1. About Your Privacy and This Privacy Policy
Your privacy is extremely important to us. This document is our “Privacy Policy” and it contains details on issues related to your privacy when using our services. It is intended to inform you of our policies, procedures and practices regarding the collection, use and disclosure of any information that you provide through the Platform (defined below).
This Privacy Policy applies to visitors to the public websites owned and operated by Lumate Health, Inc. (the “Company”), the registered users of the Company’s associated services (i.e., you or your guardian, as applicable, referred to herein together as “you”), and to the counselors that provide the Counselor Services (“Counselors”). The Company’s mobile and web applications and related websites are referred to herein collectively as the “Platform”).
California residents should read the information available in the Privacy Notice for California Residents below.
The Privacy Policy is part of our Terms and Conditions. When you use our Platform you accept and agree to both the Terms and Conditions and to the Privacy Policy. If you do not agree to be bound to the Privacy Policy you should stop using the Platform immediately. By accessing and using our Platform, you affirm that you have read the Terms and Conditions and the Privacy Policy and that you understand, agree to and acknowledge all the terms contained in both of them.
2. Information Collection, Use, and Disclosure
Categories of Information Collected
To enable us to operate the Platform effectively and to let you use the Platform, including the Counselor Services, we may collect, use, and store the information described below. We also disclose certain information to third parties, as described further below. The information we collect is received directly or indirectly from you and generated in the course of your use of the Platform. The data we collect is not used for marketing or any other purposes except as specified in this Privacy Policy.
Visitor Data: The Company collects, uses, and stores data regarding user visits to its website and use of the Company application (“Visitor Data”), including the particular pages visited or viewed by the user, the amount of time the user spent on the website or application, website errors experienced by the user, visits to the “FAQ” page, and information about the browser or device used to access the website and application, such as the user’s mobile device ID and IP address. These practices apply to users who visit pages for prospective new customers as well as those who visit pages for prospective Counselors.
Onboarding Data: In addition to the questionnaire responses provided by users (including Counselors) in the process of initial registration, the Company collects, uses, and stores certain additional data from users during the onboarding process (“Onboarding Data”). This data includes the pages viewed by the user, whether the user begins completing the questionnaire, and whether the user responds to any of the questionnaire prompts.
Account Registration Data: The Company collects, uses, and stores certain information in connection with the account registration process, such as whether users registered using their Facebook or Google profiles, and whether a user verifies their reported email address or phone number (“Account Registration Data”). The Company also assigns each user who creates an account an anonymized, randomly-generated client ID.
Transaction Data: The Company collects, uses, and stores certain information regarding payment for its services by users and related transactions on its website, such as whether a user completed payment for the Company’s services, signed up for services using a trial offer, canceled or otherwise ended a trial, or completed a request to receive financial aid for Company services (“Transaction Data”).
Login Data: The Company collects, uses, and stores data regarding logins to the Platform by registered users (including Counselors) and activity conducted during that log in such as when a user logs in, the number of messages received or sent through the website or app during that log in, and whether a user has been assigned, started, or completed a counseling goal (“Login Data”). Login Data does not include the content of any messages sent or received by users or the content of any counseling goals.
Counseling Session Data: The Company collects, uses, and stores certain general data regarding user counseling sessions such as whether a live session has been scheduled by the user, whether a Counselor or user joins a scheduled session, when a counseling session began and ended, and whether a counseling session was canceled or re-scheduled.
Customer Data: The Company collects, uses, and stores certain data from users that have signed up for services such as a user’s self-reported name or nickname, age, e-mail address, phone number, and emergency contact information (“Customer Data”).
Counselor Data: In order to credential, recredential, run checks and pay Counselors, the Company collects, uses, and stores certain data from Counselors. This data includes information such as the Counselor’s name, e-mail address, and phone number, address, provider number (if applicable), insurance number (if applicable) and education and job history (“Counselor Data”).
Communications Data: The Company collects, uses, and stores communications between users and Counselors on the Platform, and communications between users and the Company’s customer service team (“Communications Data”). Unless a specific request is made by your therapist and a written consent is obtained from you, therapy sessions are not recorded.
Protecting this information is important for us. Other than in the ways detailed in this Privacy Policy, we will never use or disclose any information unless you requested or approved us to do so.
Purposes for Which Information is Used
We may use the information we collect for one or more of the following purposes:
Communication with you
Delivery of services to you
Administration and improvement of services
Customization and marketing
Compliance with law
Other uses with consent
Purposes for Which Information is Disclosed to Third Parties
Information about you may be disclosed to third parties for one or more of the following purposes:
For business purposes and advertising: We may share a user’s information with a Counselor and a Counselor’s information with a user only as necessary for facilitating the Counselor Services. We may also share your information with vendors and service providers, including our data hosting and data storage partners, analytics and advertising providers, and vendors providing technology services and support, payment processing, and data security. We also may share information with professional advisers, such as auditors, law firms, and accounting firms.
With your direction or consent: We may share your information with third parties if you request or direct us to do so.
With affiliates within our corporate group: We may share your information with any subsidiaries or parent companies within our corporate group.
Compliance with law: We may share your information with a court, a regulatory entity, law enforcement personnel, or pursuant to a subpoena, to comply with applicable law or any obligations thereunder.
In the context of a transaction: We may share your information in connection with an asset sale, merger, bankruptcy, or other business transaction.
For other business reasons: We may share your information to enforce any applicable Terms and Conditions and Terms of Use, and to ensure the safety and security of the Platform and our users.
Note that if you make any information publicly available on the Platform, anyone may see and use such information.
3. Opting out of Marketing Communication
You can opt out of receiving email marketing by unsubscribing using the unsubscribe link provided in all of our marketing email communications.
4. Cookies and Web Beacons
Like many websites, we use “cookies” and “web beacons” (also known as pixels) to collect information. A “cookie” is a small data file that is transferred to your computer’s hard disk for record-keeping purposes. We collect cookies that are necessary for the Platform to function, cookies that enhance the Platform’s performance, and cookies used for third-party tracking. A “web beacon” is a tiny and sometimes invisible image or embedded code, placed on a Web page or email that can report your visit or use to a third party. Web beacons are typically used by third parties to monitor the activity of users at a website for the purpose of web analytics, advertising optimization, or page tagging. Additional information regarding web beacons is available on Wikipedia.
You can change your browser’s settings so it will stop accepting cookies or to prompt you before accepting a cookie. Opt-out options for cookies are located here.
Use of Cookies, Web Beacons, and Similar Technology for Analytics
We may use third party cookies for the purposes of web analytics, attribution, and error management. Our Platform may use vendor services that use cookies, web beacons, and similar technology to collect and store anonymous information about you, including when you pay for services, load a page, indicate that you heard about us on television, sign up for services, enter your payment information (but the payment details are not disclosed), start the intake questionnaire, and your response as to the referral source to the Platform.
Our Platform also uses analytics vendors to collect information (for example, Visitor Data and Onboarding Data) about user actions on our websites for purposes of analytics and analysis of certain Platform usage.
Use of Cookies, Web Beacons, and Similar Technology for Advertising Networks
You and others may see certain ads for our services or for the Platform on other websites because we participate in ad networks. Ad networks allow us to target our messaging to users through demographic, interest-based, and contextual means. These networks track individuals’ online activities over time by collecting information through automated means, including through the use of cookies, web server logs, and web beacons. The networks use this information to show advertisements that may be tailored to an individual’s interests. The information our ad networks may collect includes information about your visits to websites that participate in the relevant ad networks, such as the pages or advertisements you view and the actions you take on the websites. This data collection takes place both on our websites and on third-party websites that participate in the ad networks. This process also helps us track the effectiveness of our marketing efforts and assists other websites and advertising partners to find you or people like you on different platforms, including social media websites.
5. Social and General Information Tools
We may use several publicly available tools and information exchange resources, such as (but not limited to) a blog, a Facebook page, a Twitter account, and others (collectively “Social and General Information Tools”). Any information you provide or share while using Social and General Information Tools may be read, accessed, collected by that site and users of that site according to their Privacy Policy.
6. Phishing
Online identity theft and account hacking, including the practice currently known as “phishing”, are of great concern. You should always be diligent when you are being asked for your account information and you must always make sure you do that in our secure system. We will never request your login information or your credit card information in any non-secure or unsolicited communication (email, phone or otherwise).
7. Links
The Platform may contain links to other websites, services or offers which are owned, operated or maintained by third parties. If you click on a third party link, you will be directed to that third website or service. The fact that we link to a website or service is not an endorsement, authorization or representation of our affiliation with that third party, nor is it an endorsement of their privacy or information security policies or practices. We do not have control over third party websites and services and we do not have control over their privacy policies and terms of use.
8. Security of Information
While using any Internet-based service carries inherent security risks that cannot be 100% prevented, our systems, infrastructure, encryption technology, operation and processes are all designed, built and maintained with your security and privacy in mind. We apply industry standards and best practices to prevent any unauthorized access, use, and disclosure. We comply with all applicable federal laws, state laws, and regulations regarding data privacy.
9. HIPAA
All personal health information (“PHI”) gathered or transmitted through the Platform is protected under federal regulations governing the confidentiality of PHI under the Health Insurance Portability and Accountability Act (“HIPAA”) and the confidentiality of Alcohol and Drug Abuse Patient Records under 42 CFR Part 2, and cannot be disclosed without my consent unless otherwise provided for in the regulations. You will be given more information about your rights under these regulations when you are connected with a Counselor.
10. Service Providers
We may employ third party companies and individuals to facilitate our Platform, to perform certain tasks which are related to the Platform, or to provide audit, legal, operational or other services for us. These tasks include, but not limited to, customer service, technical maintenance, monitoring, email management and communication, database management, billing and payment processing, reporting and analytics. We will share with them only the minimum necessary information to perform their task for us and only after entering into appropriate confidentiality agreements.
11. Children’s Privacy
We do not knowingly collect or solicit any information from anyone under the age of 13 or knowingly allow such persons to become our user. The Platform is not directed and not intended to be used by children under the age of 13. If you are aware that we have collected Personal Information from a child under age 13 please let us know by contacting us and we will delete that information.
12. Compliance with Laws and Law Enforcement
We cooperate with government and law enforcement officials to enforce and comply with the law. We may disclose information necessary or appropriate to protect the safety of the public or any person, to respond to claims and legal process (including but not limited to subpoenas), and to prevent or stop activity that may be illegal or dangerous. You should also be aware that Counselors may be obliged to disclose information to law enforcement or other authorities to conform to their professional and legal responsibilities. Specifically, and without limitation, you should be aware that the law requires mental health professionals to disclose information and/or take action in the following cases: (a) reported or suspected abuse of a child or vulnerable adult; (b) serious suicidal potential; (c) threatened harm to another person; (d) court-ordered presentation of treatment.
13. Changes to the Privacy Policy
We may update this privacy statement at our sole discretion. The date of the last revision of this policy appears at the end of this page. We encourage you to periodically review this page for the latest information on our Privacy Policy and practices. Regardless of changes to our Privacy Policy, we will never use the information you submit under our current privacy notice in a new way without first notifying you and giving you the option to stop using the Platform.
14. Contacting us
If you have any questions or concerns about this Privacy Policy or our privacy-related practices, please contact us by clicking the “Contact” link at the bottom of any page in our website.
***************
Privacy Notice for California Residents
This Privacy Notice for California Residents supplements and is expressly made part of the information contained in the Company Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this Notice.
1. Information We Collect
Through your use of our website, we collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The description of the information that we collect is provided above, in the section titled “Categories of Information Collected.” In particular, our websites have collected the following categories of personal information from consumers within the last twelve (12) months. Additionally, we have disclosed the following categories of information for a business purpose in the past twelve (12) months:
| Category | Collected | Disclosed for a business purpose |
| A. Identifiers. | Yes | Yes |
| B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | Yes | Yes |
| C. Protected classification characteristics under California or federal law. | Yes | Yes |
| D. Commercial information. | Yes | Yes |
| E. Biometric information. | No | No |
| F. Internet or other similar network activity. | Yes | Yes |
| G. Geolocation data. | Yes | Yes |
| H. Sensory data. | No | No |
| I. Professional or employment-related information. | Yes | Yes |
| J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). | No | No |
| K. Inferences drawn from other personal information. | Yes | Yes |
The information that we share with third parties is described in greater detail above in the section titled “Purposes for Which Information is Disclosed to Third Parties.”
The Company obtains the categories of personal information listed above from the following categories of sources:
2. Use of Personal Information
We may use the personal information we collect for one or more of the following business or marketing purposes:
| Category of Personal Information | Purpose of Use |
| Identifiers. | We may use Identifiers (provided account name, email address, online identifier, and IP address) to communicate with you, deliver our services to you, facilitate the Counselor Services, customize and market the services (attribution and optimization), conduct research and development and other activities to improve our service, understand how you interact with our services, and comply with the law. |
| Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | We use your name (if you provide it to us) and the payment details you provide to us to communicate with you, deliver services to you, and facilitate the Counselor Services. We may also use your name and contact details to optimize our marketing to prospective users and Counselors. |
| Protected classification characteristics under California or federal law. | We may use your age, religion, sex, orientation and medical condition to customize and deliver the services to you. If you are a veteran or have military status, we may use this information to offer you a discount for our services. We may also use this information to conduct research and development and other activities to improve our service, show and optimize advertising, and understand how you interact with our services. |
| Commercial information. | We use information regarding your purchase of our services to customize and market services, conduct research and development and other activities to improve our services, show and optimize advertising, and understand how you interact with our services. |
| Internet or other similar network activity. | We use information regarding your activity on our websites to deliver our services to you, customize and market services (attribution and optimization), conduct research and development and other activities to improve our service, and understand how you interact with our services. |
| Geolocation data. | We use your geolocation information to personalize the services to you and for analytics. |
| Inferences drawn from other personal information. | We use information regarding your actions on our websites and the information you provide to deliver our services to you, customize and market the services, conduct research and development and other activities to improve our service, and understand how you interact with our services. |
3. Disclosure of Personal Information
In the 12 months preceding the date of this Privacy Policy, the Company has shared personal information with the following categories of third parties:
| Category of Personal Information | Purpose of Use |
| Identifiers. | We may disclose your IP address, unique identifier, or email address to our analytics vendors for analytics and to ad network partners for advertising optimization and attribution. We may disclose your contact information to webinar providers and to customer support to provide services for the Platform. We may disclose contact information between users and Counselors to provide the Counselor Services. We may disclose your credit card information to payment processing vendors for payment processing. If you are a user that uses the Company as the result of a business arrangement we have with an organization you are affiliated with or with your employer, we may disclose, with your authorization, identifiers to those entities in order to deliver the services to you. |
| Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). | We may disclose your contact information to webinar providers and to customer support and payment processing vendors to provide services for the Platform and to ad network partners for advertising optimization and attribution. We may disclose personal information between users and Counselors as necessary to provide the Counselor Services. We may disclose your credit card information to payment processing vendors for payment processing. |
| Protected classification characteristics under California or federal law. | We may disclose information regarding your age, sex, race, gender, sexual orientation, medical conditions, and disabilities to our advertising partners to optimize marketing, and to Counselors as necessary to provide the Counselor Services. |
| Commercial information. | We may disclose information regarding your purchase of our services to our advertising partners to optimize marketing. We may disclose your credit card information to payment processing vendors for payment processing. |
| Internet or other similar network activity. | We may disclose information regarding your activity on our websites to our advertising partners to optimize marketing. |
| Geolocation data. | We may disclose geolocation data to our advertising partners to optimize marketing. |
| Inferences drawn from other personal information. | We may disclose information regarding your activity on our websites to our advertising partners to optimize marketing. |
| All data categories | We may disclose all necessary information about you to comply with legal requirements that apply to us. We may disclose information about you at your direction or request. We may disclose information about you to vendors and other contractors and advisors that provide services to us, including data hosting and storage providers, analytics providers, engineering vendors, data security vendors, marketing services processors, lawyers, advisors, auditors, accountants, and others. We may disclose information about you in connection with an asset sale, merger, bankruptcy, or other business transaction. We may disclose information about you with corporate affiliates as necessary for internal business operations, and with subcontractors as necessary in the provision of services to you. |
The CCPA defines “sale” broadly. It includes the sharing of personal information in exchange for anything of value. According to this broad definition, in the 12 months before this section was last updated, our use of analytics and targeting cookies and web beacons to deliver advertising tailored to individual interests may have been considered a “sale” of personal information.
4. Your Rights and Choices
The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
Right to Request Access to Information
You have the right to request that the Company disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights), we will disclose to you:
Right to Request Deletion of Information
You have the right to request that the Company delete any of your personal information that we collected about you and retained, subject to certain exceptions. Once we receive your request and verify who you are, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
We may also deny your request if the information in question is not subject to the CCPA. Examples of such information include de-identified information, information covered by the Health Insurance Portability and Accountability Act, and information covered by the California Confidentiality of Medical Information Act.
Right to opt out of sale
You have the option to opt out of the use or disclosure of your information that is considered a “sale” under the CCPA. If you would like to opt out of the use and disclosure of your information, follow this link to manage your preferences.
Exercising Your Rights
To exercise the rights listed above, please submit a request in writing to the Company using this form via the submission methods listed below. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a request related to your personal information. You may also make a request on behalf of your minor child.
You may only make a request for access twice within a 12-month period. Your request must:
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a request does not require you to create an account with us. We will only use personal information provided in a request to verify your identity or authority to make the request.
You may submit requests using the following methods:
By completing this form in writing and sending it to:
Lumate Health, Inc.
10408 Gainsborough Road
Potomac, MD 20854
Or by calling our toll-free number or 800.402.8768 ext 2
Response Timing and Format
We endeavor to respond to a request within forty-five (45) days of its receipt. If we require more time (up to 90 days from the day of receipt), we will inform you of the reason and extension period in writing.
For Requests to Access, our response will only cover the 12-month period preceding the request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
5. Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. We will not:
6. Other California Privacy Rights
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our websites that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to [email protected].
7. Changes to Our Privacy Notice
The Company reserves the right to amend this Privacy Notice at our discretion and at any time. When we make any changes to this Privacy Notice, we will post the updated Privacy Notice on our websites and update the Privacy Notice’s effective date. Regardless of changes to our Privacy Policy, we will never use the information you submit under our current privacy notice in a new way without first notifying you and giving you the option to stop using the Platform. Your continued use of our websites and services following the posting of changes constitutes your acceptance of such changes.
8. Contact Information
If you have any questions or comments about this Privacy Notice, the ways in which the Company collects and uses your information described above, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Lumate Health, Inc.
10408 Gainsborough Road
Potomac, MD 20854
Or by calling our toll-free number or 800.402.8768 ext 2
General Data Protection Regulation (GDPR) Notice
This section provides additional information about our Privacy Policy relevant to users from the European Union (EU) and Switzerland. It supplements and should be read in conjunction with the rest of the Privacy Policy. Under the GDPR, the Company is the Controller with respect to your Personal Data.
The Company may use your personal information:
1. Your Rights and Choices
EU and Swiss residents have specific rights regarding their personal information. This section describes your rights if you are resident in the EU or Switzerland, and explains how to exercise those rights.
Right of access: You may be entitled to ask us for a copy of any personal information which we hold. This right is known as a ‘Subject Access Request.’ We will normally send you a copy of the personal information within one month of your request. However, that period may be extended by two further months where necessary, taking into account the complexity of the request or the difficulty in accessing the personal information that you request. There is usually no charge; but in exceptional circumstances we may charge but will discuss this with you if those circumstances apply.
Right to rectification: If the personal information we hold about you is inaccurate, you may request rectification. The personal information will be checked, and, where appropriate, inaccuracies will be rectified.
Right to erasure: In certain circumstances, you may be entitled to ask us to erase your personal information.
Right to data portability: In certain circumstances, you may wish to move, copy, or transfer the electronic personal Information that we hold about you to another organization.
Right to object: You may object to your personal information being used for direct marketing. You may object to the continued use of your personal information in any circumstances where we rely upon consent as the legal basis for processing it. Where we rely upon legitimate interests as the legal basis for processing your personal information, you may object to us continuing to process your personal information, but you must give us specific reasons for objecting. We will consider the reasons you provide, but if we consider that there are compelling legitimate grounds for us to continue to process your personal information, we may continue to do so. In that event, we will let you know the reasons for our decision.
Rights related to automated decision-making including profiling: We use limited personal information to operate the Platform and to carry out certain profiling activities to support and grow our business. When doing so, we rely upon our legitimate interests as the lawful basis for processing your personal information and you may exercise the above rights if you do not wish us to process your personal information in this way.
To exercise the rights in relation to your Personal Information set out in this section, please contact us by clicking here.
2. International Data Transfers
The Platform is controlled and operated by us from the United States. By accepting the terms of this Privacy Policy you agree that any personal information you provide to us through use of the Platform may be stored and processed, transferred between and accessed from the United States and other countries that may not guarantee the same level of protection of personal information as the one in which you reside. However, we will handle your personal information in accordance with this Privacy Policy at all times.
You can contact our Data Protection Officer with questions, about this policy, or about your personal information by writing to:
Lumate Health, Inc.
10408 Gainsborough Road
Potomac, MD 20854
Or by calling our toll-free number or 800.402.8768 ext 2
While we will always work with you to resolve any concerns you have about the use of your personal information, under GDPR you have the right to lodge a complaint with the supervisory authority in your country of residence if you have any concerns about our use of your personal information.
Last Updated and Effective: December 6, 2022