Nevada Consumer Health Data Privacy Policy
Effective date: 30 September 2026
This policy explains how Calverra Holdings LLC (“we”, “us”) handles consumer health data about Nevada consumers through the Luma app, our websites and our quiz, as Nevada law (NRS 603A.400 to 603A.550) requires. Consumer health data is personally identifiable information that is linked or reasonably capable of being linked to you and relates to your past, present or future health.
What we collect and how we use it
Entries you create: worries, reflections, thought records, emotional-weather check-ins, gratitude notes, values, goals and habits. We use them to save your entries, show them back to you and provide Luma’s wellbeing tools.
Summaries of your own entries: counts, history and progress shown in the app. We use them to show you your own progress.
AI habit inputs: the goal, reason, target date and value you enter when you ask for AI habit suggestions. We use them to generate the suggestions you asked for.
Account and subscription information: name, email address, sign-in identifier, subscription status and purchase history. The fact that you use a mental wellbeing app can itself be consumer health data. We use it to run your account and subscription and to support you.
App use and device information: features used, device and app identifiers, device type, app version, IP address, approximate location based on IP address, and time zone. We use it to run and secure Luma, fix faults, time your reminders, and measure how features are used so we can improve Luma.
Notification information: push notification tokens and reminder settings. We use it to send the reminders you set.
Quiz answers: your answers to our overthinking quiz, your result and your email address. We use them to give you your result and, if you opt in, to send you emails about Luma.
Support messages: anything about your health you include when you contact us. We use them to answer you and resolve your request.
Why we collect, use and share it
We collect, use and share consumer health data only to provide the Luma features you ask for, run your account and subscription, keep Luma secure and working, support you, and for any other purpose you consent to. We don’t sell consumer health data.
Where we get it
From you, when you use the app, take our quiz or contact us.
From your device, automatically, when you use the app or our websites.
From Apple and Google, when you sign in with them or subscribe through their app stores.
From WorryTree Ltd, which operated Luma before us, for accounts that existed when we took over Luma.
What we share, and who with
Apple and Google: account and subscription information and app identifiers, when you sign in with them, subscribe through their app stores or receive notifications through their push services.
Your calendar provider: the title of a worry, if you turn on linked-calendar reminders. You choose the calendar.
Government authorities, courts or others with legal authority: any category, but only when the law requires it.
Our service providers, which process it only on our instructions and under contract: cloud hosting and databases (Heroku, MongoDB Atlas), subscription management (RevenueCat), notifications (OneSignal), analytics and app links (Google Analytics for Firebase, Branch), AI text generation (Google Gemini), email (Kit, Google Workspace, Microsoft 365, Resend), websites and our quiz (Squarespace, Lovable, Make) and privacy requests (Prighter).
We have no affiliates that receive consumer health data.
How we process it
We process consumer health data electronically. Your account and entries are stored in our cloud database, encrypted in transit and at rest. We hold the encryption keys, so the data is not end-to-end encrypted. Only people who need access to run Luma, fix problems or answer your requests can access it.
How to review and change your information
You can view, edit and delete your entries in the app at any time. To review or correct your account details, email hello@myluma.app.
Your rights and how to make a request
You can ask us to:
Confirm whether we collect, share or sell your consumer health data.
Give you a list of all third parties we have shared it with.
Stop collecting, sharing or selling it.
Delete it.
To make a request, use our privacy portal or email hello@myluma.app. You can also delete your account in the app under Profile. We’ll verify that the request comes from you before acting on it.
We respond within 45 days of verifying your request. If we need more time, we’ll tell you why within the first 45 days, and we may take up to 45 more. We delete the data from our live systems within 30 days of verifying a deletion request and tell anyone we shared it with to do the same. Backup copies are deleted within 6 months. Requests are free, and we won’t treat you differently for making one.
If we refuse your request, you can appeal through the privacy portal or by emailing hello@myluma.app with “Appeal” in the subject line. We’ll tell you in writing within 45 days what we decided and why. You can also contact the Nevada Attorney General at ag.nv.gov.
Tracking by other companies
We don’t allow other companies to collect consumer health data about you over time and across different websites or online services when you use Luma, except our service providers acting for us.
Changes to this policy
If we make a material change, we’ll update the effective date and tell you by email or in-app notice before it takes effect. If the change needs your consent, we’ll ask for it first.
Contact
Calverra Holdings LLC, 2631 Housley Road, PMB 1301, Annapolis, Maryland 21401, United States. Email: hello@myluma.app.