1. Who we are and what this policy covers
Lummy Ltd ("Lummy", "we") is a company registered in England and Wales under number 15989826, registered office Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. You can contact us about privacy at contact@lummy.ai.
This policy explains how we handle personal data when we decide why and how it is used. It covers visitors to lummy.ai, people who contact us or request a demo, people at clinics we contact about our services, and the staff of our clients who use our services or deal with us.
Patients and clinic callers: when you call a clinic or use a clinic's website chat that runs on Lummy, the clinic decides how your data is used, and we process it only on the clinic's behalf. The clinic's own privacy notice applies. If you contact us about that data, we will pass your request to the clinic.
2. What we collect, why, and our legal basis
| Data | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Contact and business details | Name, role, clinic, email, phone number | To answer enquiries, arrange demos, and manage our relationship with you | Contract, or our legitimate interest in running our business |
| Prospect details from public sources | Business contact details from clinic websites, professional directories and networks | To contact clinics about services relevant to their business | Our legitimate interest in promoting our services to businesses. You can object at any time |
| Account and usage data | Login email, login codes, IP address, device and browser, activity logs | To provide and secure the Platform | Contract, and our legitimate interest in security |
| Billing data | Billing contact, invoices, payment status | To bill you and keep financial records | Contract, and legal obligation |
| Communications | Emails, messages and call notes with us | To provide support and keep records | Our legitimate interest in running our business |
| Website data | IP address, browser type and pages requested, recorded in server logs | To run and secure the website | Our legitimate interest in running a secure website |
| Testimonials and media | Quotes, photos or videos you agree to provide | To show on our website and in marketing | Consent, which you can withdraw at any time |
We do not store full payment card numbers. Card payments are handled by our payment provider.
3. Who we share it with
We share personal data only with: service providers who host, run or support our business, such as hosting, email, CRM, communication and payment providers; professional advisers; authorities, where the law requires; and a buyer or successor, if our business or assets are sold or restructured. We do not sell personal data.
4. International transfers
Some of our service providers are located outside the UK and the European Economic Area. Where we transfer personal data to them, we use a transfer mechanism recognised by data protection law, such as an adequacy decision or approved standard contractual clauses.
5. How long we keep it
We keep personal data only for as long as we need it for the purposes in section 2, including to meet legal, accounting and reporting requirements. We then delete or anonymise it.
6. Your rights
Depending on where you live, you may have the right to access, correct or delete your personal data, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. You can always object to direct marketing, and we will stop. To exercise a right, email us at the address in section 1.
You may complain to the data protection authority in the country where you live or work. Our lead authority is the UK Information Commissioner's Office. We would appreciate the chance to deal with your concern first.
7. Security
We use appropriate technical and organisational measures to protect personal data, including access controls and encryption in transit. No system is completely secure.
8. Cookies
Our website does not use cookies or similar tracking technologies.
9. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
10. Changes
We may update this policy. We will post the new version on this page and, for material changes, tell our clients by email.