1. Introduction
ilumenIQ LLC ("ilumenIQ," "we," "us," or "our") is committed to protecting the privacy of the individuals and organizations that interact with our website and software platform. This Privacy Policy describes how we collect, use, and disclose information when you visit our marketing website at ilumeniq.com (the "Site") or use our SaaS data aggregation, dashboarding, reporting, and practice management platform (the "Platform," and together with the Site, the "Services").
ilumenIQ serves group mental health and wellness practices ("Customers") on a business-to-business basis. This Privacy Policy addresses our practices with respect to:
- Visitors to our Site (including prospective customers);
- Customer Administrators and Account Users who access and use the Platform on behalf of a Customer; and
- Data we process on behalf of Customers, including data that may constitute Protected Health Information under HIPAA.
Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read, understood, and agree to the practices described herein.
2. Scope and Applicability
2.1 This Policy Covers
This Privacy Policy covers personal information collected by ilumenIQ in connection with the Site and the Platform, including information about Customer representatives and authorized end users.
2.2 Customer Data and PHI
ilumenIQ's Platform is designed to process—but not store—data provided by or on behalf of Customers, which may include Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act (collectively, "HIPAA").
Where ilumenIQ processes PHI on behalf of a Customer, ilumenIQ acts as a Business Associate as defined under HIPAA, and such processing is governed by a Business Associate Agreement ("BAA") executed between ilumenIQ and the Customer, which is incorporated into our Master Subscription Agreement. The terms of the BAA govern the processing of PHI and supersede this Privacy Policy to the extent of any conflict.
ilumenIQ does not store PHI. ilumenIQ processes Customer data—including any PHI—solely in transit for the purpose of generating reports, dashboards, and analytics outputs for the Customer. ilumenIQ does not retain underlying PHI following the completion of processing.
2.3 This Policy Does Not Cover
This Privacy Policy does not govern the practices of:
- Third-party websites or services linked to from the Site;
- Customers' own privacy practices with respect to their patients or clients; or
- Electronic health record ("EHR") or practice management systems used by Customers that feed data into the Platform.
3. Information We Collect
3.1 Information You Provide Directly
We collect information you provide when you:
- Contact us through the Site (e.g., via a contact or inquiry form);
- Create an account or register for the Platform;
- Communicate with us by email, phone, or other means;
- Execute agreements with us; or
- Respond to surveys or participate in product research.
This information may include your name, job title, organization name, email address, phone number, billing and payment information, and any other information you choose to provide.
3.2 Information Collected Automatically — Site
When you visit the Site, we and our third-party analytics providers automatically collect certain information about your device and usage, including:
- IP address and approximate geographic location;
- Browser type and version, operating system, and device type;
- Pages visited, time spent on pages, and referring URLs;
- Date and time of visits; and
- Other standard web log data.
Google Analytics: The Site uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies and similar technologies to collect and report information about Site usage. Information collected by Google Analytics is transmitted to and stored by Google in accordance with Google's privacy policy. You may opt out of Google Analytics data collection by installing the Google Analytics Opt-out Browser Add-on. We use Google Analytics to understand how visitors use our Site and to improve our content and services.
We do not use advertising cookies or share Site visitor data with third-party advertisers.
3.3 Information Collected Automatically — Platform
When authorized users access and use the Platform, we may collect:
- Login and session data, including timestamps and IP addresses;
- Feature usage data and interaction logs;
- Error logs and diagnostic data; and
- Configuration and preference settings.
This information is collected for purposes of operating, securing, and improving the Platform.
3.4 Customer Data Processed on the Platform
Customers may direct data—including data imported or exported from third-party EHR and practice management systems—into the Platform for the purpose of generating reports, dashboards, and analytics outputs. Such data may include PHI. ilumenIQ processes this data solely as a Business Associate acting on the Customer's behalf and in accordance with the applicable BAA. ilumenIQ does not use Customer data, including PHI, for its own purposes beyond what is necessary to provide the Services.
4. How We Use Information
We use the information we collect for the following purposes:
- To provide and operate the Services, including creating and managing accounts, processing transactions, and delivering reports and dashboards;
- To communicate with you, including responding to inquiries, sending service-related notifications, and providing customer support;
- To send marketing communications, where permitted and with the ability to opt out as described in Section 7 below;
- To improve and develop the Services, including analyzing usage patterns, diagnosing technical issues, and conducting research and development;
- To ensure security, including detecting and preventing fraud, unauthorized access, and other malicious activity;
- To comply with legal obligations, including responding to lawful requests from government authorities and enforcing our agreements; and
- To process PHI on behalf of Customers, as directed by each Customer and as permitted under the applicable BAA.
We do not sell personal information. We do not use personal information for targeted advertising.
5. How We Share Information
We do not sell your personal information to third parties. We may share information in the following circumstances:
5.1 Service Providers
We may share information with third-party vendors and service providers that perform services on our behalf, including cloud hosting, payment processing, customer support, email communications, and analytics. These providers are authorized to use your information only as necessary to provide services to us and are bound by appropriate confidentiality and data protection obligations.
5.2 Customers
If you are an authorized end user accessing the Platform on behalf of a Customer, your usage data and account information may be accessible to the Customer's administrator(s).
5.3 Legal Requirements
We may disclose information when required to do so by law, regulation, court order, or lawful government request, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ilumenIQ, our customers, or others. Where legally permitted, we will notify the applicable Customer prior to disclosing any Customer data in response to a legal request.
5.4 Business Transfers
In the event of a merger, acquisition, sale of assets, or other corporate transaction involving ilumenIQ, personal information may be transferred as part of that transaction. We will provide notice of any such transfer and any material changes to this Privacy Policy.
5.5 With Your Consent
We may share information with third parties when you have given us explicit consent to do so.
6. Cookies and Tracking Technologies
6.1 Site Cookies
We use cookies and similar tracking technologies on the Site for the following purposes:
- Strictly necessary cookies: Required for the Site to function (e.g., session management).
- Analytics cookies: Used to understand how visitors interact with the Site (Google Analytics).
We do not use advertising or targeting cookies on the Site.
6.2 Managing Cookies
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Site. For information about opting out of Google Analytics, see Section 3.2 above.
6.3 Do Not Track
Our Site does not currently respond to "Do Not Track" signals from web browsers.
7. Your Choices
7.1 Marketing Communications
If you have provided your email address to us, you may receive marketing communications from ilumenIQ. You may opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at legal@ilumeniq.com. Opting out of marketing communications will not affect service-related communications.
7.2 Account Information
Authorized users may update their account information by logging into the Platform. Customers may request deletion or modification of account data by contacting us as set forth in Section 10 below.
7.3 Data Subject Rights
Individuals in certain jurisdictions may have rights with respect to their personal information under applicable law, including rights of access, correction, deletion, and portability. To exercise any such rights, please contact us at legal@ilumeniq.com. We will respond to verifiable requests in accordance with applicable law.
8. Data Retention and Security
8.1 Retention
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, to maintain our business relationship with Customers, to comply with legal obligations, to resolve disputes, and to enforce our agreements.
Customer data processed through the Platform that constitutes PHI is processed in transit and not retained by ilumenIQ following the completion of processing, except as may be required for audit logging or as otherwise specified in the applicable BAA.
8.2 Security
We implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit, access controls, and regular security assessments.
No method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of information transmitted to or through the Services.
Where ilumenIQ processes ePHI, we comply with the HIPAA Security Rule requirements applicable to Business Associates.
9. HIPAA and Business Associate Obligations
Where ilumenIQ processes PHI on behalf of a Customer, ilumenIQ acts as a Business Associate under HIPAA. In that capacity:
- ilumenIQ will use and disclose PHI only as permitted by the applicable BAA and as required by law;
- ilumenIQ will implement appropriate safeguards to prevent unauthorized use or disclosure of PHI;
- ilumenIQ will report to the applicable Customer any Breach of Unsecured PHI (as defined in HIPAA) of which ilumenIQ becomes aware, in accordance with the timeframes specified in the BAA;
- ilumenIQ will not use PHI for its own purposes beyond what is necessary to provide the Services; and
- Upon termination of the applicable agreement, ilumenIQ will return or destroy PHI as specified in the BAA.
A BAA is required before ilumenIQ will process any PHI on behalf of a Customer. The BAA is incorporated into and made a part of the Master Subscription Agreement.
Customers are solely responsible for ensuring that their collection, use, and disclosure of PHI—and their use of the Platform in connection with PHI—complies with HIPAA and all applicable state laws. ilumenIQ's compliance with HIPAA as a Business Associate does not relieve Customers of their own HIPAA obligations as Covered Entities.
10. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our privacy practices, please contact us at:
ilumenIQ LLC 1235 East Blvd, Suite E519 Charlotte, NC 28203 legal@ilumeniq.com
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers by email or by posting a notice through the Platform prior to the change becoming effective. The "Last Updated" date at the top of this page reflects when the Policy was most recently revised. Your continued use of the Services after the effective date of any changes constitutes acceptance of the revised Policy.
12. Governing Law
This Privacy Policy is governed by the laws of the State of North Carolina, without regard to its conflict of law principles.
ilumenIQ LLC | 1235 East Blvd, Suite E519 | Charlotte, NC 28203