Privacy Policy

What we collect

• Account data: your name, work email, organization and role, collected when you create an account.
• Student records you enter or import: name, date of birth, grade, district student ID, primary language, guardians, IEP goals, objectives, service minutes and accommodations.
• Session data: trial counts, accuracy, cue levels, clinician notes and, when you enable it, an audio recording and its transcript.
• Generated documents: SOAP notes, progress notes and family summaries, with their review status.
• Family portal data: guardian names and email addresses you add, and the one-time sign-in codes we send them.
• Operational data: sign-in history, audit entries for exports and disclosures, and error logs.

Why we hold it

Student data is held only to produce documentation for the clinician who entered it. We do not sell data and we do not use student data for advertising. [Third-party model training statement, only with contractual backing from every AI vendor in the chain]

AI processing

Transcription, translation and document drafting are performed by third-party AI models reached through our gateway. Content is sent for processing and a result is returned; LumaLayer does not use it to train models. Every AI output is stored with a review record showing whether a clinician accepted, edited or rejected it.

Recording and AI transcription track a per-student consent record in the consent ledger. Today the ledger is informational: a missing consent does not block a session. Your organization is responsible for obtaining consent before recording.

De-identify and Synthetic modes

In de-identify mode, identifiers are replaced with stable per-student tokens before text reaches an AI model or long-lived storage. Synthetic mode runs a workspace on sample data only, for demos and training. See Security for details.

Access and separation

Records are visible only to the clinician who created them, clinicians explicitly assigned to that student's caseload, and administrators of your organization. This is enforced at the database layer, not just in the interface. Guardians see only what you share with them through the family portal, and you can revoke their access at any time.

Retention and deletion

Records persist until you delete them or your organization ends its agreement. You can delete your own account from inside the app; a solo workspace is removed with it. You can also request deletion or anonymization of an individual student at any time. Anonymization strips identifying fields while keeping the audit trail. Deletion requests are actioned within 30 days.

Sub-processors

• Cloud hosting, database, authentication and file storage for the application.
• AI model providers for transcription, translation and document drafting.
• Transactional email for account, sign-in, invitation and family portal messages.
• Stripe, for payment processing, subscription billing and invoices.

Your rights

Clinicians and districts may request a copy of the records they control, correction of inaccurate data, or deletion. Guardians should direct requests to the district or practice that holds the educational record; we support that organization in responding.

Contact

Privacy requests: privacy@lumalayer.ai