LumeLabs OÜ ("we," "us," or "our") operates PainApp, a pain tracking and neuroplasticity education application. This Privacy Policy explains how we collect, use, protect, and share your personal information, including sensitive health data.
Your privacy is important to us. We are committed to protecting your personal information and complying with the General Data Protection Regulation (GDPR) and other applicable privacy laws.
The pain test on our website. Our free pain test at painapp.health/assessment runs entirely in your browser. Your answers and your result aren't sent to us or anyone else, and they're kept only while the page is open: closing or reloading it clears them. If you've allowed analytics, we count anonymous steps, such as starting the test, reaching a question, finishing it, and which button you tap afterwards. Those counts never include your answers or your result.
2. Information We Collect
2.1 Information You Provide Directly
Account Information:
Email address
Name (if provided)
Password (encrypted)
Profile information
Health Data (Special Category Data under GDPR):
Pain levels and descriptions
Symptom information
Body part tracking
Timestamps of pain episodes
Notes and observations
Medication tracking (if used)
Any other health-related information you choose to enter
AI Chatbot Conversation Data:
Questions you ask the AI chatbot
Responses generated by the AI
Health information you share with the chatbot
Conversation history and context
This data may be processed by third-party AI providers (see Section 5.1)
This is "special category" personal data under GDPR and receives enhanced protection.
2.2 Information Collected Automatically
Technical Data:
IP address
Device type and operating system
Browser type and version
App version
Time zone settings
Language preferences
Mobile device identifiers (if using mobile app)
Device model and manufacturer
Operating system version
Screen resolution
Usage Data:
Features you use
Time spent in app
Interaction patterns
Error logs and crash reports
Button clicks and navigation paths (via Posthog)
Session duration and frequency
Feature adoption metrics
Note: Usage analytics help us improve the app but do NOT include your actual health data or pain tracking details.
2.3 Information From Third Parties
We may receive information if you:
Sign in through social media (if enabled)
Use third-party integrations (with your permission)
2.4 Mobile App Permissions
If you use the mobile app, we may request:
Required Permissions:
Internet access (to sync data and use chatbot)
Storage (to cache data locally)
Optional Permissions (only if you grant):
Notifications (for reminders and updates)
Camera (if you want to add photos to pain logs)
You can manage permissions in your device settings. Denying optional permissions may limit some features but won't prevent basic app functionality.
2.5 How You Found Us
If you agree to “Marketing and source tracking” in Cookie settings, our website records how you first arrived:
The first page you visited (its address without anything after the “?”, and with any part that looks like an email address removed)
The website that sent you, as its address only (for example https://www.reddit.com), never the page you were on
Campaign tags in the link you followed (utm_source, utm_medium, utm_campaign)
Click IDs added by Google Ads (gclid) and Reddit Ads (rdt_cid)
The date and time you arrived
This stays in the painapp_acquisition cookie on your device for 90 days, with the random ID of your cookie choices (Section 10.4). Only your first visit counts. When you follow a link from our website to the PainApp web app, or to the Android app on Google Play, it’s passed along with the link so the app can read it.
What we keep with your account: when you create an account, PainApp keeps only the resulting source category, how the source was detected, the platform you signed up on, the host name of the referring website, and the random ID of your cookie choices, which links your account to the record of them (Section 10.4). We don’t keep the page address, campaign tags or click IDs with your account.
Purpose: understanding which channels bring people to PainApp
Legal basis: your consent for storing and reading this on your device, which you can withdraw anytime in Cookie settings; our legitimate interest (GDPR Art. 6(1)(f)) in knowing which channels bring people, for keeping the source category with your account
Retention: the cookie for 90 days; the source details for the life of your account, deleted with it
Partner links: if you arrive through a partner’s link (one with ?ref= in it), we record that the link was used, with the partner’s code and the page it led to, so the partner’s clicks can be counted. For that visit, the code is also passed to the PainApp app when you follow a link to it. It’s only stored on your device, in the painapp_ref cookie, if you agree to “Marketing and source tracking”.
2.6 Payment Records
We keep a record of each payment, trial and refund so we can take payment, handle refund requests and disputes, keep the accounting records the law requires, and report our revenue:
Amount and currency
The product you bought
The payment provider’s transaction ID
The date
The platform (web, iPhone or Android)
These records are linked to your account while it exists. If you delete your account, we remove that link and keep the record itself for the financial records period in Section 7.1 (7 years).
Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)) for taking payment and issuing refunds; our legal obligation to keep accounting records (Art. 6(1)(c)); and our legitimate interest (Art. 6(1)(f)) in handling refund requests, disputes and chargebacks, defending legal claims, and reporting our revenue
3. Legal Basis for Processing (GDPR)
We process your personal data only when we have a legal basis:
3.1 Consent (Primary Basis for Health Data)
You explicitly consent to us processing your health data
On our website, optional cookies and source tracking run only with your consent (Section 10)
Telling our advertising partners about your signup or payment runs only with your consent (Section 5.1, Advertising Partners)
You can withdraw consent at any time
Withdrawal does not affect lawfulness of prior processing
3.2 Contract Performance
To provide the Service you signed up for
To manage your account
To process payments and refunds
3.3 Legitimate Interests
To improve the Service
To prevent fraud and abuse
To ensure security
To analyze usage patterns (anonymized)
To know which channels bring people to PainApp, by keeping a source category with your account (Section 2.5)
To handle refund requests, payment disputes and chargebacks, and to defend legal claims (Section 2.6)
3.4 Legal Obligations
To comply with laws and regulations
To keep accounting records for 7 years (Section 2.6)
To keep a record of your cookie choices, so we can show you consented (GDPR Art. 7(1), Section 10.4)
To respond to legal requests
To enforce our Terms of Service
4. How We Use Your Information
4.1 Primary Uses
To Provide the Service:
Display your health tracking data
Generate visualizations and reports
Sync data across your devices
Provide personalized features
Power the AI chatbot with your questions and context
Generate AI responses to your health information queries
To Improve the Service:
Analyze usage patterns (anonymized)
Identify bugs and fix errors
Develop new features
Conduct research (with anonymized data)
To Communicate With You:
Send service announcements
Respond to your inquiries
Send marketing communications (with consent)
Provide customer support
To Ensure Security:
Prevent fraud and abuse
Protect against security threats
Enforce our Terms of Service
Maintain system integrity
4.2 We Do NOT
Sell your personal data to third parties
Use your health data for advertising
Share identifiable health data without consent
Use your data for purposes incompatible with those described here
5. How We Share Your Information
5.1 We Share Your Data In Limited Circumstances:
Service Providers (Data Processors):
We share data with trusted third parties who help us operate:
Authentication & Data Storage:
Supabase - Provides authentication services and database infrastructure
Processes: Email, password (encrypted), user authentication tokens, session data
Location: Servers in EU/US (depending on configuration)
Advertising Partners (signups and payments in the app):
Google Ads and Reddit Ads - when you sign up, start a trial or pay, we tell them that this happened
What we send: the event (signup, trial or purchase), its date, the amount and currency for a purchase, the ad click ID if you arrived from one of their ads, your email address hashed with SHA-256 so they can match it to their own users without us sending the address itself, and your PainApp account ID hashed the same way so they can tell repeat events apart
When: only with your consent. The ad click ID is sent if you allowed “Marketing and source tracking” on our website or turned on “Help us measure our ads” in the app. Your hashed email address and hashed account ID are sent if you turned on “Help us measure our ads” in the app, or allowed “Marketing and source tracking” on our website since October 8, 2026, when its description started saying so. Your most recent choice, on the website or in the app, is the one that counts, and the app shows a website choice as its own
Why: so we can see which ads lead to signups and payments. We tell Google not to use it to personalize ads
Never sent: your health data, pain logs, chat messages or anything you tell the coach
Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by turning off Ad measurement in the app’s Settings or changing your Cookie settings, and we’ll stop sending your data from then on
Cloud hosting providers for data storage and application delivery
Payment Processing:
Stripe - Processes payments for subscriptions bought on our website
Apple App Store and Google Play - Process payments for subscriptions bought in the iPhone and Android apps
RevenueCat - Manages app store subscriptions on our behalf
Processes: Purchase amounts and dates, subscription status, and the account identifier that links a purchase to your account
Refund Requests and Payment Disputes:
If you ask Apple or Google for a refund, or dispute a charge with your bank or card issuer, we may send them a summary of your account and usage so they can decide the request. This is described in section 10.5 of our Terms of Service.
Shared: account creation and last sign-in dates, what you bought and when, your subscription status, and counts and dates of your activity (for example, days active and number of messages sent)
Shared with a card issuer only: your email address, to identify the purchase
Never shared: the content of your conversations, your pain logs, symptoms or any other health information
You can withdraw consent to this sharing at any time by emailing hello@painapp.health
Email Communications:
Email service providers for transactional and marketing emails
Customer Support:
Support tools for handling user inquiries
AI/LLM Providers (Chatbot Functionality):
When you use the AI chatbot feature, your questions and health information may be processed by third-party AI providers including:
OpenAI (GPT models)
Anthropic (Claude models)
Google (Gemini/PaLM models)
Meta (Llama models)
Other LLM providers we may integrate
Important About AI Providers:
Your chatbot conversations are sent to these providers to generate responses
Each provider has their own privacy policy and data practices
We may switch providers without notice
AI providers may use conversations to improve their models (check their policies)
We select providers based on their security and privacy commitments
All Service Providers:
Are contractually bound to protect your data
Process data only on our instructions
Comply with GDPR requirements (or equivalent)
Are selected based on security standards
Legal Requirements:
We may disclose data if required by:
Court orders or subpoenas
Law enforcement requests
Legal proceedings
Protection of our rights
Public safety concerns
Business Transfers:
If we are acquired or merged, your data may be transferred to the new entity (you will be notified).
With Your Consent:
We may share data with third parties if you explicitly consent.
5.2 Mobile App Stores
Apple App Store:
If you download PainApp from the Apple App Store:
Apple collects data about your download and purchases
Apple processes payment information
Apple may collect device information and usage data
We receive limited information (aggregate downloads, crash reports)
Your relationship with app stores is governed by their terms
We are not responsible for app store data practices
5.3 We Never Share
Identifiable health data for marketing purposes
Personal data for sale to data brokers
Your health data to advertisers, ever. What advertising partners do receive is listed in Section 5.1 (Advertising Partners) and, for our website, Section 10
6. Data Security
6.1 Security Measures
We implement appropriate technical and organizational measures:
Technical Measures:
Encryption in transit (TLS/SSL)
Encryption at rest for sensitive data
Secure password hashing
Regular security updates
Firewall protection
Intrusion detection systems
Organizational Measures:
Access controls (principle of least privilege)
Employee training on data protection
Regular security audits
Incident response procedures
Data protection impact assessments
6.2 Your Responsibility
You are responsible for:
Keeping your password secure
Not sharing account access
Using strong passwords
Logging out on shared devices
Updating security settings
6.3 No Absolute Security
Important: No internet transmission or electronic storage is 100% secure. While we implement strong security measures, we cannot guarantee absolute security. You use the Service at your own risk.
7. Data Retention
7.1 Retention Periods
Account Data:
Retained while your account is active
Deleted 90 days after account closure (unless legal requirements apply)
Health Data:
Retained while your account is active
Deleted 90 days after account closure
May be retained longer if you request (e.g., for health records)
Anonymized Data:
May be retained indefinitely for analytics
Cannot be linked back to you
Legal Requirements:
Some data may be retained longer if required by law
Financial records: 7 years (EU requirement)
Payment records (Section 2.6): linked to your account while it exists, then kept for the same 7 years with the link to your account removed
How you found us (Section 2.5): the cookie for 90 days, and the source details kept with your account for the life of the account, deleted with it
Records of your cookie choices (Section 10.4): for as long as the choice is in effect, plus up to 3 years
7.2 Data Deletion
To delete your data:
Contact us at hello@painapp.health
We will delete your data within 30 days
Some data may be retained in backups (90 days maximum)
Anonymized data may remain
8. Your Rights Under GDPR
As an EU data subject, you have the following rights:
8.1 Right to Access
Request a copy of your personal data
Understand how we process your data
Receive data in a structured, commonly used format
How to exercise: Email hello@painapp.health with subject "Data Access Request"
8.2 Right to Rectification
Correct inaccurate personal data
Complete incomplete data
How to exercise: Update in app settings or email us
8.3 Right to Erasure ("Right to be Forgotten")
Request deletion of your personal data
Applies when data is no longer necessary
Subject to legal retention requirements
How to exercise: Email hello@painapp.health with subject "Data Deletion Request"
8.4 Right to Restrict Processing
Limit how we use your data
Applies in specific circumstances
How to exercise: Email hello@painapp.health with subject "Restrict Processing"
8.5 Right to Data Portability
Receive your data in machine-readable format
Transmit data to another service
How to exercise: Email hello@painapp.health with subject "Data Portability Request"
8.6 Right to Object
Object to processing based on legitimate interests
Object to direct marketing (anytime)
How to exercise: Use unsubscribe link in emails or email us
8.7 Right to Withdraw Consent
Withdraw consent for health data processing anytime
Does not affect lawfulness of prior processing
May limit Service functionality
How to exercise: Email hello@painapp.health with subject "Withdraw Consent"
EU residents can complain to their local authority
8.9 Response Time
We will respond to your requests:
Within 30 days (GDPR requirement)
Free of charge (for first request)
May request identity verification
May charge fee for excessive requests
9. International Data Transfers
9.1 Data Location
Your data is primarily stored and processed in the European Economic Area (EEA).
9.2 Transfers Outside EEA
If we transfer data outside the EEA, we ensure adequate protection through:
EU Standard Contractual Clauses
Adequacy decisions by EU Commission
Other approved safeguards
Third-Party Service Transfers:
Some of our service providers may be based outside the EEA:
Supabase: May store data in EU or US data centers depending on configuration
Posthog: May process analytics data in US/EU servers
Google (website analytics and advertising, with your consent): May process data in the US
AI Providers: OpenAI (US), Anthropic (US), Google (US), Meta (US)
App Stores: Apple (US), Google (US)
All international transfers are protected by:
Standard Contractual Clauses (SCCs)
Adequate security measures
GDPR-compliant data processing agreements
Your explicit consent for AI chatbot data transfers
9.3 Your Rights
You have the right to:
Be informed of international transfers
Request information about safeguards
Object to transfers in certain circumstances
10. Cookies and Tracking
10.1 Your Choice
The first time you visit painapp.health, we ask which optional cookies you’re happy with. Nothing optional runs until you say yes: Google Tag Manager isn’t loaded, and our own source tracking cookies aren’t set. “Reject all” is as easy as “Accept all”, and the website works the same either way.
We use Google Consent Mode, so Google’s tags are told what you chose. We ask again after 6 months, or sooner if what we use changes.
10.2 What the Website Stores
Here’s everything our website stores on your device, by category. Google Tag Manager can only run the tags we’ve set up in it, which may include Google Analytics, Google Ads and PostHog analytics. Google and PostHog set the duration of their own cookies.
Necessary
Consent: Not needed. These are strictly necessary for something you asked for.
painapp_consent
Type
Cookie (ours)
Purpose
Remembers your cookie choices, so we don’t ask on every page, and a random ID that links them to the record of your choices we keep on our server (Section 10.4).
Duration
6 months, then we ask again
Functional preferences
Consent: Not needed. They’re only written when you use the feature, stay in your browser and are never sent to us.
painapp-font-size
Type
Browser storage (localStorage)
Purpose
The text size you picked.
Duration
Until you clear it
painapp-theme
Type
Browser storage (localStorage)
Purpose
Light or dark theme, on pages that offer one.
Duration
Until you clear it
painapp_practice_streak
Type
Browser storage (localStorage)
Purpose
Your streak on the daily practice card.
Duration
Until you clear it
painapp.seoCta.v1
Type
Browser storage (localStorage)
Purpose
Remembers that you minimised the assessment prompt on a page.
Duration
Ignored after 30 days, kept until you clear it
painapp-partner-nudge
Type
Browser storage (localStorage)
Purpose
Remembers that you closed the partner program note.
Duration
Until you clear it
exit-intent-fired
Type
Browser storage (sessionStorage)
Purpose
Stops the same prompt from showing twice in one visit.
Duration
Until you close the tab
Analytics
Consent: Only with your consent. Without it, Google Tag Manager isn’t loaded at all.
Google Tag Manager
Type
Google script (www.googletagmanager.com)
Purpose
Loads the analytics and advertising tags below that you’ve agreed to. It reads your choice through Google Consent Mode and is told when you change it.
Duration
Sets no cookie of its own
Google Analytics (_ga, _ga_*, and may include _gid)
Type
Google cookies on painapp.health
Purpose
Counts visits and shows which pages help people.
Duration
Set by Google (up to 2 years for _ga)
PostHog (ph_*_posthog), if run through Tag Manager
Type
Analytics cookie on painapp.health
Purpose
Counts visits and button clicks on the website.
Duration
Set by PostHog (up to 1 year)
Marketing and source tracking
Consent: Only with your consent.
painapp_ref
Type
Cookie (ours)
Purpose
The partner referral code in the link you followed, so the partner gets credit if you sign up later.
Duration
90 days
painapp_acquisition
Type
Cookie (ours)
Purpose
How you first found us (see Section 2.5), passed to the PainApp app if you sign up.
Duration
90 days
Google Ads tags (may include _gcl_au, _gcl_aw)
Type
Google cookies, run through Google Tag Manager
Purpose
Measure whether our ads lead to visits and signups.
Duration
Set by Google (90 days for _gcl_au)
10.3 Changing Your Mind
You can change or withdraw your consent anytime, as easily as you gave it, with the Cookie settings link at the bottom of every page, or right here:
When you withdraw a category, we delete the cookies we set for it (painapp_ref and painapp_acquisition for marketing and source tracking) and the Google and PostHog cookies stored under painapp.health, tell Google’s tags through Consent Mode, and reload the page so tags that already loaded stop. Some cookies Google sets on its own domains can’t be removed by our website. You can clear those in your browser settings.
Withdrawing doesn’t affect anything that happened while your consent stood.
10.4 Our Record of Your Choices
Each time you make or change a cookie choice, including when you withdraw one, our website sends a record of it to our server. That’s how we can show what you chose and when, if we’re ever asked to.
What it holds: a random ID, made the first time you choose and kept in the painapp_consent cookie so all your choices on this browser share it; your choice (which categories you allowed, and whether you accepted all, rejected all, saved your own choices or withdrew one); the version of the banner text you answered; and the time
What it doesn’t hold: your IP address, your name, your email or anything else that says who you are
Your account: the ID is linked to your account only if you later sign up. Our website passes it to the PainApp app with how you found us (Section 2.5), so that only happens if you agreed to “Marketing and source tracking”
Legal basis: our legal obligation to be able to show that you consented (GDPR Art. 7(1)), under Art. 6(1)(c)
Retention: for as long as the choice is in effect, plus up to 3 years as proof of it
The record is kept whatever you choose, “Reject all” included, because it’s the proof of your choice.
10.5 In the PainApp App
This section covers our website. The PainApp app uses the storage it needs to keep you signed in (Supabase), which is strictly necessary, and the product analytics described in Section 5.1 (PostHog). Our cookies painapp_ref and painapp_acquisition can be read by the PainApp web app at app.painapp.health, which only reads them and never writes them.
11. Children's Privacy
11.1 Age Restriction
PainApp is not intended for anyone under 18 years of age. We do not knowingly collect data from children under 18.
11.2 If We Discover
If we discover we have collected data from a child under 18:
We will delete it immediately
We will terminate the account
Parents/guardians should contact us if this occurs
12. Marketing Communications
12.1 What You Receive
With your consent, we may send:
Product updates
New features
Tips and best practices
Special offers
12.2 How to Opt Out
You can opt out by:
Clicking unsubscribe in any email
Updating preferences in account settings
Emailing hello@painapp.health
Note: You will still receive essential service communications (security alerts, account changes, etc.)
13. Automated Decision-Making
13.1 Our Practice
We do NOT use automated decision-making or profiling that produces legal effects or similarly significantly affects you.
13.2 If We Do in Future
We will:
Notify you explicitly
Obtain your consent
Explain the logic involved
Give you the right to human intervention
14. Data Breach Notification
14.1 Our Commitment
If a data breach occurs that poses a risk to your rights:
We will notify you within 72 hours (GDPR requirement)
We will inform the supervisory authority
We will explain the breach and our response
14.2 What We Tell You
Nature of the breach
Data affected
Likely consequences
Measures taken to address breach
Steps you should take
15. Third-Party Services
15.1 Links to Other Sites
PainApp may contain links to third-party websites or services. We are not responsible for their privacy practices.
We recommend:
Reading their privacy policies
Understanding how they use your data
Making informed decisions
15.2 Third-Party Integrations
If you connect third-party services (e.g., health devices):
You authorize data sharing
Their privacy policies apply
We are not responsible for their practices
16. Changes to This Privacy Policy
16.1 Updates
We may update this Privacy Policy from time to time. We will:
Post updated policy on our website/app
Update "Last Updated" date
Notify you of material changes (email or in-app)
16.2 Your Responsibility
You should:
Review this policy periodically
Understand how we use your data
Contact us with questions
16.3 Continued Use
Continued use after changes constitutes acceptance. If you don't agree, stop using the Service and delete your account.
17. Contact Us
17.1 Privacy Questions
For questions about this Privacy Policy or our data practices:
