Lumi Health Pty Ltd | ABN 59 570 586 599
Last updated August 2026
Privacy summary
- We collect the information needed to arrange and perform your carrier screening, provide your report and support related care.
- Your sample and genetic information receive a higher level of protection because they are sensitive health information.
- We share information only with people and organisations that help deliver the service, with your consent where required, or where the law permits or requires it.
- Some testing and related services may involve providers in the United States.
- You can ask to access or correct your information, withdraw consent for future activities that rely on consent, opt out of marketing, or make a complaint.
1. About this Privacy Policy
This Privacy Policy explains how Lumi Health Pty Ltd (Lumi, we, us, or our) collects, holds, uses, and discloses personal information when you use our website, patient platform, carrier screening products, and related services.
Lumi is an Australian company with its registered office at 627 Chapel Street, South Yarra, Victoria 3141. We manage the website at lumihealth.com.au (Website) and the patient platform at patient.lumihealth.com.au (Platform).
We handle personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles and, where applicable, the Health Records Act 2001 (Vic) and other state or territory health privacy laws (applicable privacy laws). This Privacy Policy should be read with our Terms and Conditions and any collection notice or consent form provided for a particular service.
Links to other websites are governed by those sites' privacy policies. Lumi does not control how those sites handle your information.
2. Key terms
“personal information” means information or an opinion about an identified person, or a person who is reasonably identifiable. Genetic information processed through our Services is treated as health information and sensitive information and receives extra protection under applicable privacy laws.
“processing” or “handling” means any operation or set of operations which is performed on personal information, and includes collecting, recording, organising, holding, using, analysing, sharing, correcting, deleting and destroying personal information.
“Services” means our Website, Platform, carrier screening and prenatal wellness tests, reports, counselling arrangements, customer support and related products, functions or activities that we provide to you either for a fee or free of charge.
“you” or “your” means a current or potential customer of Lumi, as a user of the Website, Platform, or any other Services provided by Lumi.
3. What personal information we process, why, and for how long
We process personal information described in this Section where it is reasonably necessary for our Services, with your consent where required, or where otherwise permitted or required by law. Where we collect your sensitive information, including health and genetic information, we obtain your consent unless an applicable law permits or requires us to collect it without consent. For couple-based testing, each person must separately provide the consent required for the collection and handling of their own sensitive and health information.
You may withdraw your consent at any time for future handling that depends on that consent. Withdrawal does not affect handling that occurred before withdrawal or for personal information we must keep or handle by law. It may mean we cannot continue or complete a Service.
You do not have to give us your personal information. However, if you do not provide information needed for a test or related service, we may not be able to provide that service.
Depending on the Service you use, we may process your personal information for the following purposes:
3.1 Orders, accounts and service administration
Why: To help you select and order a Service; create and manage your account; process payments where applicable; communicate about your order; deliver kits; and administer the Service.
Personal information: Name; date of birth; sex or gender where relevant to testing; address; email address; phone number; login information; customer, order, kit and sample identifiers; selected test type; order status; health and reproductive information relevant to the Service, such as genetic counselling records, family history and pregnancy estimated due date; Medicare number, eligibility and claim information, where Medicare funding is sought; payment, billing and transaction information (our payment provider processes payment-card details; Lumi does not ordinarily store full card details).
How long we keep your personal information: While your account remains active, then as needed for legal, security and service-administration purposes. Health information contained in the account is retained for at least the applicable health-record period, generally at least 7 years after the last health service provided. Financial information is kept for the period required under applicable Australian taxation, corporations, and record-keeping laws. At the end of the applicable period, we securely destroy or de-identify personal information.
3.2 Medicare eligibility and billing
Why: To check eligibility, submit and manage a Medicare claim and meet Medicare billing requirements.
Personal information: Name; date of birth; Medicare number, eligibility and claim information; kit and sample identifiers.
How long we keep your personal information: For at least the applicable health-record period, generally 7 years after the last health service provided. Financial information is kept for the period required under applicable Australian taxation, corporations, and record-keeping laws. At the end of the applicable period, we securely destroy or de-identify personal information
3.3 Kit registration and sample management
Why: To register your kit, match the sample to the correct person and test, maintain sample identification and chain of custody, arrange transport and receipt of the sample, and enable the relevant laboratory to perform the requested test.
Personal information: Identity details needed for matching; date of birth where required; customer, kit and sample identifiers; test type and service information.
How long we keep your personal information: At least 7 years after the last health service provided. At the end of the applicable period, we securely destroy or de-identify personal information.
3.4 Laboratory Genetic testing and laboratory analysis
Why: To process your sample, extract and analyse DNA, generate genetic information, identify and analyse relevant genetic variants, perform quality and validation checks and determine results.
Personal information: Kit and sample identifiers, relevant clinical and reproductive information; your cheek-swab sample; extracted DNA; sequence or genotype data; variants; analytical outputs; carrier findings.
How long we keep your personal information: Physical cheek swab, sample and extracted DNA is kept for at least 3 months from report, unless a different period is explained to you or required for quality, clinical or legal reasons. Laboratory, genetic and sequencing information is kept for at least 10 years from the testing date. At the end of the applicable period, we securely destroy or de-identify personal information.
3.5 Clinical interpretation and reporting
Why: To interpret your test results, prepare, review, issue and, where needed, amend your report, make the report available through the Platform, and support appropriate clinical follow-up.
Personal information: kit and sample identifiers; genetic findings; carrier status; clinical interpretation; quality information; test reports.
How long we keep your personal information: Lumi’s copy is retained for at least the applicable health-record period, generally 7 years after the last health service provided. Information may be kept for longer by the clinical reporting provider where required by its applicable health-record and accreditation obligations. At the end of the applicable period, we securely destroy or de-identify personal information.
3.6 Genetic counselling and related care
Why: To determine whether genetic counselling is required, arrange counselling appointments, record whether required counselling has been completed, facilitate optional counselling requested by you, and manage any related report-release requirements.
Personal information: Identity and contact details; test identifier; relevant result status; appointment and completion information.
How long we keep your personal information: At least 7 years after the last relevant health service. At the end of the applicable period, we securely destroy or de-identify personal information.
3.7 Sharing test results to your nominated healthcare professional
Why: Where you authorise us to do so, to give your report to a healthcare professional nominated by you.
Personal information: Your identity; practitioner identity and contact details; report; findings; carrier status and related clinical information.
How long we keep your personal information: While your account remains active, then as needed for legal, security and service-administration purposes. At the end of the applicable period, we securely destroy or de-identify personal information.
3.8 Customer support and service administration
Why: To respond to enquiries and complaints, investigate Service issues, maintain our systems, improve service quality and manage our relationship with you.
Personal information: Contact information; account; order; service; correspondence; feedback; technical and usage information.
How long we keep your personal information: While your account remains active, then as needed for legal, security and service-administration purposes. At the end of the applicable period, we securely destroy or de-identify personal information.
3.9 Marketing
Why: To send information about Lumi Services where you have consented or the law otherwise permits it.
Personal information: Name; email address; phone number; marketing preferences; device or browser information; pages visited; cookie or analytics data.
How long we keep your personal information: Until you opt out. We may keep a minimal suppression record so we can respect your opt-out. At the end of the applicable period, we securely destroy or de-identify personal information.
3.10 Safety, security, fraud prevention and legal compliance
Why: To protect our systems and information, prevent and investigate fraud, security incidents and data breaches, protect our rights, manage legal claims and respond to regulators, courts, tribunals, law-enforcement bodies, or other authorities where required or authorised by law.
Personal information: Information relevant to the particular issue or legal requirement.
How long we keep your personal information: Until the matter is resolved and 5 years thereafter. At the end of the applicable period, we securely destroy or de-identify personal information.
4. How we process your personal information
We usually collect your personal information directly from you. We may also receive it from another person, such as a partner involved in delivering the Service. If another person gives us information about you, they must have authority to do so. Where required, we will notify you of the collection.
We hold personal information electronically in Lumi's systems and in systems operated by service providers that support our Services. Where relevant, personal information may also be contained in physical records or associated with physical samples held in connection with the Services. We take reasonable steps to protect the personal information we hold from misuse, interference, loss and unauthorised access, modification or disclosure. Further information about how we protect personal information is provided in Section 8 below.
5. Who we share personal information with
We may share personal information with the following recipients when needed to provide the Services, with your consent where required, or where the law permits or requires it:
- companies in the same corporate group that provide operational, laboratory, technology or support services
- accredited laboratories, sequencing providers, bioinformatics providers, clinical reporting services and other genetic-analysis providers
- your referring or nominated healthcare practitioner, hospital or institution
- genetic counselling and other healthcare providers involved in your care
- Medicare, billing providers and payment processors
- IT, cloud storage, platform, cybersecurity, communications, website and analytics providers
- professional advisers, auditors and insurers where needed for legitimate business or legal purposes
- regulators, courts, tribunals, law-enforcement bodies or other authorities where required or authorised by law
- another person you authorise us to share information with
We do not sell or rent your individual health or genetic information. We do not place customer genetic information in public databases, or provide it to an employer or insurer, unless you expressly authorise us or the disclosure is otherwise required or authorised by law.
If Lumi is involved in a merger, acquisition, reorganisation, sale or transfer of all or part of its business or assets, personal information may need to be disclosed or transferred as part of that transaction. Any disclosure or transfer of personal information in connection with such a transaction will be made only where permitted by applicable law and subject to appropriate privacy and confidentiality safeguards. Given the sensitive nature of health and genetic information, we will use de-identified or aggregated information where practicable and limit access to identifiable information. Where required, we will notify you of any transfer of your personal information.
6. Overseas disclosures
Some of our Services use providers located outside Australia. In particular, personal information, including sensitive and health information, may be disclosed to recipients in the United States for laboratory testing, sequencing, bioinformatics, related analysis, technology or support services.
Before an overseas disclosure, we take reasonable steps required by applicable privacy laws so the recipient handles the information consistently with the Australian Privacy Principles. Where applicable, we also follow state or territory requirements for health information.
7. How we protect personal information
We use physical, technical and organisational controls designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These controls include:
- access controls based on a person’s role and work responsibilities
- encryption in transit and at rest where appropriate
- separating personal information from sensitive and health information where practicable
- coded identifiers, secure systems, monitoring, vulnerability management and incident-response processes
- laboratory quality, access-control and chain-of-custody procedures
- staff confidentiality, privacy and security obligations
No system or internet transmission is completely secure. You should protect your account by using a strong, private password, keeping devices secure and avoiding suspicious links.
8. Cookies and website analytics
Our website and emails may use cookies, pixels and similar technologies. These help us operate the site, keep sessions secure, remember preferences, understand site traffic, measure communications and improve our services.
These technologies may collect your IP address, device and browser information, pages viewed, referring pages and time spent on the site. Our analytics and advertising providers may process this information under their own privacy policies.
You can block or delete cookies using your browser and, where available, Lumi’s cookie settings. Blocking some cookies may affect site functions. You can also configure your email application to block tracking images.
9. Your choices and privacy rights
Subject to the law, you may:
- ask what personal information we hold about you and request access to it
- ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading
- ask us to delete information where we are legally permitted to do so
- withdraw consent for future handling that relies on consent
- opt out of marketing at any time by using the unsubscribe link or contacting us
- make a complaint about how we have handled your information
We may ask you to verify your identity before acting on a request. If we cannot provide access, make a correction or delete information, we will explain why, where the law requires us to do so, and tell you about available complaint options. We will not treat you unfairly because you exercise a privacy right, although some requests may affect our ability to provide a Service.
Please contact Lumi first if you have a privacy concern. This gives us the opportunity to investigate and address it.
- Email the Privacy Team at privacy@lumihealth.com.au. Include your name, contact details, a clear description of the concern and any useful dates, order numbers or other references.
- We may verify your identity. We will investigate your complaint, keep you informed and aim to respond in writing within 30 days.
- If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner. Depending on where the health service was provided or the information was handled, you may also be able to complain to a state or territory health complaints or privacy regulator.
Office of the Australian Information Commissioner: www.oaic.gov.au/privacy/privacy-complaints
10. Changes to this Privacy Policy
We review this Privacy Policy from time to time. We will publish the updated Privacy Policy on our Website and change the ‘last updated’ date. If a change materially affects how we handle personal information already collected, we will provide further notice where appropriate or required by law.
11. Contact us
For questions, access or correction requests, consent withdrawal, deletion requests or complaints, contact:
Privacy Team
Lumi Health Pty Ltd
627 Chapel Street
South Yarra VIC 3141
Australia
Email: privacy@lumihealth.com.au