Privacy Notice — Lumen Wellness Devices

1. Who we are

Lumen Wellness Devices ("Lumen Devices", "we", "us") is a trading name of Lumen Wellness, an Irish company supplying clinician-grade diagnostic devices to medical practices in Ireland and the United Kingdom. We are the data controller for personal data collected through this website and through our sales and support activities.

Data controller

Lumen Wellness
Dublin, Ireland
Email: info@lumenwellness.ie

2. What personal data we collect

We collect personal data only where we have a clear, lawful purpose for doing so. The categories below describe the data we typically collect and the channels through which we collect it.

Source	Data collected
Contact form on this website	Name, email address, practice or clinic name, the content of your message.
Email enquiries (mailto links)	Your email address and the content of any message you choose to send us.
Orders placed via our payment processor (Stripe)	Name, billing address, contact email, VAT number where applicable, and order details. Card payment data is collected and processed by Stripe directly; Lumen does not see or store your full card number.
Server logs	Standard technical information such as IP address, browser type, and pages viewed, as is normal for any website.

3. Why we use this data

The lawful bases on which we process personal data are:

To respond to your enquiry — legitimate interest, where you have contacted us about our products or services.
To fulfil a sales contract — performance of contract, where you have placed an order with us. This includes processing payment, arranging delivery, providing onboarding and training, and managing warranty and after-sales support.
To meet legal and regulatory obligations — legal obligation, including invoicing, tax record-keeping, and any vigilance reporting obligations under medical device regulations.
To protect and operate the website — legitimate interest in maintaining a secure service.

4. Who we share your data with

We share personal data only with carefully selected third parties who help us deliver our service, and only to the extent necessary.

Stripe — our payment processor, who handles card payments on our behalf. Stripe processes data under its own privacy policy, available at stripe.com/ie/privacy.
Email and hosting providers — for the operation of our email and website infrastructure.
Device manufacturers — Eko Health, VentriJect, and HeartSciences, where it is necessary to share information to enable warranty, technical support, software access, or training in respect of a product you have purchased.
Professional advisers — our accountants, legal advisers, and similar, where strictly necessary.
Public authorities — including the Health Products Regulatory Authority (HPRA), where required by law or in the interest of patient safety.

We do not sell or rent your personal data to anyone.

5. International transfers

Some of our service providers (notably Stripe and certain device manufacturers) are located outside the European Economic Area, including in the United States and United Kingdom. Where data is transferred outside the EEA, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses and adequacy decisions where applicable.

6. How long we keep your data

We retain personal data for as long as we need it for the purposes described in this notice, and as required by law. In practical terms:

Sales enquiries that do not lead to an order: typically up to 24 months from last contact.
Order and customer records: at least 6 years from the end of the relevant accounting period, in line with Irish tax and company law requirements.
Vigilance and safety records relating to medical devices: for the period required under applicable regulations.
Server logs: typically deleted or anonymised within 12 months.

7. Your rights

Under the General Data Protection Regulation and the Irish Data Protection Act 2018, you have the following rights in respect of your personal data:

The right to be informed about how we use your data (this notice).
The right to access a copy of the personal data we hold about you.
The right to rectification of inaccurate or incomplete data.
The right to erasure ("right to be forgotten"), subject to legal exceptions.
The right to restrict our processing in certain circumstances.
The right to data portability for data you have provided to us.
The right to object to processing carried out on the basis of legitimate interest.
Where processing is based on consent, the right to withdraw consent at any time.

To exercise any of these rights, please contact us at info@lumenwellness.ie. We will respond within one month.

8. Cookies and tracking

This website does not use third-party advertising cookies or cross-site tracking. Some essential cookies may be set by services we rely on (for example, Stripe sets cookies during checkout to support secure payment processing). We do not use these cookies for marketing or profiling.

If we add analytics or marketing cookies in future, we will update this notice and seek consent where required.

9. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. Our systems are operated under industry-standard hosting and security practices, and access to customer data is limited to those who require it to perform their role.

10. Complaints

If you have a concern about how we are using your personal data, we would encourage you to raise it with us first so that we can investigate and resolve it. You also have the right to lodge a complaint with the Irish Data Protection Commission:

Supervisory authority

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
Web: www.dataprotection.ie

11. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or in the law. Where changes are material, we will draw them to your attention. The "last updated" date at the top of this page indicates when the current version was published.