Legal . Updated 18 August 2026
Data processing addendum
This is a plain-language draft, not legal advice. Have an attorney review it for your jurisdiction before you rely on it.
Roles
For personal data about your clients, you are the controller and Lumela is the processor. You determine what your forms collect and why. We process it only to provide the service and only on your documented instructions, which your use of the product constitutes.
Subject matter and duration
We process client personal data for as long as your account is active, plus the 90 day export window after cancellation described in our privacy policy.
Categories of data
Identity and contact details, date of birth, health information relevant to the treatment being consented to, signature images, photo-consent choices, optional identity-document photos, and signature audit metadata including IP address and device.
Categories of data subject
Your clients, and where a client is a minor, their parent or guardian.
Our obligations
We keep processing personnel bound by confidentiality. We apply appropriate technical and organisational security measures. We assist you, so far as we reasonably can, with data subject requests, security incidents and any impact assessments you must carry out. We tell you without undue delay if we become aware of a personal data breach affecting your data.
Sub-processors
We use sub-processors for hosting, storage, email, payments and analytics. Each is bound by data protection terms no less protective than these. We will give you notice before adding a new sub-processor, and you may object on reasonable data protection grounds. A current list is available from legal@lumela.co.
International transfers
Where personal data is transferred outside its country of origin, we rely on an approved transfer mechanism such as standard contractual clauses.
Deletion and return
On termination you may export all of your data. After the export window we delete it, except where we are legally required to keep it.
Audit
On reasonable request and no more than once a year, we will provide the information you need to demonstrate our compliance with this addendum. Requests go to legal@lumela.co.