Privacy Policy
How Lumavia Health collects, uses, and protects your personal data.
Data controller
The controller of your personal data is Serenidadexpoente LDA (NIPC 518621642), registered at Rua Alfeu Gaspar do Amaral 100, 1685-754 Famões, Portugal, operating the Lumavia Health platform. For any privacy question, email us at lumaviahealth@gmail.com.
Data we collect
We collect only the data the service needs: account data (email address and sign-in codes), the health profile you provide at registration and while using the service (safety questionnaire answers and pain and progress check-ins), billing data processed by our payment provider (we never store card numbers), and technical data (access logs and cookies strictly necessary for your session). We use no advertising or third-party analytics cookies. The service is intended for adults aged 18 or over, and we do not knowingly collect data from minors.
Health data
Your safety questionnaire answers and pain check-ins are health data — a special category of personal data (Article 9 GDPR). We process them only with your explicit consent, requested at registration, and solely to adapt the exercise content shown to you. You can withdraw consent at any time in your account area, without affecting the lawfulness of prior processing; without it, features that rely on your health profile become unavailable.
Legal basis for processing
We process your data on the following grounds (Article 6 GDPR): performance of the contract, to create your account, provide the service and process payments; explicit consent, for health data (Article 9(2)(a)); compliance with legal obligations, notably tax and accounting rules; and legitimate interest, limited to platform security and abuse prevention.
Your rights
You have the right to access your data, rectify it, erase it, restrict or object to its processing, and receive it in a portable format (Articles 15–22 GDPR). Erasure and export are available directly in your account area; for any other request, email us. You also have the right to lodge a complaint with a supervisory authority — in Portugal, the CNPD (www.cnpd.pt) — or with the authority of your country of residence. We make no decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR); the safety questionnaire automatically limits the content shown to you as a precaution, and you can always request human review by email.
Data retention
We keep data only as long as needed: account and health data until you delete your account or withdraw consent; billing data for the periods required by tax and accounting law; technical logs for short periods, for security purposes. After these periods, data is erased or anonymised.
Sub-processors
We use processors that handle data on our behalf under contracts pursuant to Article 28 GDPR: Supabase (database and authentication), Stripe (payments), Resend (email delivery) and Cloudflare (security and content delivery). Where processing takes place outside the European Economic Area, it relies on a European Commission adequacy decision — such as the EU-US Data Privacy Framework — or on standard contractual clauses.
Contact
To exercise your rights or ask anything about this policy, contact us at lumaviahealth@gmail.com. We reply within one month at the latest, as provided by the GDPR. If you believe the processing infringes the law, you can complain to the CNPD (www.cnpd.pt).