Privacy Policy

Identity (name, email, phone), clinical data (skin profile, photos, notes, prescriptions), and technical data (device, IP, browser). We do not collect analytics beyond product usage — no advertising trackers, no third-party fingerprinters.

To deliver the service: match you with a clinician, run AI triage on your questions, store treatment plans, bill for care, and satisfy regulatory record-keeping obligations under Australian health law.

Primary storage is in AWS Sydney (ap-southeast-2). Group tenants can opt for EU or US residency at contract time. Backups are encrypted and stored in the same region as the primary.

Clinicians on your clinic’s team, and Lucent Health staff strictly on a need-to-know basis (support, security response). We never sell or share your data with advertisers.

You can access, export, or delete your data at any time from your account settings. For patients in the EU, the same rights apply under GDPR; for Australia, under the Privacy Act 1988.

Clinical records are retained for 7 years past the last treatment date, in line with AHPRA record-keeping guidance. Non-clinical data is deleted 90 days after account closure.

Data at rest is encrypted with AES-256; data in transit uses TLS 1.3 with modern ciphers. All administrative access is audited to the log surfaced under Admin · Audit log. Full detail at lucenthealth.com.au/security.

Data-subject requests go to privacy@lucenthealth.com.au. We reply within 30 days as required by law, usually sooner.