1. Who we are
The Lumier is a private-beta software service for dental clinics and dental-treatment businesses. It is operated by ORLECA LTD, a company registered in England and Wales with company number 16281127 (“ORLECA”, “we”, “us” or “our”).
This Privacy Policy explains how we handle personal data when you visit this website, contact us, use The Lumier as an authorised user of a client business, or when your information is processed through The Lumier on behalf of a client business.
If you have any questions, contact us at orcuncanbulat@gmail.com.
2. Our role: controller or processor
Under UK data protection law, our role depends on the information involved.
Where ORLECA LTD is the controller
We act as controller for personal data we use for our own business purposes, including:
- information about visitors to this website;
- enquiries and correspondence sent to us;
- account and contact information for client businesses and their authorised users;
- information used to administer client relationships, provide support, secure the service and meet our legal obligations.
Where a client business is the controller
Dental clinics and other client businesses use The Lumier to manage their own patient enquiries, patient records and conversations. For that information, the client business is normally the controller, and ORLECA LTD acts as a processor that processes the information on the client’s documented instructions to provide the service.
If you are a patient or prospective patient of a clinic that uses The Lumier, the clinic is responsible for telling you how it uses your information and for responding to your data protection requests. Please contact the clinic directly. If you contact us instead, we will refer your request to the relevant client business and support it as required.
3. Information we process
Depending on how you interact with us or with The Lumier, we may process the following categories of information.
- Account information
- Names, business email addresses, roles, business name, login and authentication details, user permissions and account settings for client businesses and their authorised users.
- Enquiry and contact information
- Information you provide when you contact us, such as your name, email address, business name and the content of your message.
- Patient and lead information
- Where a client business uses The Lumier for this purpose: names, phone numbers, contact details, enquiry details, status, internal notes, assigned staff, qualification information, follow-up activity and treatment-plan workflow information. This may include information about health or dental treatment interests that the client business or patient chooses to record.
- Meta and WhatsApp business identifiers
- Where a client business authorises a connection: identifiers such as the Meta business ID, WhatsApp Business Account ID, phone number ID, display phone number, business profile information, message template information and access tokens or credentials needed to operate the integration.
- Message content and conversation metadata
- Where authorised by the client business: the content of messages sent and received through the connected WhatsApp Business account, together with metadata such as sender and recipient phone numbers or WhatsApp IDs, profile names, timestamps, message status and delivery information.
- Files and media
- Images, documents, audio or other media exchanged in conversations or uploaded to The Lumier, where a client business chooses to process them through the service.
- Generated workflow information
- Conversation summaries, qualification fields, suggested next steps, tags and similar outputs created in the course of providing the service.
- Technical and security logs
- IP addresses, browser and device information, access times, pages or features used, error logs, audit logs and security events.
Some of the information processed for client businesses may be special category data, such as information about health. Client businesses are responsible for ensuring they have a lawful basis and an appropriate condition for processing that information and for providing appropriate information to patients.
4. Where information comes from
- Directly from you, for example when you email us, create or use an account, or configure the service.
- From client businesses and their authorised users, who add, import or manage patient, lead and operational information in The Lumier.
- From Meta and WhatsApp, when a client business authorises The Lumier to connect to its WhatsApp Business account through Meta’s approved onboarding flow. This includes business account details and the messages and message events that pass through that account.
- Automatically, through server, hosting and application logs generated when the website or service is used.
5. How we use information
We use personal data only for the purposes described below. Where we act as a processor, we process information on the client business’s instructions and the client business determines the lawful basis.
- Service delivery
- Providing, operating and maintaining The Lumier for client businesses. Lawful basis where we are controller: performance of a contract, or our legitimate interests in providing the service to the client business.
- Authentication
- Creating and managing accounts, verifying users and controlling access. Contract; legitimate interests in keeping accounts secure.
- CRM and workflow functionality
- Organising patient enquiries, leads, records, ownership, follow-up and treatment-plan workflows for the client business. Processed on client instructions.
- Messaging
- Sending, receiving, displaying and organising messages through the client’s connected WhatsApp Business account. Processed on client instructions.
- Automation
- Running workflows the client business has enabled, such as routing, reminders, summaries, qualification and handoff to staff. Processed on client instructions.
- Support
- Responding to enquiries, troubleshooting and helping client businesses use the service. Contract; legitimate interests.
- Security
- Monitoring for, preventing and investigating misuse, fraud, unauthorised access and technical issues. Legitimate interests in protecting the service, our clients and their patients.
- Legal compliance
- Meeting legal, regulatory, tax and accounting obligations, responding to lawful requests and establishing or defending legal claims. Legal obligation; legitimate interests.
We do not use patient information processed on behalf of client businesses for our own marketing.
6. Meta and WhatsApp data
The Lumier may connect to a client-owned WhatsApp Business account only after that business explicitly authorises the connection through Meta’s approved onboarding flow.
- Platform Data obtained through Meta or WhatsApp is processed only as needed to provide the service the client business has authorised.
- We do not sell, license or rent Platform Data, and we do not use it for purposes unrelated to providing The Lumier to the authorised client business.
- The client business remains responsible for its use of WhatsApp, including obtaining any required opt-ins from the people it messages and complying with Meta’s and WhatsApp’s applicable terms and policies.
- A client business can revoke The Lumier’s access at any time through its Meta business settings or by contacting us. Revoking access stops The Lumier from receiving new data through that connection. To request deletion of data already held, see our Data Deletion page.
Meta and WhatsApp process information under their own terms and privacy policies, which apply independently of this policy.
7. Automation and AI features
Where a client business enables them, some features of The Lumier may use automated processing, including AI models provided by third-party service providers, to help generate conversation summaries, structure qualification information, suggest follow-up actions or assist with replies.
- These features support operational and communication workflows. They are not used to diagnose patients, recommend treatment or make clinical decisions.
- The Lumier is designed so that clinic staff can review conversations and take over interactions when required.
- Client businesses decide how these features are used and remain responsible for decisions made about their patients.
9. No sale of data
ORLECA LTD does not sell personal data. We do not sell client Platform Data, patient information or conversation content, and we do not share it with third parties for their own advertising or marketing.
10. International transfers
Some of our service providers may process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we take steps to ensure the transfer is permitted under UK data protection law, for example by relying on UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures that may be appropriate.
You can contact us for more information about the safeguards used for a particular transfer.
11. Retention
We keep personal data only for as long as it is needed for the purposes described in this policy. In particular:
- Client data processed on behalf of a client business is retained in line with that client’s instructions and our agreement with the client, and is deleted or returned at the end of the service unless the law requires otherwise.
- Account and business records are kept for as long as the client relationship continues and afterwards for as long as reasonably needed for legitimate operational purposes, such as resolving disputes or enforcing agreements.
- Records we are legally required to keep, such as financial and tax records, are retained for the period required by law.
- Technical and security logs are retained for a limited period appropriate to their security and diagnostic purpose.
12. Security
We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse or alteration, appropriate to the nature of the service. These include access controls, encrypted connections and restricting access to personal data to people who need it to provide or support the service.
No online service can be guaranteed to be completely secure. If you believe your account or information may have been compromised, please contact us promptly.
13. Your rights
Under UK data protection law, including the UK GDPR and the Data Protection Act 2018, you may have the right to:
- access the personal data held about you;
- have inaccurate or incomplete personal data corrected;
- have personal data erased in certain circumstances;
- restrict or object to certain processing;
- receive certain personal data in a portable format;
- withdraw consent, where processing is based on consent;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects, subject to certain exceptions.
To exercise these rights where ORLECA LTD is the controller, email orcuncanbulat@gmail.com. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law.
If your information is held by a clinic or other client business using The Lumier, please direct your request to that business. We will assist the client business in responding where required.
You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to address your concerns first, so please contact us before approaching the ICO.
15. Children
This website and The Lumier accounts are intended for businesses and their authorised staff, not for children. Client businesses may process information about patients of any age in their capacity as controller and are responsible for doing so lawfully.
16. Data deletion
You can request deletion of data associated with The Lumier, including data received through connected Meta or WhatsApp integrations. Full instructions are available on our Data Deletion page.
17. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes to the service or to legal requirements. The updated version will be published on this page with a revised effective date. Where changes are significant, we will take reasonable steps to inform client businesses.
18. Contact
For privacy questions or requests, contact:
ORLECA LTD (operator of The Lumier)
Company No. 16281127, registered in England and Wales
Email: orcuncanbulat@gmail.com