Privacy Policy

HaloTogether is a care coordination app designed to help families, friends, and carers stay organised and informed while supporting someone they care about.

Users can create private "Care Spaces" to share updates, coordinate visits, track medications, manage appointments, and keep important care information in one place.

HaloTogether is for adults aged 18 and over, and is intended only for coordinating the care of adults aged 18 and over. It is not a medical device, healthcare provider, emergency monitoring system, or clinical record system. It is a coordination and communication aid only. The app does not provide medical advice, diagnosis, treatment recommendations, medication verification, or emergency response services.

This Privacy Policy explains what data we collect, why we collect it, how it is used, and your rights under UK data protection law.

Data Controller: HaloTogether is operated by Lumin Apps Ltd, a company registered in England & Wales.

Company number: 17248655

Registered office: 30 Hanley Road, Southampton, England, SO15 5AN

ICO registration number: [Pending]

Contact: hello@luminapps.co.uk

We use personal data only to provide and operate HaloTogether, including:

• Creating and managing accounts
• Allowing users to create and join Care Spaces
• Synchronising care information between trusted members
• Recording and evidencing consent and legal authority
• Sending notifications and reminders requested by users
• Sending secure sign-in email links
• Providing offline functionality
• Maintaining security and preventing misuse
• Improving reliability and fixing technical issues
• Responding to support requests

Notifications and reminders are informational only and should not be relied upon as guaranteed alerts.

Sensitive health information is only stored and shared once a lawful basis has been confirmed during setup. There are three ways this happens:

• You set up your own Care Space. You give consent directly for your own information to be stored and shared with the people you invite.
• You set it up for someone else with their consent. You confirm that the person knows about the Care Space and has agreed to their information being shared with the carers you invite.
• You hold Lasting Power of Attorney. You confirm you hold LPA authorising you to manage that person's welfare and share their information.

If none of these is confirmed yet, you can still create a basic Care Space, but sections involving sensitive health information (conditions, key facts, medications, and appointments) stay locked until a basis is confirmed.

When you confirm a basis, you type your full name as a signature and tick statements confirming your understanding. We keep this as a consent record (see above). If a Care Space was created on someone's behalf, that person can later be invited to take ownership and confirm consent directly themselves.

You are responsible for ensuring you have appropriate permission or authority before sharing information about another person. HaloTogether does not verify legal authority.

Under UK GDPR, our legal bases for processing are:

If you enter information about another person, you are responsible for ensuring you have an appropriate lawful basis to share it. You can remove sensitive information, revoke consent, or request erasure at any time.

Data inside a Care Space is private and visible only to invited members of that specific Care Space.

Users cannot access:

• Other users' Care Spaces
• Data belonging to unrelated Care Spaces
• Private account information outside their authorised groups

Members may hold different roles (Owner, Co-owner, Coordinator, or Helper), and some sensitive sections may be limited by role. The HaloTogether operator may have limited administrative access where strictly necessary for technical support, security investigation, backup recovery, handling a data rights request, or legal compliance. Administrative access to personal data is recorded in operational logs, and erasure actions are recorded in a separate internal log.

HaloTogether relies on trusted third-party service providers to operate the platform. Each processes data on our behalf under a data processing agreement.

These providers process data only in accordance with our instructions and their own security and compliance standards.

We store Care Space data, files, and server functions in the European Union. Some of our providers are based outside the UK, which can involve transferring personal data internationally - for example to the United States.

Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or Addendum, or the UK extension to the EU-US Data Privacy Framework where the provider is certified.

You can contact us at hello@luminapps.co.uk for more information about the safeguards in place.

HaloTogether does not use advertising or tracking cookies.

We use only storage that is necessary to run the service you have requested, including:

• Keeping you signed in
• Storing data locally (via IndexedDB) so the app works offline
• Essential security and error-diagnostic information

Because this storage is strictly necessary to provide the app, it does not require consent under the Privacy and Electronic Communications Regulations.

HaloTogether supports offline use. To provide this feature, some data may be cached locally on your device using browser storage technologies such as IndexedDB.

This means:

• Some information may temporarily remain stored on your device after viewing it
• Data may exist on multiple trusted members' devices within a Care Space
• Offline data may not always reflect the latest synced information
• Changes made offline may sync later once connectivity is restored

If you use a shared or public device, you should log out appropriately, protect access to your device, and avoid storing sensitive information on unsecured devices.

We retain data only for as long as reasonably necessary:

• Account data is retained while your account remains active. If your account has no active Care Space and you have not signed in for two years, we email a warning to the address on your account and permanently delete the account 30 days later unless you sign in during that period. Signing in at any time resets this two-year period.
• Care Space data is retained while the Care Space remains active.
• When a Care Space is archived, all content - including feed posts, medications, appointments, visits, to-dos, contacts, the medical profile, member records, and stored photos - becomes read-only and is permanently deleted 30 days after archiving.
• Deleted content may remain in secure encrypted backups for up to 30 days before being overwritten. If we ever restore from a backup, any data that was deleted or erased after that backup was taken will be re-deleted before the restored data is made available.
• Error-monitoring logs are retained for up to 90 days, and server and infrastructure logs for up to 30 days.

Consent records. Records that evidence consent or legal authority (such as attestations and related audit entries, including the name, email, and timestamp of the confirmation) are retained for as long as the Care Space exists. When a Care Space is permanently deleted, all associated consent records are deleted at the same time. We keep a separate internal record of GDPR erasure requests - such as who was erased, when, and which administrator actioned it - for our own legal compliance; this record is not shared with users.

You may request deletion of your account and associated personal data at any time.

Under UK GDPR, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of your data
• Restrict or object to processing
• Request a copy of your data in a portable format
• Withdraw consent for sensitive data processing

When you request erasure, we delete your account, identity, and profile photo, and remove your name from shared Care Space records by anonymising them. Where a Care Space is closed as part of your erasure, its stored photos and medical information are deleted at that time. Some shared Care Space history may remain for other members, but without your identifying details. We keep a separate internal record that the erasure took place, for legal compliance.

For full details of what gets deleted, what is retained, and how long processing takes, see our Account & Data Deletion page.

To exercise your rights, contact hello@luminapps.co.uk. We will respond within one month. We may need to verify your identity first, which can pause that period until we have what we need.

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. Contact us at hello@luminapps.co.uk.

We will acknowledge your complaint within 30 days, look into it, and let you know the outcome, keeping you updated on progress.

If you remain unsatisfied, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We take reasonable technical and organisational measures to protect user data, including:

• Secure authentication via Firebase Authentication
• Encrypted connections (HTTPS)
• Access controls enforced between Care Spaces at the database level
• Cloud infrastructure managed by established providers

No online system can guarantee absolute security. Users are responsible for keeping their email account secure, inviting only trusted individuals, and protecting access to their devices.

HaloTogether is not a healthcare provider, medical record system, MAR system, or emergency monitoring service. The app does not provide:

• Medical advice or clinical recommendations
• Diagnosis or treatment guidance
• Medication verification
• Emergency response services
• Guaranteed reminders or alerts

Information entered into HaloTogether may be incomplete, delayed, or inaccurate. It must not be relied upon for clinical decisions. This includes DNACPR and other sensitive status information, which may be out of date or incorrect and should always be verified against official records. Always seek professional medical advice for healthcare decisions.

If someone may be at immediate risk or requires urgent medical attention, contact emergency services immediately.