Privacy Policy Addendum
Last updated: October 20, 2026
This privacy addendum explains how Luma Health, Inc. handles information exchanged through its ChatGPT plugin (also called an app or connector) and integrations with similar AI assistant platforms using the Luma Model Context Protocol (MCP) server. “AI platform” means ChatGPT or the other platform you choose to connect.
It supplements Luma’s HIPAA Compliance Policies. Customer agreements, applicable Business Associate Agreements (BAAs), and organizational configurations govern permitted uses of customer data. This addendum does not expand those permissions or replace those agreements.
Information exchanged
The AI platform sends Luma tool requests, including the selected tool and arguments that may contain information from your prompt. Luma returns records or action outcomes for the requested workflow. Exact fields depend on the customer’s configuration, enabled tools, account permissions, and agreements. Examples include:
| Category | Examples |
|---|---|
| Patient identity and demographics | Names (including middle names and suffixes), Luma patient IDs and external EHR identifiers, birth year or full date of birth, gender identity, birth sex, race, ethnicity, language preference, phone numbers, email addresses, current and previous addresses, and contact-on-file indicators. These may be supplied in search/update requests or returned in nested EHR records. |
| Appointments and scheduling | Appointment and availability IDs, dates, times, duration, status and status reasons, visit type, source, provider/facility references, scheduling preferences, waitlist entries, telehealth/location information, and booking, confirmation, cancellation, and rescheduling requests and results. |
| Providers, facilities, and staff | Names, business email addresses and phone numbers, facility addresses, provider identifiers (including NPI), specialty, department, scheduling/visibility settings, staff recipient and task assignee identifiers, and external system identifiers. |
| Insurance and billing | Payer/plan names and identifiers, member and group numbers supplied to insurance tools, subscriber names and dates of birth, relationship to subscriber, coverage and verification status, nested eligibility/benefit lookup results, copays, balances, billing charge amounts, descriptions, and service codes. |
| Referrals, recalls, and feedback | Patient and appointment references, referring/rendering provider references, diagnoses, referral reasons, priority, status, free-text notes and customer notes, outreach attempts and dates, recall type and due date, fax/document references, feedback text or values, and satisfaction scores. |
| Messages and follow-up tasks | Patient-linked message text, channel, direction, visibility, sender/recipient references, timestamps, and task labels, status, assignees, provider/facility references, and expiry dates. Internal messages may include patient or staff information entered by users. |
| EHR orders, encounters, forms, and documents | Orders and encounter records returned by the configured EHR; patient, appointment, encounter, and form IDs; field names and values; free-text clinical or administrative notes; HTML content; document titles/categories; rendered PDFs; assignee/notification choices; writeback statuses and failed or skipped field names. Form/document tools process the content needed to render or file a document even when their result contains only an outcome. |
| Organization settings and nested records | Account/resource identifiers, enabled workflow settings, section names, and requested configuration values. Some responses include nested patient, provider, facility, insurance, appointment, or other integration-specific records in the categories above. Requesting full settings returns more configuration than the default section summary. |
| Authorization and service operation | Organization and user identifiers, roles, authorization tokens, session/assistant-instance identifiers, tool names, timestamps, resource IDs, result counts, status, and request duration. Tokens are used for authorization, not intentionally included in tool results. |
| Diagnostic and debug information | Request argument values for some tools, API query parameters at debug level, API paths containing resource IDs, errors, and workflow status details. These can contain identifiers, search terms, demographics, message text, or other information from the categories above. EHR tool arguments receive additional log filtering, but this does not apply uniformly to every diagnostic path. |
The patient search/profile and demographic-update tools minimize their patient responses (for example, birth year instead of full date of birth and contact-on-file indicators instead of contact values). Insurance profile tools omit member names and numbers from their profile responses. This filtering is specific to those tools: it is not a guarantee for EHR import/sync responses, nested records, eligibility lookup results, messages, settings, free text, or diagnostics. Inputs may contain more information than the corresponding result. These measures do not make results anonymous; names, identifiers, dates, and healthcare information may still be protected health information (PHI).
Tool results can be returned both as text and as structured data, including nested objects and arrays. Both are sent to the connected AI platform. MCP diagnostic notifications can also be sent to the connected client at its configured logging level; they are not a private channel visible only to Luma. Avoid entering unrelated information in free-text fields or requesting full settings or debug diagnostics unless needed for an authorized task.
With OAuth, you sign in with Luma or your organization’s identity provider and authorize the connection. The AI platform uses authorization tokens to call Luma. Enter passwords and one-time codes only in the sign-in flow, not in a chat. Other MCP clients may use an API token configured by your organization.
Uses
Luma processes connector information to authenticate and authorize access, retrieve records, carry out requested administrative healthcare workflows, return results, and operate, secure, audit, and troubleshoot the service. Enabled and authorized write tools can change records in Luma or connected systems, send internal staff messages, create follow-up tasks, request insurance eligibility checks, and render or file forms and documents. Navigator workflows also persist assistant actions and related context to maintain workflow history. Diagnostic information is used to investigate failures and operate the integration.
Luma’s AI Governance and Use Policy sets requirements for AI processing, including restrictions on using customer data and PHI to train models. Customers must ensure their selected platform and account configuration satisfy their agreements and applicable healthcare data requirements before exchanging PHI.
Recipients
- Your selected AI platform: OpenAI receives requests and returned tool results when you use ChatGPT. Another platform’s operator receives them when you use that platform. This includes nested tool results and any diagnostic notifications delivered to the client. Its processing is governed by your account settings, organizational arrangements, and agreements with that provider.
- Luma and its service providers: Luma processes requests through its MCP server and APIs. Authorized personnel and service providers may process information to deliver, support, and secure the service, subject to access controls and agreements. See Luma Health Subprocessors for how to obtain the current list.
- Your healthcare organization and connected systems: Enabled workflows may retrieve information from or send updates to your organization’s EHR, scheduling, eligibility processors/payers, billing, or other configured systems. Internal messages and assigned tasks are available to authorized staff; document workflows may notify an assignee. Rendering caller-supplied HTML may request externally hosted resources referenced in that HTML, exposing request/network information to those hosts.
Connecting a platform establishes a data path to that provider. Luma’s BAA with a customer does not by itself establish a BAA with the AI platform or approve every platform, plan, or use case.
Retention and deletion
Luma retains customer records under the applicable customer agreement, legal obligations, and Data Retention Policy. Records created or changed through the connector become part of those records. Operational, diagnostic, and audit logs follow applicable service retention requirements; they include tool activity and identifiers and may include the diagnostic data described above. There is no single connector-wide deletion period for all of these categories: customer records, persisted workflow history, operational logs, and backups follow their respective contractual and service retention schedules. Contact Luma or your administrator for the schedule applicable to your organization. See the Data Management Policy for backup handling.
Authorization and session information is retained to operate and secure the connection, subject to expiration and revocation. Disconnecting does not automatically delete underlying healthcare records, required audit records, backups, or information already sent to an AI platform.
The selected platform controls retention of chats, tool results, and other information it receives under its policies, settings, and your organization’s agreement. Use its privacy and deletion controls for those copies. Deleting a chat does not delete a Luma record, and deleting a Luma record does not automatically delete a chat.
User controls and contact
- Connect only accounts and platforms approved by your organization. Request only information needed for your task; available tools and access depend on organizational configuration and permissions.
- Review requested actions before allowing changes to healthcare records. AI output can contain errors and requires appropriate human review.
- Disconnect Luma in the AI platform to stop using the connection. Ask your administrator to revoke the Luma authorization or revoke or rotate a configured API token when access should end.
- Use the platform’s available chat deletion and data controls. Consult your administrator about workspace retention settings.
- Request access, correction, export, or deletion of healthcare information through the healthcare organization responsible for the records. Luma assists customers under their agreements and applicable law; retention obligations may limit deletion.
For connector privacy questions or help routing a request, contact support+mcp@lumahealth.io or Luma Support. See Luma’s HIPAA policies and Business Associate Agreement for the broader framework.