1. Who We Are
Biolumi, Inc. (“Biolumi”, “we”, “us”) is the data controller for personal data collected on this website (biolumi.io) and through the Bion compliance training platform. For privacy-related enquiries, contact us at privacy@biolumi.io.
2. Data We Collect
2a. Biolumi.io Website
When you submit the demo request form, we collect: first name, last name, work email address, organisation name, role, and approximate company size. We use this information solely to respond to your enquiry and, where you consent, to send product updates.
2b. Bion Platform
When your organisation uses Bion, we process the following on your behalf:
- Email addresses of training participants (used for assignment and completion tracking)
- Training completion status and quiz answers
- Uploaded document content (used to generate training assessments via AI)
- Authentication events (login timestamps, Auth0 session metadata)
- System audit logs (user ID, IP address, action, timestamp) required for regulatory compliance
3. Legal Basis for Processing
| Processing Activity | Legal Basis |
|---|---|
| Demo request (website) | Legitimate interest — responding to a business enquiry |
| Training assignment and completion tracking | Contract — service delivery to your organisation |
| AI quiz generation from uploaded documents | Contract — service delivery to your organisation |
| Audit logging | Legal obligation — SOC 2, HIPAA, 21 CFR Part 11 record-keeping requirements |
| Authentication | Contract — necessary to provide secure access to the platform |
| Aggregate analytics | Legitimate interest — improving service quality |
4. Sub-processors and Recipients
We share personal data only with the processors listed below, all of whom are bound by data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Cloud hosting, PostgreSQL database, Blob Storage, email delivery (ACS) | EU / US |
| OpenAI / Azure OpenAI | AI-powered quiz generation from uploaded documents | US |
| Auth0 (Okta) | Authentication and session management | US |
We do not sell personal data. We do not share data with third parties for their own marketing purposes.
5. Retention Periods
| Data Category | Retention Period |
|---|---|
| Training completion records (quiz sessions) | 5 years |
| Uploaded files (soft-deleted) | 90 days after deletion |
| File version history | 2 years |
| System audit logs | 7 years |
| Demo request leads (website) | Until you request deletion |
| Authentication session metadata | Duration of the active session |
6. Your Rights
If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with applicable data protection laws, you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your personal data (Bion users: available via
DELETE /api/user/account) - Restriction — ask us to limit how we use your data
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, email privacy@biolumi.io. We will respond within 30 days.
7. Supervisory Authority
You have the right to lodge a complaint with your national data protection supervisory authority at any time. In Ireland: the Data Protection Commission (dataprotection.ie). In the UK: the Information Commissioner's Office (ico.org.uk).
8. Cookies
This website does not use tracking or advertising cookies. We use only the functional cookies set automatically by Next.js for routing purposes. No cookie consent banner is required.
9. International Transfers
Some processors (OpenAI, Auth0) are based in the United States. Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent transfer mechanisms.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be notified to Bion account holders via email. The “Last updated” date at the top of this page reflects the most recent revision.
Questions? privacy@biolumi.io