Legal
Privacy Policy
Last updated September 6, 2026
This policy explains what happens when you connect a health or fitness device, such as Fitbit or Withings, to Lumi Wellness Portal. It covers the connected-devices feature. The public marketing website is informational and does not connect devices. Device connections happen in the live portal at app.lumiwellnessportal.com.
Connecting a device is always your choice
No device data is collected unless you explicitly connect a device from My Devices and grant permission on the provider’s own consent screen. You can disconnect at any time, and nothing is collected before you connect or after you disconnect.
What we receive from your device provider
| Data | Why we receive it |
|---|---|
| Health and fitness measurements: heart rate, resting heart rate, blood pressure, blood oxygen, body weight, body temperature, respiratory rate, steps, and sleep | To show your readings and trends in the app and make them available to your care team |
| An identifier for your account with the device provider | To match incoming measurements to your record and avoid storing anything twice |
| Device type and connection status | To show whether the device is connected and when it last synced |
| Access and refresh tokens issued by the provider | To keep the connection working so you do not have to reconnect repeatedly |
We request read-only access. We never write data back to your device provider account and never modify anything there.
What we do not collect
- Your password or login credentials for the device provider. We never see them
- Location or GPS data
- Contacts, messages, photos, or files
- Any data type not listed above
How we use it
Device data is used only to:
- Display your measurements and history in the app
- Add them to your personal health record so your clinician can review them
- Keep the device connection active
We do not sell your data, use it for advertising or profiling, or use it to train machine-learning models.
Google user data
Where your device data is accessed through Google Health APIs, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the minimum scopes needed to read the measurements described above.
When you disconnect Google Health from My Devices, we revoke our access with Google and delete the Google Health sourced readings we stored in your record in this app. We do not delete data in your Google account.
Who it is shared with
- Your care team: clinicians involved in your care, as part of your health record
- Nobody else: we do not share device data with advertisers, data brokers, or other third parties
We may disclose data only where required by law.
How it is stored and protected
- Measurements are stored in your health record on our servers
- Provider tokens are encrypted before storage
- All transfers use encrypted connections (HTTPS/TLS)
- Access is limited to your care team and authorised personnel
How long it is kept
Measurements we copied from a connected device are deleted when you disconnect that device in the app. Provider tokens are deleted at the same time.
Disconnecting one device does not remove readings from another. For example, disconnecting Google Health leaves Withings and Dexcom readings in place.
Disconnecting and deleting your data
- Disconnect: open My Devices and tap Disconnect. We revoke our access with the provider, stop syncing, delete stored tokens, and delete that provider’s synced readings from this app.
- Revoke from the provider: you can also remove our access from your Fitbit, Google, Withings or Dexcom account settings. That stops new syncing. Use Disconnect in the app to delete copies we already stored.
- If a reading remains: email support@eclinicsinternational.com, subject to medical record-retention requirements.
Your rights
You may request access to, correction of, or deletion of your device data, and you may withdraw consent at any time by disconnecting the device. Contact us using the details below.
Children
The connected-devices feature is not intended for children under 13.
This marketing site
The public website does not ask you to create an account or connect a device. Hosting may create standard server logs such as IP address, browser type, and pages requested, needed to operate and secure the site. We do not sell personal information.
Changes to this policy
If we change how device data is handled we will update this page and revise the date above.
Contact
Questions about privacy: info@lumiwellnessportal.com or support@eclinicsinternational.com.
LUMISOFT / E-Clinics International LLC
10 York Lake Ct, Oak Brook, IL 60523, United States
+1 (877) 605-4550