Privacy

Who We Are

Lumirai, LLC is the controller for the personal data we collect about users of our products and this website. That means we decide what personal data is collected and why.

Lumirai, LLC, 320 N. Meridian Street, Suite 817, Indianapolis, Indiana 46204. Privacy contact: support@lumir.ai

Viewer

Lumirai Viewer (“App”) displays medical images provided by your organization’s secure systems.

Echo

Lumirai Echo (“App”) displays medical images provided by your organization’s secure systems.

Lumirai Accounts

Lumirai Accounts, at accounts.lumir.ai, is where you manage your Lumirai licenses and subscription.

It stores your e-mail address and your account and license status. Your password stays with your organization’s system — we do not receive or store it. Lumirai Accounts does not store protected health information.

Subscriptions, Billing, and Payments

Subscriptions to Lumirai Echo are sold through Paddle.com Market Ltd (“Paddle”), which acts as our reseller and merchant of record. Paddle is an independent controller of the payment data it collects.

When you buy or manage a subscription:

• Paddle collects and processes your payment details, billing address, and tax information directly. Lumirai does not receive or store your card number or other payment credentials.

• Paddle handles the sale, subscription management and renewals, payment processing, invoicing, and sales tax compliance.

• We share your e-mail address, and the name on your account, with Paddle so it can create and manage your customer record.

• Paddle sends us the status of your subscription — for example whether it is active, trialing, past due, or cancelled, and how many licenses you hold — so we can enable the right level of access in your account.

We may also use Paddle to invoice practices for Lumirai Link deployments licensed under a Master Subscription Agreement. The same division of responsibility applies: Paddle handles the payment, and we do not receive your payment credentials.

Paddle’s own privacy notice is at paddle.com/legal/privacy.

Why We Process Your Information

We process personal data for the purposes below. Where a law requires us to identify a legal basis for processing, these are the bases we rely on:

• Performance of a contract — to create and maintain your account, provide the software, enable your licensed features, and provide support.

• Legitimate interests — to keep our services secure, prevent fraud and abuse, verify compliance with the license quantities you have purchased, understand which features are used so we can improve the product, and operate our business. We balance these interests against your rights.

• Consent — for optional features you choose to turn on, such as Microsoft OneDrive sync, and for any marketing communications. You can withdraw consent at any time.

• Legal obligation — where we must retain or disclose information to comply with the law.

Who We Share Information With

We do not sell your information or share it for advertising. We share information only with:

• Paddle, as merchant of record, for the sale of subscriptions, subscription management, payments, invoicing, and tax compliance.

• Service providers and subprocessors who help us run the service, including cloud hosting and storage, e-mail delivery, and support tooling. These providers act on our instructions and are bound by confidentiality obligations. A current list is available on request.

• Your organization’s own systems, such as your Medstrat Joints PACS or your Microsoft 365 tenant, where you sign in to them through our software. Data handled by those systems stays under your organization’s control.

• Professional advisers, such as legal and accounting advisers, where necessary.

• Authorities, where required by law or to protect the rights, property, or safety of Lumirai, our users, or others.

We do not use your data, your content, or protected health information to train machine learning or artificial intelligence models.

Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;

• have inaccurate data corrected;

• have your data deleted;

• restrict or object to how we process your data;

• receive your data in a portable format;

• withdraw consent where we rely on it; and

• complain to your state attorney general or other regulator with authority over privacy where you live.

To exercise any of these, contact support@lumir.ai. We will respond within 45 days, or tell you if we need longer where the law allows.

We do not hold patient medical records or imaging. If you are a patient looking for your records, contact your healthcare provider directly.

Security

We use appropriate technical and organizational measures to protect personal data, including encryption of data in transit, encryption of data at rest, access controls that limit who on our team can reach account data, and authentication safeguards including optional two-factor authentication on Lumirai accounts.

No system can be guaranteed completely secure, but we review our safeguards and work to keep them current.

Cookies

We use cookies and similar technologies for:

• Essential purposes — keeping you signed in to your Lumirai account and keeping the service secure. These are required for the service to work.

• Analytics — understanding how our website and software are used so we can improve them.

You can manage or block cookies through your browser settings. Blocking essential cookies will prevent you from signing in.

Effective as of November 29, 2025
Updated August 8, 2026