Privacy Policy

• Account data: your name, work email, organization and role, captured when you create an account, start a trial, or request access.
• Student records you enter or import: name, date of birth, grade, district student ID, primary language, guardians, IEP goals, objectives, service minutes and accommodations.
• Session data: trial counts, accuracy, cue levels, clinician notes and, when you enable it, an audio recording and its transcript.
• Generated documents: SOAP notes, progress notes and family summaries, along with their review status.
• Family portal data: guardian names and email addresses you add, and the one-time sign-in codes we send them.
• Operational data: sign-in history, audit entries for exports and disclosures, and error logs.

Districts and practices own the student records they enter. When a school district uses LumaLayer, we act as a "school official" with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)(i)(B)), under the district's direct control, and we do not re-disclose education records except as the district directs or the law requires. Where a district signs a Data Protection Agreement with us, that agreement takes precedence over this page and our Terms.

Student data is held solely to produce documentation for the clinician who entered it. We do not sell data, we do not use student data for advertising or profiling, and we do not use student data or audio to train, retrain or fine-tune AI models. We use AI providers under API terms that do not permit them to train on the content we send.

Transcription, translation and document drafting are performed by third-party AI models reached through our gateway. Content is sent for processing and a result is returned; it is not used by us to train models. De-identify mode is on by default for new workspaces: identifiers are replaced with tokens before text reaches an AI model. Every AI output is stored with a review record showing whether a clinician accepted, edited or rejected it. A per-student consent ledger tracks recording, AI transcription, HIPAA and FERPA disclosure consents. In the current release the ledger is informational for recording and AI transcription: a missing consent does not block a session, but every AI-generated artifact produced without one is flagged for audit. FERPA disclosure consent is enforced: a summary cannot be shared with a family until it is on file. Your organization is responsible for obtaining required consents before recording a student.

Jes conversations are saved after student and patient identifiers are removed. LumaLayer uses those redacted transcripts only to review and improve Jes quality. Only LumaLayer admins can see them, and they are deleted automatically after 90 days. LumaLayer supports FERPA and HIPAA workflows. It does not claim HIPAA or FERPA certification.

Records are visible only to the clinician who created them, clinicians explicitly assigned to that student's caseload, and administrators of your organization. This is enforced at the database layer, not just in the interface.

Records persist until you delete them or your organization ends its agreement. You can request deletion or anonymization of an individual student at any time; anonymization strips identifying fields while preserving the audit trail. Deletion requests are actioned within 30 days.

These companies process data on our behalf. We give districts with a signed agreement 30 days' written notice before adding or replacing one.

• Supabase (on Amazon Web Services): database, authentication and private file storage. Holds all workspace data.
• Cloudflare: application hosting and network delivery. Processes requests in transit.
• Google (Gemini models): transcription, translation and document drafting. Receives de-identified text and audio for processing only.
• xAI: real-time voice for the Jes companion. Receives live audio for processing only.
• Resend: transactional email for sign-in, invitations and family portal messages. Receives names and email addresses.
• Stripe: payment processing, subscription billing and invoices. Receives billing contact and payment details; never student data.

Clinicians and districts may request a copy of the records they control, correction of inaccurate data, or deletion. Guardians should direct requests to the district or practice that holds the educational record; we support that organization in responding.

Privacy requests: privacy@lumalayer.ai.