Lunas security
What Lunas holds, who else touches it, the controls that are actually in place, and where our compliance posture genuinely stands.
Lunas is a personal health record and medical AI workspace. People upload lab reports, imaging, genetic data, and clinical documents, and talk to Stethos about them. That is among the most sensitive data a person has, and the point of this page is to describe how it is handled without rounding anything up.
Every control listed here is in place today. Where our compliance posture is incomplete, this page says so rather than describing an intention. Claims about security are worth exactly as much as their weakest sentence.
5
Subprocessors
Five external processors receive data, two of which never receive health content. Each one is a link in the chain, so the list is kept deliberately short.
Never
Health data sold or shared for advertising
No advertising SDKs, data brokers, insurers, or employers. No behavioural analytics on health surfaces.
Off by default
Model training on your data
Requires explicit opt-in, de-identification, and human review before any record becomes a training candidate.
Compliance
Every framework that applies to Lunas, and our honest status against each. A framework we have not been assessed against is listed as such.
BAAs executed with our AI, storage, and database providers.
Business Associate Agreements are executed with Google Cloud (AI inference and file storage) and Neon (database). The chain is not complete across every processor, so Lunas does not currently accept protected health information on behalf of a covered entity, and clinician upload of identifiable patient files is not open. Consumer health data that you enter about yourself is not PHI under HIPAA.
We are a vendor of personal health records under the Rule.
Security incidents affecting health data are evaluated against the Rule's notification requirements, including the 2024 amendment covering unauthorized disclosure and not only intrusion.
Consumer health data is never sold and never shared without authorization.
Consumer health data is collected only for the product functions described in our Privacy Policy, is never sold, and is never shared without separate authorization.
No attestation. Controls organized against the criteria, unaudited.
Lunas holds no SOC 2 attestation and has not begun an observation window. The controls on this site are organized against the Trust Services Criteria because that is the useful shape for review, not because an auditor has examined them. We will say plainly when that changes.
Lunas is not offered to users in the EEA or the UK.
Lunas is not marketed, priced, or offered to users in the European Economic Area or the United Kingdom, and does not target them. If that changes, this page will be updated before it does, not after.
Data
Controls
Who can reach a record, and how that is proven on every request.
How records and files are stored, validated, and kept separated.
What we can prove after the fact about who accessed what.
Design choices that keep sensitive data out of places it should never reach.
Baseline hardening at the transport, browser, and schema layers.
What you can do with your own record, without asking us.
Subprocessors