Lumaegis, Inc. Privacy Notice

This Privacy Notice applies to lumaegis.com and any page that links to it, and to personal information you send us by email, through our contact form, at events or through other channels connected with our Services. It does not cover third-party websites we link to, such as LinkedIn or the sources we cite. RadBox is not yet cleared by the U.S. FDA or on sale, so this notice does not cover any product, patient or clinical data.

Personal information is information that identifies, or could be used to identify, a specific person. It does not include deidentified information (anonymized or pseudonymized) or aggregated information derived from personal information.

Lumaegis, Inc. is a company based in Austin, Texas. For the purposes of the EU and UK General Data Protection Regulation (GDPR), Lumaegis is the controller of the personal information described in this notice.

Lumaegis, Inc.
Austin, Texas, United States
Email: sterilize@lumaegis.com

Contact form and communications. When you use our contact form or contact us directly, we collect your name, email address, organization, the type of contact you are (for example clinician, investor or partner) and your message. If you email, call or message us, we may also collect your phone number, mailing address, job title and any attachments you send, so that we can verify your identity and communicate with you.

Events. If you register for an event we host or attend, in person or online, we may collect your name, title, company, address, phone number, email address and information relevant to that event.

Email updates. If you ask to receive updates from us, we collect your name and email address.

Job applications. If you apply for a job with us, we may collect your name, phone number, email address, the position you are applying for, job and education history, references, a cover letter and similar information.

Information you should not send us. Please do not send us health information about yourself or others, patient information, or other sensitive personal information through our Services. We do not need it, and our Services are not designed to receive it.

Our website does not offer accounts, registration, payments or public posting of user content.

Device and log information. When you visit, our hosting provider automatically records standard technical information, such as your IP address, browser type and version, operating system, device identifiers, referring page, the pages you request, and the date and time of your visit.

Form submission metadata. When you submit our contact form, we and our hosting provider log your IP address and submission metadata, such as the time of submission and browser details, for security purposes, including detecting spam, automated submissions and abuse.

Cookies and similar technologies. Our website does not currently use cookies, analytics, advertising tags, tracking pixels, session recording or similar tracking technologies. See our Cookie notice. If this changes, we will update this notice and our Cookie notice first and, where the law requires it, ask for your consent.

We may receive information about you from other sources, for example from a colleague who introduces you, an event organizer or co-sponsor, a public professional profile such as LinkedIn when you contact us there, or third parties that help us keep our records up to date or detect and prevent fraud. What those parties share is governed by their own privacy settings, policies and procedures, which we encourage you to review.

We may use the information we collect to:

• Provide, maintain, improve and secure our Services
• Respond to your messages, comments and questions, and provide information you request
• Manage relationships with clinicians, practices, partners, suppliers, advisors and investors
• Send you updates and other information about Lumaegis and RadBox, where you have asked for them or where the law otherwise allows
• Host and run events
• Evaluate and process job applications
• Detect and prevent fraud, spam and abuse, and respond to trust and safety issues
• Support our business operations, including through generative AI tools provided by our service providers under contract
• Comply with law, enforce our Terms of use and other legal rights, and respond to legal process or government requests
• Any other purpose we tell you about when we collect the information

We do not sell personal information, share it for cross-context behavioral advertising, or use it to make decisions with legal or similarly significant effects about you by automated means alone.

If the GDPR applies to you, we rely on:

• Legitimate interests: to respond to inquiries, manage business relationships, run events and keep our Services secure. You can object at any time.
• Steps before a contract, or a contract: where you contact us about working with us or apply for a role.
• Legal obligation: where we must keep or disclose information by law.
• Consent: for example for email updates. You can withdraw consent at any time.

Service providers. We share information with companies that help us provide our Services, such as website hosting and form processing, email, file storage and productivity tools. They may use it only to provide services to us, under contract.

Affiliates and representatives. We may share information with our affiliates, subsidiaries, professional advisers and representatives as needed to run our business, under duties of confidentiality.

Events. We may share your information with event partners or co-sponsors to run events you register for.

Advertising and analytics partners. Our website does not currently share information with advertising or analytics partners. If we work with such partners in future, such as Google, Meta, LinkedIn or Microsoft, we will update this notice before doing so. For a current list, contact us.

As required by law. We may access, preserve and disclose information if we believe it is required or appropriate to comply with law enforcement requests and legal process, such as a court order or subpoena, to respond to your requests, or to protect your, our or others’ rights, property or safety.

Merger, sale or other asset transfers. We may transfer information to advisors, potential transaction partners or other third parties in connection with a financing, merger, acquisition, sale, liquidation or transfer of all or part of our assets. This Privacy Notice will continue to apply to that information.

Consent. We may share your information with your permission.

Our communications. You can unsubscribe from our updates using the link in any email, or by contacting us. You may still receive messages we need to send to respond to you or for administrative reasons.

Cookies. Most browsers let you manage cookies in their settings. Our website does not set them. See our Cookie notice, or visit aboutcookies.org.

Personalized ads. We do not run personalized advertising on our website. To limit ad tracking elsewhere, you can use the opt-out tools of the Network Advertising Initiative and Digital Advertising Alliance, and the settings on your device.

Our Services are hosted in the United States and intended mainly for use in the United States. If you use them from the EU, UK or elsewhere, your information will be transferred to, stored and processed in the United States, and we may transfer it to other countries where our service providers operate. Where we transfer personal information from the EU, UK or Switzerland, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

We keep personal information only as long as needed for the purpose it was collected:

• Contact form messages and general inquiries: up to two years after our last contact, unless an ongoing relationship continues
• Security logs of form submissions: up to 12 months
• Business relationship and event records: for the length of the relationship and as required for legal, tax and accounting purposes
• Job applications: up to one year after the role is filled, unless you agree to a longer period
• Email update lists: until you unsubscribe
• Hosting provider server logs: for the provider’s standard retention period

When information is no longer needed, we delete or anonymize it.

We make reasonable efforts to protect your information using administrative, technical and physical safeguards designed to protect it from accidental loss and unauthorized access, use or other inappropriate or unlawful processing, including encrypted (HTTPS) connections, access controls and reputable service providers. No information system is 100% secure, so we cannot guarantee absolute security.

If the GDPR applies to you, you have the right to access, correct or erase your personal information, to restrict or object to our processing, to receive your information in a portable format, and to withdraw consent where we rely on it. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in your country. We would appreciate the chance to address your concern first.

Depending on your state, including California, Texas, Colorado, Connecticut, Virginia and others with consumer privacy laws, you may have the right to know and access the personal information we hold about you, correct it, delete it, obtain a portable copy, and opt out of its sale, targeted advertising and certain profiling (we do none of these). We will not discriminate against you for exercising these rights.

California notice at collection. In the past 12 months we have collected identifiers and contact details, professional information, the content of communications, and internet activity information such as logs and form submission metadata, from the sources and for the purposes described above. We have not sold or shared personal information, and we do not use sensitive personal information for purposes that would give California residents a right to limit it.

Appeals. If we decline your request, you can appeal by replying to our decision with the subject line “Privacy appeal”. If you are not satisfied, you may contact your state attorney general.

To exercise any of these rights, email sterilize@lumaegis.com with the subject line “Privacy request”. We will verify your identity before acting, usually by confirming details you have already given us. You may use an authorized agent where the law allows. We respond within one month under the GDPR, or within 45 days under U.S. state laws, and may extend these periods where the law permits. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we do not do.

Our Services may link to websites, products or services we do not own or operate, such as LinkedIn and the references on our Sources page. We are not responsible for their content or privacy practices, and this notice does not apply to them. We encourage you to read their privacy policies before giving them any information.

No part of our Services is directed at children. We do not knowingly collect, maintain or use personal information from children under 16 (or under 13 in the United States). If you learn that a child has given us information, contact us at sterilize@lumaegis.com and we will delete it.

We will post any changes to this Privacy Notice on this page, and the revised version is effective when posted. If we make material changes, we may notify you through a notice on our website or another method. We encourage you to review this notice periodically. This version replaces our Privacy Notice dated June 24, 2025.

All feedback, comments, questions and requests relating to our Services and our data collection and processing should be sent to:

Lumaegis, Inc.
Austin, Texas, United States
Email: sterilize@lumaegis.com