Privacy Policy
Last updated on September 3, 2026
This Privacy Policy explains how Lumos AI Research Corp. and its affiliates, including Lumos AI Labs Corp. ("Lumos", "we", "us") collect, use, share, and protect personal information, and the choices and rights you have. It applies to thelumos.ai, labela.ai, our products and services (the "Services"), our events, and our other interactions with you.
1. Who we are
Lumos AI Research Corp. provides expert data, expert hiring, and reinforcement learning services (including RLHF and RLAIF) and evaluation tools for healthcare and life science AI. Our mailing address is 8 The Green, #21176, Dover, DE 19901, USA. For privacy questions, email support@thelumos.ai.
Where this policy applies, Lumos AI Research Corp. is the controller (or "business" under California law) of your personal information.
2. When this policy does not apply
Customer Data. When a customer submits data about other people through our Services, we process that data as a processor (service provider) on the customer's instructions under our Master Services Agreement (thelumos.ai/msa), not under this policy. If you believe a Lumos customer has processed your information through our Services, direct your request to that customer. We will assist them in responding.
Protected Health Information. Where a customer provides us with PHI under HIPAA, our Business Associate Addendum (thelumos.ai/baa) and HIPAA govern that PHI. This policy does not apply to it.
3. Who this policy covers
We collect personal information from four groups of people:
Customers and their users: people who use the Services on behalf of a customer organization.
Experts: clinicians, scientists, and other domain experts who apply to work with us, or who complete data, evaluation, or research tasks through Labela or other Lumos programs.
Visitors and contacts: people who visit our websites, attend our events, request information, or correspond with us.
Job applicants: people who apply for employment or contract roles with us.
4. Information we collect
4.1 Information you give us
Account and contact details. Name, email address, phone number, company, role, and login credentials. If you sign in with Google, we receive your name, email address, and profile picture from Google, and we use them for authentication only.
Expert profile and qualification information. If you apply or work as an Expert: professional credentials, degrees, licenses and board certifications, specialty, years of experience, CV and work history, languages, country of residence, professional profile links, and the results of our screening and qualification assessments.
Work product and performance data. For Experts: the content you produce through the Services (annotations, evaluations, written responses, and other deliverables), task activity, quality ratings, and feedback on your work.
Payment information. For customers: billing contact and invoicing details. For Experts: the payment and tax information needed to pay you, such as bank details and tax identification information. Invoices and payouts are processed through our payments provider, Brex. We do not store full payment card numbers.
Communications. Support requests, survey responses, emails, and messages you exchange with us.
Application information. For job applicants: CV, cover letter, and information you provide during interviews.
4.2 Information we collect automatically
When you use our websites or Services, we collect log data: IP address, browser and device type, pages viewed, timestamps, and referring URLs. We use this for security, debugging, and to understand how the Services are used.
We do not use third-party advertising or analytics trackers on thelumos.ai. We use only cookies that are strictly necessary for the Services to work, such as session and authentication cookies.
4.3 Information from other sources
Identity providers (Google) when you sign in with them.
Professional networks (such as LinkedIn) and public sources, when we identify and contact prospective Experts or job candidates.
Customers, when they provision your account or refer you to us.
Referrals from other Experts.
5. How we use personal information
For each purpose, the legal basis we rely on in the EEA, UK, and Switzerland is shown in parentheses.
Provide the Services: create and manage accounts, authenticate you, deliver features, provide support (contract).
Recruit, qualify, and place Experts: review applications, run screening assessments, match Experts to projects, share profiles with prospective customers (contract; legitimate interests).
Pay Experts and bill customers: issue invoices, process payouts, tax reporting (contract; legal obligation).
Operate and improve the Services: monitor performance, fix bugs, develop features, produce deidentified aggregate statistics (legitimate interests).
Security and fraud prevention: detect abuse, investigate incidents, enforce our terms (legitimate interests; legal obligation).
Communicate with you: service notices, responses to your requests, event and product updates (legitimate interests; consent where required). You can opt out of marketing at any time.
Hiring: evaluate applications and conduct interviews (legitimate interests; legal obligation).
Legal compliance: respond to lawful requests and meet HIPAA, tax, and other obligations (legal obligation).
Use in AI training. Deliverables that Experts produce under their agreement with us (for example, annotations, evaluations, and written responses) may be used to train, fine-tune, and evaluate AI models for Lumos and its customers. This use is governed by the Expert's agreement with us. We do not use Experts' identity, contact, credential, or payment information to train models. We do not use customers' Customer Data to train models except as the customer directs or as permitted by the Master Services Agreement.
6. How we share personal information
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We share personal information with:
Customers, if you are an Expert: your profile, credentials, qualification results, and work samples may be shared with prospective and current customers for project matching and placement, and your deliverables are provided to the customer whose project you work on.
Service providers that process data on our behalf under contract: cloud hosting and AI infrastructure (Google Cloud, including Vertex AI), identity and authentication (Auth0), source code and build hosting (GitHub), website hosting, delivery, and security (Framer, Vercel, Cloudflare), productivity and communication tools (Google Workspace, Slack), payments (Brex), and AI model providers that power AI features in the Services (Anthropic, Google Vertex AI, OpenAI). Each provider may use the data only to provide its service to us.
Affiliates within the Lumos corporate group, under this policy.
Professional advisers, such as lawyers, accountants, and auditors, under confidentiality obligations.
Authorities and other parties when required by law, to enforce our agreements, or to protect the rights, safety, or property of Lumos, our users, or others.
A successor in a merger, acquisition, financing, or sale of assets, subject to this policy.
Anyone you direct us to, or with your consent.
7. International transfers
We are based in the United States and process personal information there and in other countries where our service providers operate. Where we transfer personal information from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, and we apply supplementary safeguards where needed.
8. Security
We maintain an information security program aligned with the SOC 2 Trust Services Criteria and the HIPAA Security Rule. It includes encryption in transit and at rest, multi-factor authentication, role-based access control, audit logging, vulnerability management, and workforce training. Current information about our security and compliance program, including SOC 2 and HIPAA updates, is published on our trust center at trust.thelumos.ai. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Retention
We keep personal information only as long as needed for the purposes in Section 5 and to meet legal, contractual, and audit obligations. Typical periods:
Customer accounts and Customer Data: the contract term plus up to 90 days, unless the contract or a BAA provides otherwise.
Expert profiles: while you are active with us and for up to 24 months after your last activity, unless you ask us to delete sooner or we must keep records for tax or legal reasons.
Job applications: up to 12 months after the hiring decision, unless you agree to a longer period.
Security and audit logs: at least one year.
Backups: a rolling 35-day window.
Financial and compliance records: as required by law, typically six to seven years.