Published policy
Australian privacy
Client information, closer to home
Our Privacy Notice sets out our commitment to Australian patient-data storage and explains how information is collected, used and handled.
Read our Privacy NoticeSECURITY & PRIVACY
Personal records.
Considered protection.
An AI-first EHR for mental health needs a thoughtful approach to privacy. Here’s how we approach your information, your team’s access and the work you do with Luma.
POLICIES, STANDARDS & YOUR QUESTIONS
Compliance, in clear view.
Start with our published policies. If your practice needs specific standards, agreements or audit evidence, let’s work through the details.
Documentation enquiry
HIPAA & BAA
Requirements for your practice
If your practice requires HIPAA documentation or a Business Associate Agreement, talk to us about your requirements before using the service for that purpose.
Discuss HIPAA & BAADocumentation enquiry
PHIPA
A conversation about your requirements
Need to assess PractaLuma against PHIPA requirements? Discuss your intended use, data-handling arrangements and the documentation you need with our team.
Discuss PHIPA requirementsDocumentation enquiry
SOC 2 Type II
Evidence matters as much as the label
If an independent audit report is part of your vendor review, ask us about available evidence, its scope and the services it covers.
Ask about audit documentationPublished policy
GDPR
Privacy rights in the EU and UK
Our Privacy Notice explains the additional rights that may apply under the EU General Data Protection Regulation (GDPR) and UK GDPR, including access, correction, deletion and data portability. It also explains how to make a privacy request.
Read about GDPR & your rightsThese entries identify published policies and documentation enquiries. They do not represent independent certification.
PRACTICAL SAFEGUARDS
Clear controls.
Part of your day.
Privacy isn’t a separate workflow. These controls help your team make considered choices about access, information and recordkeeping.
TEAM PERMISSIONS
The right access for each role.
Configure roles and permissions around the work your team does. Review access when someone joins, changes responsibilities or leaves.
Roles and permissions
ACCOUNT SECURITY
Another step at sign-in.
Add an authenticator app to your account for two-factor sign-in. This is an optional account setting, not an automatically enforced practice-wide requirement.
Optional two-factor authentication
RECORD ACTIVITY
Look into the activity that matters.
Authorised team members can filter recorded activity, inspect event details and export results to help review access and changes.
Permission-controlled activity history
RETENTION SETTINGS
Make retention a considered choice.
Choose retention settings for recordings, transcripts and generated notes. Review your settings alongside your practice’s recordkeeping responsibilities.
Separate preferences for each content type
LUMA SUPPORTS. YOU DECIDE.
AI prepares.
You stay in control.
Luma helps with the documentation around your care. Your clinical judgement stays at the centre of it.
Explore AI Scribe- 01
Choose the source
Provide relevant context and consider what information is appropriate for the task.
- 02
Luma prepares a draft
Use AI to help organise and draft your notes and documents.
- 03
You review and edit
Check accuracy and clinical meaning before relying on or sharing the content.
Your information is not training material.
Our published privacy commitment is that patient data is not used to train foundation models. Our Privacy Notice explains the service providers involved in delivering AI features.
LOOK A LITTLE CLOSER
The details matter.
Clear policies and a conversation with the right people. Start here for your practice’s review.
POLICY
Privacy Notice
Collection, use, storage, retention and the providers involved in handling information.
Read the notice AGREEMENTTerms of Service
The terms and responsibilities that apply when your practice uses PractaLuma.
Read the terms VENDOR REVIEWYour security requirements
Ask about encryption, backups, recovery, hosting and compliance documentation.
Discuss your requirementsPlease leave client records and sensitive information out of your initial email.
Where is client information stored?
Our Privacy Notice sets out our commitment to storing patient data in Australia, without overseas replication. It also describes the service providers involved in delivering PractaLuma. Contact us if your practice needs to review hosting or data-processing arrangements in more detail.
Is client data used to train AI models?
Our published privacy commitment is that patient data is not used to train foundation models. AI features use service providers described in our Privacy Notice, including Microsoft Azure AI and Amazon Bedrock. Processing information to provide an AI feature is different from using it to train a model.
What compliance documentation can my practice review?
Start with our Privacy Notice and Terms of Service. If you require GDPR, HIPAA or PHIPA documentation, a data processing agreement, a Business Associate Agreement or a SOC 2 Type II report, contact us to confirm what documentation is available and whether it covers your intended use. The framework entries on this page are review topics, not certification claims.
Where can I find information about GDPR?
The Users outside Australia & GDPR section of our Privacy Notice explains the additional rights that may apply under the EU GDPR and UK GDPR, and how to make a privacy request. For questions about data processing agreements or international transfers, contact [email protected] to discuss the documentation available for your practice. Please do not include client records or sensitive information in your initial email.
Can I control team access and account security?
Yes. Roles and permissions let you configure access for different responsibilities in your practice. Individual accounts can also set up optional authenticator-based two-factor sign-in. Review both when people join, change responsibilities or leave.
What happens to recordings, transcripts and generated notes?
Account preferences include separate retention settings for recordings, transcripts and generated notes. Check the settings you have selected and review the Privacy Notice for information about retention. Do not assume that all audio is deleted immediately or that these preferences apply to every clinical record or backup.
Can I review and edit Luma’s output?
Yes. Review the source information, check the draft for accuracy and edit it before relying on or sharing it. AI-generated content does not replace your clinical judgement. Recording consent, the information you provide and the final content remain part of your practice’s workflow and responsibilities.
How can we review encryption, backups and recovery?
Contact our team with the technical and contractual requirements for your practice. Ask about hosting, encryption, backup arrangements, recovery and relevant service providers. We can discuss the information available for your review. Please leave client records and other sensitive information out of your initial email.
LET’S TALK IT THROUGH
Confidence starts
with a conversation.
Bring your questions. We’ll work through what matters to your practice.
Talk to PractaLuma