Privacy Policy

When you create a LUMINA account or book an appointment, we store the following on our own servers:

• Account basics. Name, email address, optional phone number, date of birth (used to confirm age for waiver purposes), optional mailing address.
• Profile photo. If you upload one. Stored via Vercel Blob (US datacenters) at a public, hard-to-guess web address. We only show it to you and to Lumina staff, but anyone who has that exact link can open the image, so only upload a photo you're comfortable with.
• Booking history. The classes, red light sessions and personal training sessions you've booked, attended, cancelled, or no-showed, including timestamps and the staff/instructor involved.
• Treatment programs. If you enroll in a laser treatment program, we record which one (for example neuropathy or endometriosis). That says something about your health, so we only show it to you and Lumina staff (Stripe also sees the program name on your payment).
• Personal training. The training package you bought or were enrolled in, its sessions, and any note staff add (for example that it was paid for elsewhere).
• Subscription + credit balances. Plan, billing cycle, remaining red light credits, free token state.
• Payment links. When staff send you a link to pay for something, we keep what it was for, the amount, and whether it was paid.

We do not store credit card numbers, bank details, or any payment-method data on our servers. All payment data flows directly through Stripe (see below).

We use the following service providers to run Lumina. Each one receives only the data it needs to do its job.

Lumina staff can see your account, bookings and programs in our admin tools. Our staff also follow the clinic schedule in their own calendar apps (such as Outlook or Google Calendar) through a private calendar feed. That feed includes customer names and appointment times for the past month and the next six months, so staff know who is coming in. The feed address is kept private, and we can replace it at any time to cut off an old copy.

We set a session cookie (HTTP-only, secure in production) when you sign in. That cookie is the only thing Lumina uses to identify you on follow-up requests. We don't use cookies for ad tracking, cross-site tracking, or any third-party purpose.

We use Vercel Web Analytics and Speed Insights to count page views and measure how fast pages load. Both are cookieless: they set no cookies and do no cross-site tracking. If you arrive from a link tagged with a campaign (for example a flyer at the clinic), we note that tag on your account when you sign up, so we know which channels bring people in. For a Google sign-up the tag is held in a first-party cookie that lasts at most 15 minutes, just long enough for the sign-in step.

Stripe Checkout pages may set their own cookies for fraud prevention. Google's OAuth flow may set Google cookies in your browser during the sign-in handshake. Both are governed by those providers' respective policies (linked above).

• Active accounts. As long as you have an account with us.
• Booking history. Indefinitely while your account is active, so we can show you past sessions and so staff can reference your history.
• Payment records. Retained as long as required by tax + accounting rules (typically 7 years in the US), independent of account deletion. Held in Stripe.

There's no self-serve button for these yet. Email us and a member of our team will handle it by hand. You can ask us to:

• See what we have on you. We'll gather it and send you a copy.
• Correct anything inaccurate. You can edit most of this yourself on the account page; for anything you can't change there, email us.
• Delete your account. We'll close it and remove your personal details. Payment records stay with Stripe for as long as tax and accounting rules require.
• Stop non-essential emails. We don't send newsletters. Booking confirmations, reminders, receipts and password resets are part of the service; if you'd rather not get anything else from us (like a request to review your visit), email us and we'll stop it.

Send requests to support@lumina-reno.com with the subject line "Privacy request."

Lumina services are intended for adults (18+). We don't knowingly collect personal data from anyone under 13. If you believe a child has created an account, contact us and we'll delete it.

When we materially change what we collect or who sees it, we'll update the "Last updated" date at the top of this page.