Privacy Policy

Effective August 27, 2026

MoveLuma is a healthcare communication practice service operated by Media Yard LLC (“Media Yard,” “we,” “us,” or “our”). Media Yard LLC is responsible for the information processed through MoveLuma. This policy explains what information we process when you use the website and free practice experience.

Information we process

• Practice audio: when you record a response, it is securely sent to our service for transcription and feedback.
• Transcript and feedback: a transcript is created so your response can be evaluated and returned to you.
• Practice history: recent scenario names, scores, and dates are saved locally in your browser. Transcripts are not included.
• Account data: when you request passwordless access, we store your email, account timestamps, the accepted legal-policy version and acceptance time, hashed one-time-link and session tokens, and any associated access entitlement. Authentication tokens are not stored in plaintext.
• Payment and entitlement data: our payment provider processes billing details and payment credentials. We receive transaction, customer, subscription, and plan identifiers needed to provide and manage paid access; we do not store complete card numbers.
• Waitlist details: if you join the beta list, we collect your email address, signup time, and which signup path or plan prompted your request.
• Technical data: our infrastructure may process standard request data such as IP address, browser information, and security logs. One-way identifiers derived from your IP and email are used to enforce practice and sign-in limits.

How we use information

We use information to authenticate users; provide simulations, transcription, AI-generated feedback, progress, billing, and support; prevent abuse; maintain security; send requested service messages; comply with law; and understand aggregate reliability and use. We do not sell personal information or share it for cross-context behavioral advertising.

AI processing, voices, and model training

When you deliberately start recording, your audio is securely transmitted through Cloudflare for transcription and AI-generated feedback. MoveLuma does not intentionally store learner audio or transcripts in its application database. Cloudflare states that Workers AI customer content—including audio, prompts, and outputs—is not used to train AI models or improve Cloudflare or third-party services without explicit consent. MoveLuma does not consent to that use and does not use learner recordings or transcripts to train shared or general-purpose AI models.

MoveLuma does not create voiceprints, identify or recognize speakers, or infer emotion, health, race, ethnicity, disability, or other sensitive traits from voices. Prerecorded example voices are AI-generated simulated learning assets; playing one does not send your voice to the audio-generation provider.

How long we keep information

We follow a purpose-based retention schedule. Account information and practice progress are retained while an account is active so learners can use the Service and see their progress. An inactive free account and its progress are automatically deleted after 12 months without a login. Expired sign-in links and sessions are deleted after 30 days; abuse-prevention counters and payment-webhook identifiers after 90 days; waitlist registrations after 24 months unless you unsubscribe sooner; and non-identifying aggregate product-event counts after 13 months. Inactive or expired entitlement records are deleted after 30 days.

When we complete a verified account-deletion request, application account and progress data are deleted within 30 days, subject to limited legal, security, dispute, and backup exceptions. Active account and entitlement information remains while needed to provide purchased access. Stripe or Link may retain transaction, tax, fraud-prevention, and legally required billing records under their own policies. Security evidence may be preserved longer when reasonably necessary for an active incident, dispute, or legal obligation. Deleted data may remain temporarily in protected provider-managed backups until those backups rotate and is not used for ordinary operations.

Service providers and worldwide transfers

We use Cloudflare to host the website, process AI requests, maintain our database, and protect the service; Stripe and Link to process payments, billing, tax, and related transactions; and Resend to deliver requested account and service emails. Cartesia was used to generate static example-response audio and does not receive learner data when recordings are played.

Media Yard is based in the United States. Information may be processed in the United States and other countries where our providers operate. For transfers from the European Economic Area, United Kingdom, or another jurisdiction requiring safeguards, we rely on an available lawful transfer mechanism such as an adequacy decision or approved contractual clauses used by the relevant provider.

MoveLuma keeps aggregate daily product-event counts, such as scenario starts and completions. These counters do not store an IP address, browser fingerprint, recording, transcript, email address, or visitor identifier and are automatically deleted after 30 days.

Legal bases for EEA and UK users

Where European or UK data-protection law applies, we process information as needed to perform our contract with you, pursue legitimate interests in securing and reliably operating the Service, comply with legal obligations, and obtain consent where consent is required. You may withdraw consent without affecting earlier lawful processing.

Your rights and choices

Depending on where you live, you may have rights to access, know, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, opt out of sale or sharing, limit certain sensitive-data use, appeal a refusal, or complain to a regulator. Applicable exceptions may apply. Email [email protected] to submit a request; we will verify it proportionately and respond within applicable time limits. You can decline microphone access and clear locally saved history through your browser. MoveLuma does not use solely automated processing to make decisions with legal or similarly significant effects.

Health information and HIPAA boundary

MoveLuma follows privacy and health-information laws that apply to its operations, including HIPAA when legally applicable. The individual self-service Service is not a healthcare provider, health plan, clinical record system, or emergency service and is not designed to receive protected health information. Never include real patient names, medical records, diagnoses, treatment details, or identifying health information. MoveLuma does not currently offer institutional or organization-administered accounts. Any future institutional or PHI-related use would require separate legal, privacy, security, and business-associate review before launch.

Adults only

MoveLuma is intended only for adults age 18 and older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information.

Security

We use administrative, technical, and organizational safeguards designed to protect information, including hashed authentication tokens and restricted infrastructure access. No system is completely secure. We investigate incidents and provide notices required by applicable law.

Changes and contact

We may update this policy and will revise its effective date. Questions or privacy requests for Media Yard LLC can be sent to [email protected].