Privacy & Data Protection (PIPEDA & GDPR)
Lunalta operates from Toronto, Canada. Our default privacy framework is PIPEDA (Personal Information Protection and Electronic Documents Act). For users in the European Union and European Economic Area, GDPR rights also apply where they go beyond PIPEDA. This page outlines both.
Legal basis for processing
Under PIPEDA, we process personal information with your knowledge and consent, for purposes a reasonable person would consider appropriate. Under GDPR (for EU/EEA users), we process personal information on the basis of: your explicit consent for health-related data; performance of a contract (the LUNA service); compliance with legal obligations; and our legitimate interests in operating and improving the service.
Data protection measures
LUNA applies encryption in transit and at rest, role-based access controls, audit logging, and regular security review. We host on infrastructure with industry-standard security certifications. We minimize the personal information we collect and retain.
International data transfers
Some of our service providers may process data outside your country of residence. Where this happens, we use safeguards required by applicable law (PIPEDA accountability principle; GDPR Standard Contractual Clauses or equivalent mechanisms for EU/EEA users) to maintain the same level of protection.
Your rights
PIPEDA rights: access your information, correct inaccuracies, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada. GDPR rights (EU/EEA users): all of the above, plus the right to data portability, the right to object to processing, the right to restriction of processing, and the right to lodge a complaint with your local supervisory authority. To exercise any right, contact admin@lunalta.ai. We respond within applicable legal timeframes (typically 30 days under PIPEDA; one month under GDPR).
Privacy contact
For privacy questions, complaints, or to exercise any of the rights above, contact admin@lunalta.ai. If you are an EU/EEA user and feel your privacy concerns have not been adequately addressed, you have the right to contact your local data protection authority.