Privacy Policy
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Lumastem Corp (“Lumastem,” “we,” “our,” or “us”) is committed to protecting the privacy and security of your health information. This Notice of Privacy Practices describes how we use and disclose your Protected Health Information (“PHI”), your rights regarding your PHI, and our obligations under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and applicable state and international laws.
Who We Are
Lumastem is a physician-led regenerative medicine company. We provide a range of regenerative, longevity, and wellness services delivered by licensed physicians and clinical staff at our locations and, where offered, through telehealth. Certain therapies we discuss with patients are investigational and provided only within the scope of applicable law and any required research or informed-consent framework. We create, receive, maintain, and transmit health information in connection with the services we provide.
International Operations
Lumastem operates clinics in the United States and internationally, including planned or active locations in Bahrain. HIPAA governs the PHI we handle through our United States operations. Health information collected at our clinics outside the United States is governed by the data protection laws of those jurisdictions, including the Bahrain Personal Data Protection Law (Law No. 30 of 2018), which may provide rights and protections that differ from those described here. Where required, we provide separate jurisdiction-specific privacy disclosures for care delivered outside the United States.
Our Legal Duties
We are required by law to maintain the privacy and security of your PHI, provide this Notice describing our duties and privacy practices, notify you of any breach that may have compromised your information, and follow the terms of the Notice currently in effect.
How We May Use and Disclose Your Information
Treatment. We use and disclose your PHI to provide, coordinate, or manage your care, including consultations and visits, reviewing your medical history and treatment plans, and sharing information with pharmacies, laboratories, cell and tissue suppliers, specialists, and other providers involved in your care.
Payment. We use and disclose your PHI to obtain payment for services, including billing, verifying coverage where applicable, and collecting payments.
Healthcare Operations. We use and disclose your PHI for operational purposes, including quality improvement, credentialing and licensing, training and education, audits and compliance reviews, and business planning and administration.
Business Associates and Vendors
We may share PHI with third-party vendors that perform services on our behalf, such as electronic health record providers, laboratory and diagnostic partners, telehealth and scheduling platforms, communications platforms, cloud hosting providers, billing companies, and IT and cybersecurity vendors. These entities are required by written agreement to protect your information and comply with applicable HIPAA requirements.
Electronic Health Records. We use Pabau, a cloud-based practice management and electronic health record platform, to create, store, and manage your health records. Patient data is encrypted at rest and in transit using industry-standard encryption and backed up regularly. Our use of Pabau is governed by a Business Associate Agreement, executed on September 10, 2026, that requires safeguards consistent with applicable HIPAA requirements.
Other Uses and Disclosures
Appointment Reminders and Healthcare Communications. We may contact you about upcoming appointments, treatment recommendations, prescription and therapy refills, and health-related benefits and services.
As Required by Law. We may disclose your PHI when required by federal, state, local, or international law.
Public Health and Safety. We may disclose information to report communicable diseases, prevent serious threats to health or safety, and report abuse, neglect, or domestic violence when legally required.
Health Oversight. We may disclose information to government agencies for audits, investigations, inspections, licensure, and regulatory activities.
Law Enforcement and Legal Proceedings. We may disclose information when required by court order, subpoena, warrant, or other lawful process.
Research. We may use or disclose information for approved research purposes when permitted by law. Where you participate in an investigational program, any use of your information for research is governed by the separate informed consent and authorization you provide for that program.
Uses Requiring Your Written Authorization
We will obtain your written authorization before using or disclosing PHI for most marketing purposes, selling your PHI, using or disclosing psychotherapy notes where required by law, and any other use not described in this Notice. You may revoke your authorization at any time in writing, except to the extent we have already relied on it.
Your Rights Regarding Your Health Information
Right to Access. You may inspect and obtain a copy of your health records, subject to certain legal exceptions.
Right to Request Amendments. You may request corrections to your records if you believe information is inaccurate or incomplete.
Right to an Accounting of Disclosures. You may request a list of certain disclosures of your PHI.
Right to Request Restrictions. You may request restrictions on certain uses or disclosures of your PHI. We are not required to agree to all requests but will comply when legally required.
Right to Confidential Communications. You may request that we communicate with you by alternative methods or at alternative locations.
Right to a Paper or Electronic Copy. You may request a copy of this Notice at any time.
Right to File a Complaint. If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
Telehealth-Specific Privacy Information
Telehealth services involve the electronic transmission of health information. We implement administrative, technical, and physical safeguards to protect your PHI, including encrypted communications where appropriate, secure patient portals, access controls and authentication, audit logging and monitoring, and workforce privacy and security training. We encourage patients to join telehealth visits from a private location using a secure internet connection.
Website and Online Services
This section describes how we handle information collected through our public website and online forms from general visitors. It is separate from the Protected Health Information described elsewhere in this Notice. Information you submit as a patient, or that we collect through patient portals and telehealth services, is treated as PHI and handled as described above.
Information We Collect. When you visit our website or submit a form, we may collect information you provide directly, such as your name, email address, phone number, and the contents of your inquiry, along with technical information collected automatically, such as IP address, browser type, device information, referring pages, and website usage data.
Cookies and Similar Technologies. Our website may use cookies and similar technologies to operate the site, remember your preferences, analyze traffic, and understand how visitors use our services. You can control cookies through your browser settings, though disabling them may affect how the website functions. Where required by law, we request your consent before placing non-essential cookies.
Analytics and Third-Party Services. We may use third-party analytics and advertising services to help us understand website performance and reach. These providers may collect information about your online activity over time and across websites. We do not combine this website analytics information with your PHI.
How We Use Website Information. We use website information to respond to your inquiries, operate and improve our website and services, maintain security, and, where you have consented, contact you about our services. We do not sell the personal information collected through our website.
Your Choices. You may opt out of non-essential communications at any time by following the unsubscribe instructions in our messages or by contacting us using the information below. Depending on your location, you may have additional rights regarding the information collected through our website under applicable data protection laws.
Changes to This Notice
We reserve the right to modify this Notice at any time. Updated versions will be posted on our website and made available on request. The revised Notice will apply to all PHI we maintain.
Contact Information
If you have questions about this Notice or wish to exercise your privacy rights, contact:
Lumastem Corp 1780 West 700 North Lindon, UT 84042 385-489-1235 invitation@lumastem.com
Filing a Complaint with HHS
You may file a complaint with the Office for Civil Rights, U.S. Department of Health and Human Services. Information is available at hhs.gov. No retaliation will occur for filing a complaint.