Privacy policy

Privacy officer

Mike Beaulieu is the privacy officer (person in charge of the protection of personal information) for Lumisys AI. For any question, access request, rectification request or complaint about your personal information, write to him at mike@lumisysai.com.

Information collected through the website

The lumisys.ai website does not require an account. In addition to the technical data used for analytics and form protection described below, we collect the information you give us:

• If you fill out our contact form, we collect your name, phone number, email address and trade to respond to your request. This information is recorded in GoHighLevel with the language, submission date and reference, plus your promotional choice and the wording and version of the consent shown. This choice is optional: declining does not prevent you from sending your request. The form does not automatically enroll your contact details in a promotional campaign.
• If you book a demo or a discovery call through our booking link, the scheduling platform collects your name, email address, phone number and business name.
• If you email or call us, we keep your contact details and the content of your message.
• If you call our demo lines (Sofia at 581 802-5098, Livia at 819 758-7256), an AI agent answers and tells you so at the start of the call. Information from that call is used only to show you the service and to follow up on your request.
• The site remembers your cookie choice and language in your browser (local storage). Our cookie policy also describes analytics and form protection.

Form protection and duplicate prevention

Cloudflare Turnstile checks form visits using technical signals, including your IP address, browser and site origin. Cloudflare uses these signals to block bots and improve Turnstile. See the Cloudflare Turnstile privacy notice.

Our server sends your IP address to Cloudflare during verification. To limit attempts and prevent duplicates, Upstash Redis stores fingerprints computed with a secret key from request identifiers, counters, timestamps, processing states and, when available, the GoHighLevel contact ID. It does not receive the form's contact details in plain text or the consent wording. These records are pseudonymized, not anonymous: they may still be linked to a request or CRM record.

Counters expire after 15 minutes and locks after at most 120 seconds. Recovery checkpoints expire 7 days after their last write. Their expiration does not delete the contact record or notes in GoHighLevel; those follow the retention rules below. For an access or deletion request, write to mike@lumisysai.com.

Website analytics

With your consent in the banner, lumisys.ai loads Vercel Web Analytics to measure page visits, demo clicks and requests whose receipt our server confirms. A click is not a confirmed booking. Declining or withdrawing consent disables new analytics events without preventing the form from working.

Website events use predefined page, language and source categories. They exclude form contact details and content, submission identifiers and URL parameters. After consent, three attribution categories are kept in session storage within the same tab and cleared when consent is withdrawn. Analytics is blocked if a referrer could contain personal information. Vercel also processes technical connection data for audience statistics, including country and device type. We do not use these events for advertising or link them to contact records.

Information Sofia collects during calls

When Sofia answers calls for a client business, she collects the information needed to handle the caller's request: name, phone number, address and reason for calling. Callers are informed at the start of the call that they are interacting with a conversational agent powered by artificial intelligence (AI).

This information is passed on to the client business Sofia is answering for, so it can follow up on the request (callback, quote, appointment, follow-up).

Information Livia collects during calls

When Livia answers calls for a client clinic or healthcare professional, she collects the information needed to book the appointment or pass on the message: name, phone number, type of appointment requested, availability and, where applicable, the content of the message. She never gives health advice or diagnoses. Patients are told at the start of the call that they are speaking with an artificial intelligence.

Audio recording, transcription and retention settings must be documented with the clinic and checked before activation. A transcript may contain health information if the caller provides it. For the demo, use fictional situations without detailed medical information. Text reminders, when enabled, should stay administrative and omit the reason for the visit.

This information is passed on to the client clinic, which remains responsible for its patients' information. Lumisys AI acts as the clinic's service provider under a data processing agreement.

CRM setup

When we set up a CRM for a client business, we may have access to its customers' information (records, history, follow-ups) in the GoHighLevel platform, solely to configure, test and support the system, under the service agreement made with the business. The client business remains responsible for its own customers' information.

How we use your information

• Answering calls and booking appointments for our client businesses and clinics
• Passing on to the client business or clinic the information needed to follow up on the request
• Calling you back and, with your consent, sending you information by email or text message
• Scheduling and holding the demos and discovery calls requested through our booking link
• Setting up and supporting our client businesses' CRMs
• Improving service quality and providing technical support
• Meeting our legal obligations

We never use your personal information for solicitation without your consent, and we do not sell it to third parties.

Hosting, subcontractors and disclosure to third parties

The form also uses Cloudflare (Turnstile, bot protection) and Upstash (Redis, attempt limits and request recovery). These services operate alongside Vercel hosting and the recording of requests in GoHighLevel.

We use the following subcontractors: the GoHighLevel platform (telephony, booking, customer management and CRM, servers in the United States), a voice technology provider (speech recognition and synthesis for Sofia and Livia) and Vercel (website hosting and audience measurement, United States). An up-to-date register of our subcontractors and of where data is processed is available on request.

By using our services, you understand that your information may be stored on servers located outside Quebec. Before disclosing personal information outside Quebec, we assess whether it will receive adequate protection there, and we govern the disclosure with contractual agreements with our providers.

We only share your information with those who need it to deliver the service: the client business or clinic involved in your call, and our technology providers, who are bound by confidentiality obligations, except where the law requires or permits otherwise.

Retention and security

We keep personal information only as long as necessary for the purposes described above or to meet our legal obligations, after which we securely destroy or anonymize it.

We use reasonable security measures (encrypted communications, access controls, authentication) to protect information against unauthorized access, use or disclosure.

Your rights

• Right of access: you can ask to see the personal information we hold about you and to get a copy.
• Right of rectification and deletion: you can ask us to correct information that is inaccurate, incomplete or ambiguous, and to delete information that is outdated, not justified, or whose collection, disclosure or retention is not authorized by law.
• Right to withdraw consent: you can withdraw your consent to the use of your information, subject to legal requirements.
• Right to data portability: you can ask that the computerized personal information collected from you be sent to you in a structured, commonly used technological format, or to any person or body authorized by law to collect it.
• Right to cessation of dissemination and de-indexing: in the cases provided for by law, you can require us to stop disseminating information about you or to de-index any hyperlink attached to your name that gives access to it.

To exercise any of these rights, write to mike@lumisysai.com. We respond to requests within 30 days. If your information was collected by Sofia or Livia for a client business or clinic, send your request to that business or clinic, which is responsible for it; we will help it respond. If you are not satisfied with our response, you can, within 30 days, apply to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) for an examination of the disagreement, or file a complaint with it.

Privacy incidents

If a privacy incident presents a risk of serious harm, we will notify the Commission d'accès à l'information and the individuals concerned, as required by Law 25, and take reasonable steps to reduce the risk of harm. If the incident involves information we process for a client business or clinic, we notify that client without delay so it can meet its own obligations.

Changes to this policy

We may update this policy from time to time. The current version is always published on this page, along with its update date.

Contact us

Lumisys AI, Plessisville, Quebec. Privacy officer: Mike Beaulieu, mike@lumisysai.com, +1 367-995-8787.