Compliance & Data Security

What Lumobot Does

Lumobot is a scheduling and lead capture assistant for local businesses. It helps website visitors find information about services, hours, insurance, and pricing — and connects them with your team for appointments. It is designed as a front-desk tool, not a health intake platform.

Privacy posture for healthcare practices

Lumobot is designed as a privacy-first front-desk assistant — built for general practice questions and lead capture, not for clinical intake, diagnosis, or emergencies. Our chatbot is built to:

• Answer practice-information questions (services, hours, insurance, location)
• Capture minimal contact info: name, phone, email, and general appointment interest
• Route clinical or symptom questions back to your team rather than answer them
• Avoid Electronic Health Records (EHR), patient portals, treatment records, and prescriptions

The AI is explicitly instructed not to ask for symptoms, diagnoses, or medical history. If a visitor voluntarily shares health details, the bot briefly acknowledges and connects them to your team — it does not record clinical interpretations or attempt triage.

Not a clinical or emergency tool. For urgent symptoms or emergencies, visitors should be directed to call the practice or 911. The bot surfaces this guidance when it detects emergency-language patterns.

HIPAA status. Lumobot is not currently marketed as HIPAA compliant and we do not sign Business Associate Agreements (BAAs). Practices using Lumobot remain responsible for their own HIPAA obligations and should configure the bot accordingly. A future HIPAA-ready deployment with the necessary vendor BAAs is on our roadmap; until then, the front-desk scoping above is how we minimize sensitive-information exposure.

Data Security

Even though we don't handle PHI, we take security seriously:

• Encryption in transit: All data transmitted over HTTPS/TLS 1.2+
• Encryption at rest: AES-256 database encryption via Supabase
• Application-layer encryption: Sensitive credentials (API keys, OAuth tokens) encrypted with AES-256-GCM
• Access controls: Row-Level Security (RLS) ensures each business can only access their own data
• Role-based access: Team members have Owner, Admin, or Viewer roles with appropriate permissions; the Owner can promote or demote members between Admin and Viewer in one click
• Two-factor authentication: Enable TOTP 2FA via any authenticator app (Authy, 1Password, Google Authenticator) from Settings → Account → Security
• Sign out everywhere: Invalidate every active session across every device + browser in one click, from Settings → Account → Security
• Audit logging: All access to conversations, leads, exports, and transcripts is logged with user identity, timestamp, and IP address
• Login tracking: Authentication events are recorded in an immutable audit log
• Privacy-minimized notifications (healthcare): For healthcare-vertical accounts (dental, medspa, vet, chiro), email and SMS lead alerts contain no visitor details — only a link to the secure dashboard. (Non-healthcare verticals like restaurants may include operational details such as party size or event date — see your account's notification settings.)
• AI processing: Conversations are processed via Anthropic's Claude API, which does not use customer data for model training
• No data selling: We never sell, share, or monetize visitor data

Audit Trail

Lumobot maintains a comprehensive, immutable audit log that records every access to conversation data, lead exports, transcript emails, login/logout events, settings changes, team member actions (invite / remove / role change), 2FA enrollment + unenrollment, and sign-out-everywhere events. Business owners view their complete audit history from the dashboard under Settings → Audit Log, with date-range filtering (today / last 7d / last 30d / this month / custom) and one-click CSV export for compliance reviews.

Data We Collect

Through the chatbot widget, we may collect:

• Contact information — name, email, phone (only if voluntarily provided by the visitor)
• Service interest — what service or appointment type they're interested in
• Conversation content — messages exchanged between the visitor and the AI chatbot
• Metadata — page URL, timestamp, anonymous visitor identifier

Third-Party Services

Lumobot integrates with the following trusted providers:

Data Residency & Sovereignty

All customer data is stored in the United States (AWS us-east-1, hosted via Supabase). We do not replicate data outside the US. AI processing through Anthropic's Claude API runs in their US-region infrastructure under their pay-as-you-go Terms of Service — Anthropic does not train models on API customers' content. We never transfer customer data to third-party regions for any reason.

GDPR & CCPA

Lumobot honors data-subject rights under both GDPR (EU) and CCPA (California). Each business owner is the data controller for the visitor data captured by their widget; Lumobot is the data processor. To exercise rights:

• Right to access / portability: Owners export their leads + audit log as CSV from the dashboard. Visitor-side requests should be directed to the business that operates the website where the chatbot is installed.
• Right to deletion:Owners delete their account + all data from Settings → Account → Danger Zone. Residual backups purge within 90 days. Visitor-side deletion requests forward to the operating business; if needed, email mike@lumobot.io and we'll coordinate with them.
• Do Not Sell:We never sell, share, or monetize visitor data — there is no opt-out to enable because we don't engage in selling in the first place.
• Subprocessors: The third-party services table above is the full subprocessor list. Each has its own SOC 2 Type II / equivalent attestation. Material changes (adding a new subprocessor, removing one) get a 30-day notice via the changelog.

For Healthcare Practices

Lumobot is designed as a privacy-first front-desk assistant — a scheduling and information tool, not a clinical-intake or healthcare-data system. We recommend healthcare practices:

• Use the "Topics to Avoid" feature to limit sensitive discussion areas
• Configure the chatbot to focus on scheduling, not health intake
• Add a disclaimer near the chatbot about its purpose (scheduling, not medical advice)
• Direct patients to your secure patient portal for health-related communications

BAAs:Lumobot does not sign Business Associate Agreements at this time. The product is designed to minimize PHI exposure — it captures pre-patient website visitor info (name, phone, what they're asking about), routes clinical questions back to your team, and never touches patient charts, treatment records, billing, or your PMS. Practices using Lumobot remain responsible for their own HIPAA obligations. If your organization has hospital-affiliated or DSO compliance requirements that specifically require a BAA-bound vendor, this product isn't the right fit today — email mike@lumobot.io and we'll let you know when our HIPAA-ready deployment path is available.

Data Retention, Export & Deletion

Conversation data is retained for the duration of your subscription.

Per-resource exports:Download your leads as CSV from Dashboard → Leads, and your access audit history as CSV from Settings → Audit Log. These cover the practical “give it to my accountant” / “show me who accessed what” workflows.

Self-serve deletion:Delete your account and all associated data at any time from Settings → Account → Danger Zone. After cancellation, residual data is purged within 90 days.

AI Safety Guardrails

The Lumobot chatbot has hardcoded safety rules that cannot be overridden by conversation or configuration. These protect your business from liability.

What the Chatbot CAN Discuss

• Your services, hours, location, and parking
• Insurance acceptance (plans you list)
• General pricing ranges (with "final pricing depends on your situation" disclaimer)
• Scheduling and appointment booking
• Custom FAQs you configure
• Your Google rating (if enabled)
• Spanish and English language support
• Emergency guidance (directing to 911 or your office)

What the Chatbot Will NEVER Do

When the chatbot encounters a prohibited topic, it acknowledges the question and redirects the visitor to contact your team directly.

Quality Monitoring (added April 2026)

The chatbot runs two background quality checks on every response so issues surface to the business owner before they accumulate:

• Frustration detection:Per-message tone analysis classifies visitor messages as mild / moderate / severe frustration. Severe frustrations trigger a same-day email alert so the owner can reach out personally before a bad review lands. Detection is regex-based with explicit false-positive guards (visitors venting about non-bot topics — weather, neighborhood, the visitor's own day — don't trigger alerts).
• Hallucination grader (env-gated):An optional Claude Haiku-backed grader that flags responses where the bot's claim doesn't match the configured knowledge base. Flags surface in the dashboard's Bot Knowledge → Quality panel for owner triage. Disabled by default; enable via Vercel env HALLUCINATION_GRADER_ENABLED.
• Unanswered questions report:Visitor questions the bot couldn't confidently answer are surfaced in the same Quality panel with a one-click “Promote to FAQ” button — so the bot improves answer-by-answer over time.

Contact

For compliance questions, data requests, or to discuss your specific needs: mike@lumobot.io