federal law, without regard to conflict-of-laws principles. This governing-law provision does not limit any non-waivable statutory rights you have under the privacy law of your state of residence. Any dispute is subject to the venue and dispute-resolution provisions of our Terms of Service.

---

17. Contact

LumenUs Platform, Inc., a Delaware corporation with its principal operations in California. Privacy and rights requests: hello@lumenus.life Data protection inquiries: hello@lumenus.life General: hello@lumenus.life