Privacy policy — lumelume

lumelume ("we", "us", "our") is a New Zealand business. We comply with the Privacy Act 2020 (Privacy Act) and the Health Information Privacy Code 2020 (HIPC) when we deal with personal information. This policy explains how we collect, use, share and protect it.

lumelume runs a medical weight-loss programme for people in New Zealand: an online eligibility check, video consults with NZ-registered doctors, prescription treatment dispensed by a licensed New Zealand pharmacy and delivered to your door, and ongoing support from our care team. Because we provide health services, much of the information we hold about you is health information, and the HIPC applies to it.

We care about your privacy:

We will never sell, rent or trade your personal information.
We will never publicly display your email address or other details that identify you.
The health details you enter in our online eligibility check stay in your browser. They are not sent to us or to anyone else.
The health information you give your doctor and our care team is used to provide your care. It is never used for advertising.

1. Definitions

Personal information means information about an identifiable individual.

Health information includes information about your health, such as your height, weight and medical history, and information about health services provided to you.

2. How we collect your personal information

We collect personal information directly from you when you:

complete our eligibility check and give us your email address;
sign up for emails on our website;
book a consult and pay your deposit;
attend your video consult and follow-up reviews with your doctor;
message our care team, your health coach or the patient community;
pay for your programme; or
email us or otherwise contact us.

With your consent, or where the law allows, we may also collect health information about you from others involved in your care, such as your GP, a laboratory or the pharmacy. We also collect some information automatically when you use our website (see clause 7), and we receive some information from our service providers: for example, Stripe tells us when a payment succeeds, fails or is cancelled.

3. What personal information we collect

Eligibility check. The check asks about your sex, height, weight and some health and safety questions. Your answers are used in your browser to show you a result. Your height, weight, BMI and health answers are not sent to us or to anyone else. What we do receive is your email address, your first name if you give it, and a tag recording that you came through the eligibility check and the sex you selected.
Email sign-ups. Your email address, your first name if you give it, and where on the website you signed up.
Booking your consult. Your name, date of birth, phone number, email address, residential and delivery address, and NHI number, so we can confirm who you are and that you are in New Zealand.
Your clinical record. What you tell your doctor and what your doctor records: your medical history, medicines, allergies, height, weight and other measurements, test results, your doctor's notes, and your prescriptions. Your doctor may ask you for photos or documents where they are needed for your care.
Your care. Your messages with our care team and health coach, how you are getting on with treatment, and any side effects you report.
Payments. Stripe collects your name, email address, card details and billing address (and your delivery address where a payment needs one). We receive your name, email address, billing country, what you paid for, the amount, and whether a payment succeeded, failed, was refunded or was cancelled. We never see or store your card number.
Patient community. The community runs on WhatsApp. When you join, your name, profile and phone number are visible to us and to other members of the group. Anything you post is visible to the group.
Messages to us. Whatever you tell us when you email or message us, which may include health information.
Website use. Technical information such as your IP address, browser and device type, the pages you visit and when, collected through our hosting provider and the tools described in clause 7. When you go to pay, we use the country your IP address points to (not the address itself) to check that you are in New Zealand, because we only provide our services there.

You don't have to give us your personal information. If you don't, your doctor may not be able to assess or treat you safely, and we may not be able to provide the programme or reply to you.

4. Why we collect, use and disclose personal information

We use personal information to:

confirm your identity, your age and that you are in New Zealand;
let your doctor assess you, decide on and review your treatment, and keep your clinical record;
have your prescription dispensed and your treatment delivered;
provide your ongoing care, including messages from our care team and health coach, and the patient community;
take payments, manage renewals, cancellations and refunds, and handle failed payments;
send you the information you asked for, service messages about your care and your programme, and (with your consent) marketing emails;
understand how our website is used and improve it;
measure how well our advertising works;
keep our website and services secure; and
meet our legal obligations, resolve disputes and enforce our terms.

We never send your eligibility check answers, your clinical record or any other health information to MailerLite, Meta or any other email or advertising provider.

5. Who we share personal information with

We share personal information only with the following, and only what they need:

Your doctor: the NZ-registered doctors who provide your consults see your booking details and your clinical record.
Our partner pharmacy (a licensed New Zealand pharmacy): receives your prescription and the details it needs to dispense it safely, such as your name, date of birth, NHI number, contact details and delivery address.
Our courier: receives your name, delivery address and phone number to deliver your treatment in plain packaging. It is not told what is inside.
Your GP and other health providers: with your consent, or where the HIPC allows it (for example, where it is needed to prevent a serious threat to your health or safety).
Our clinical records and video consult providers: store your clinical record and host your video consults on our behalf.
Stripe (payments): processes your payments, stores your card, billing and subscription details, and runs the billing portal where you can update your card or cancel.
MailerLite (email): receives your email address, first name if you gave it, and where you signed up (including the sex you selected if you came through the eligibility check). We use it to send our emails. It never receives health information.
Meta (advertising measurement): see clause 7. When you pay online we may also send Meta a scrambled (hashed) copy of your email address and the amount, so it can tell us whether our advertising led to the payment. We never send Meta your name, your eligibility check answers or any health information.
Supabase (database): stores a record of sign-ups, payments and account status (email address, where you signed up and payment facts) so we can manage access and understand how people find us. It does not hold your clinical record.
Netlify (website hosting): hosts this website and processes requests to it, including technical information such as IP addresses.
Google: our website loads fonts from Google, which receives your IP address when it does. If we turn on Google Analytics, Google will also receive information about how you use the website.
WhatsApp (patient community): processes your information under its own terms when you join the community.
our email and business software providers, our professional advisers, and anyone to whom our business (or part of it) is transferred or proposed to be transferred;
people you authorise us to share with; and
government agencies, regulators or law enforcement, where the law requires or permits it.

6. Overseas providers

Your doctor, our partner pharmacy and our courier are in New Zealand. Many of our technology providers are based overseas, including in the United States (Stripe, Meta, Netlify, Google, Supabase) and the European Union (MailerLite). Where a provider only stores or processes information on our behalf, the information is treated as held by us under the Privacy Act, and we stay responsible for it.

Where a provider uses information for its own purposes (for example, Meta and Google), that is a disclosure overseas. We only do that where we believe on reasonable grounds that the provider is required to protect the information in a way that, overall, gives comparable safeguards to the Privacy Act, or where you have authorised it after we have told you that it may not be.

7. Using our website, cookies and similar technology

We, and the providers we use, record some information about your use of our website, such as the pages you visit, the time and date, and your IP address. We use cookies and similar technology for this:

Login. A cookie that keeps you logged in to the patient area for up to 30 days.
Meta Pixel. Records page views and a small number of events (such as a sign-up or starting checkout) and sets cookies that let Meta recognise your browser. Meta may link this to a Facebook or Instagram account you are logged in to and use it to show and measure ads. It records the address of each page you visit, except the eligibility check: the Pixel does not run on that page at all, so Meta is not told that you took the check. We have set it up so it does not receive your email address, your answers or any health information from your browser. You can control ads through your Facebook and Instagram ad settings.
Google Analytics, if enabled: measures how the website is used in aggregate.
Your browser's storage. We keep your email address and first name in your browser for the rest of your visit so you don't have to type them twice.

You can block or delete cookies in your browser settings. Some parts of the website, such as the patient area, may not work if you do.

8. Security

We take reasonable steps to protect your information from loss, unauthorised access, use, change or disclosure. Our website uses encrypted connections (HTTPS). Card details are handled only by Stripe. Our database can only be accessed from our own server-side code, not from your browser, and access to our accounts is limited to the people who need it.

If a privacy breach happens that is likely to cause serious harm, we will notify you and the Privacy Commissioner as the Privacy Act requires.

Your clinical record is kept in a clinical records system with access limited to the people involved in your care. Please remember that anything you post in the patient community is visible to other members. Think about what health information you share there.

9. Links

Our website links to websites run by others, such as Medsafe and WhatsApp. We are not responsible for their privacy practices, which may differ from ours, so please read their privacy policies.

10. Accessing or correcting your personal information

You have the right to ask for access to the personal information we hold about you, including your clinical record, and to ask us to correct it. Email us using the details below. We may need to confirm your identity first. We will respond as soon as reasonably practicable, and within 20 working days, in line with the Privacy Act.

11. Marketing emails

We send marketing emails only to people who have given us their email address to receive them, in line with the Unsolicited Electronic Messages Act 2007 and the Privacy Act. Every marketing email includes an unsubscribe link, and you can also email us to stop them. If you are on the programme, we will still send you service messages about your care and your programme.

12. Retention

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires. In particular:

email sign-up details are kept until you unsubscribe or ask us to delete them;
payment and billing records are kept for as long as tax and accounting laws require (generally seven years);
your clinical record is kept for at least 10 years from the day after we last provide care to you, as the Health (Retention of Health Information) Regulations 1996 require; and
programme and support records are kept while you are on the programme and for a reasonable period afterwards, in case of questions, refunds or complaints.

When we no longer need information, we delete it or remove anything that identifies you. Deleted information may stay in backups for a limited time.

13. Making a complaint

If you think we have breached the Privacy Act or the HIPC, or you are unhappy with how we have handled your information, please contact us first using the details below. Tell us your name, how to reach you, and what your complaint is about. We will acknowledge your complaint within 5 working days and tell you how we will deal with it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

14. Contact us

For questions about this policy, to access or correct your information, to make a complaint or to unsubscribe, email our privacy officer at info@changingcurves.com.

15. Changes to this policy

We may update this policy from time to time by publishing the new version here. If a change materially affects how we use information we already hold about you, we will tell you before it takes effect.

Last updated 13 October 2026.

Privacy policy.