What we collect, and what we do with it.

When you submit the quote form we receive the fields you completed:

• Your name and work email address
• Your clinic or business name
• Your state or province
• The machines you selected and your purchase timeline
• Your phone number, your role and your message, if you chose to give them

Name, business, email, state and timeline are required because without them we cannot quote. Everything else is optional and the form works without it.

We do not collect anything else. There is no login, no shopping cart, and no payment processing on this website. We do not knowingly collect information from anyone under 18, and this site is not directed at consumers.

Do not send patient information through this site. The quote form is not a secure clinical channel and we are not a HIPAA business associate. If you send protected health information anyway, we will delete it.

Solely to respond to your enquiry: to work out which configuration suits your room, to prepare a quote and specification sheet, and to follow up about that quote. We may also contact you about the machine you bought — a safety notice, a parts issue, a firmware update.

We do not sell your personal information, we do not share it with advertisers, and we do not use it for automated decision-making or profiling. We do not send marketing email to anyone who has not asked for it, and every message we do send has an unsubscribe link.

Your submission is emailed to our sales inbox and recorded in our internal enquiry log. Email delivery is handled by Resend. The website is hosted by Netlify, which processes standard server request logs — IP address, user agent, requested URL — as part of serving the page.

These providers process the data on our behalf under contract and are not permitted to use it for their own purposes. Both operate infrastructure in the United States, so if you are writing to us from Canada your enquiry is processed in the US.

Quote enquiries are kept for 24 months from your last contact with us, then deleted. Records relating to an actual purchase — invoices, warranty and service history — are kept for as long as tax and product-liability law requires us to, which is longer.

This site uses Google Analytics 4, the Meta pixel and Microsoft Clarity to measure which pages lead to orders and to report on advertising. These set cookies and share limited event data — the page viewed, the machine looked at, and the value of an order — with those providers.

Microsoft Clarity records how pages are used — scrolling, clicks and taps, and where a visit ends — so we can see where the site is confusing. It masks what you type into form fields, and we use it only to improve the site.

We do not upload your name, email address or delivery address to any advertising platform.

You can turn this off, and it works. No measurement script is loaded until this preference is checked, so opting out prevents them rather than asking them to stop. We also honour the Global Privacy Control signal automatically, with nothing to click.

Fonts are compiled into the site at build time and served from this domain, so loading a page sends no request to a font provider.

The site is served over HTTPS only. Enquiry data is held in systems protected by access control and multi-factor authentication, and only the people who handle quotes can see it. No transmission over the internet is perfectly secure, and we will not pretend otherwise — but we do not hold payment details, and there is nothing on this site to log into.

Wherever you are, you can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email sales@lumabodylasers.com and we will action the request within 30 days. We will not charge you for it, and asking will never affect the service or price you get.

California. Under the CCPA as amended by the CPRA you may request the specific pieces of personal information we hold, the categories we collected and our purpose for collecting them, request correction or deletion, and limit the use of sensitive personal information. We do not collect sensitive personal information and we do not sell personal information for money. Where advertising measurement is switched on, sharing event data with an advertising platform may count as “sharing” under the CCPA — the opt-out above is the mechanism for refusing it, and Global Privacy Control is honoured automatically.

Canada. Under PIPEDA you may access the personal information we hold about you and challenge its accuracy. If we cannot resolve a complaint to your satisfaction you may escalate it to the Office of the Privacy Commissioner of Canada.

If this policy changes materially we will update this page and the date below. Continued use of the site after a change means the updated policy applies.

Privacy questions and rights requests go to sales@lumabodylasers.com. See also our Terms of Service.

Luma Body is the controller of the information described on this page. Write to the address above for anything in it.