How LumaLayer protects student data.

Access and authentication

• Clinicians can create an account directly and start a free trial.
• Sign-in is email and password or Google, handled by a managed authentication provider. LumaLayer never stores your password.
• Roles are held separately from user profiles, so a user can't raise their own permissions.
• Sign-in events are recorded so unexpected access can be spotted.

Data separation

Every student, IEP, goal, session and recording carries an owner. Database row-level security limits reads and writes to the creating clinician, clinicians assigned to that caseload, and organization administrators. The database enforces these rules on every request, including requests made by the application itself.

Recordings and files

• Session recordings and imported IEP documents are held in private storage, never in a public bucket.
• Files are reachable only through short-lived signed links issued to an authorized clinician.
• Recording and AI transcription track a per-student consent record in the consent ledger. Today the ledger is informational: a missing consent does not block a session. Your organization is responsible for obtaining consent before recording.

Encryption and transport

All traffic to the application is served over HTTPS. Data at rest is encrypted by our managed cloud database and storage providers.

Privacy and de-identification

A workspace can run in de-identify mode. Identifiers in imported IEP text, transcripts and generated notes are replaced with stable per-student tokens before the text reaches an AI model or long-lived storage. Clinicians still see real names, because the app puts them back at display time from a restricted token map. Each import pauses on a review panel so a clinician confirms what will be replaced, and every event goes to an identifier-free privacy audit that owners can export.

Synthetic mode runs a workspace on sample data only, for demos and training, so no real student information is involved.

Audit trail

Exports, disclosures, approvals and AI-output reviews are written to an append-only audit log with the acting user and a timestamp. Audit entries can't be edited or deleted from the application.

AI safeguards

• Generated documents are drafts, marked unapproved until a clinician reviews them.
• The original generated text is stored next to the clinician's final text, so edits are visible.
• Internal model instructions are kept out of saved notes; every note type is cleaned before it is saved, and automated tests check this.
• AI requests are rate-limited per user to contain runaway usage.

Deleting your account

You can delete your account yourself, from inside the app. A solo workspace is removed with the account. If other members remain in the workspace, ownership is handed over first so their records stay intact.

Shared responsibility

We secure the platform: access control, storage, encryption in transit and audit logging. Your organization is responsible for who it grants access to, for obtaining the consents required before recording a student, and for reviewing generated documentation before it leaves the workspace.

Reporting a vulnerability

Report a suspected vulnerability or security incident to security@lumalayer.ai. We acknowledge reports within two business days and don't pursue researchers who report in good faith.