General Statement

This section defines terms used in the policy to clarify the scope of personal data handling and the roles involved in processing.

We collect personal data necessary to provide legal services, comply with legal obligations, manage accounts and improve our services. We aim to limit collection to data that is relevant and proportionate to the matter being handled.

When you engage Lumiveil, you may provide the following categories of information to enable intake, case work and communication:

• Identification and contact information: full name, residential address, email address and telephone number.
• Case-related details: facts of the matter, supporting documents, medical summaries, and details required to draft legal instruments or correspond with third parties.
• Representative information: names and contact details of appointed attorneys, family members or appointed caregivers acting on your behalf.
• Billing and payment details: invoicing information and limited payment details necessary to process transactions; we avoid storing full payment card data where possible.
• Consents and preferences you express regarding communication channels and document handling.
• Feedback and records of communications such as emails, telephone notes and meeting minutes.

Certain information is collected automatically when you use our website or interact with our services to help maintain security, provide a better user experience and measure usage.

• Device and technical data: browser type, device model, operating system and unique device identifiers.
• Usage data: pages visited, time spent on pages, clicks and interaction patterns for analytics and service improvement.
• Network data: IP address and approximate geolocation derived from network information.
• Log data: server logs and error reports used to diagnose service issues and maintain stability.
• Cookies and tracking technologies as described in the cookies section.
• Security-related information such as failed login attempts and access times to support fraud prevention and access control.

We may receive personal data from third parties where necessary to carry out legal services or to comply with obligations, always seeking to limit such transfers to the minimum required.

• Referrals from healthcare providers, social agencies or other legal professionals where you have authorised that platform.
• Publicly available sources and registries accessed to verify information relevant to your matter.
• Service providers and processors supporting our operations, including cloud hosting, payment processors and analytics providers.

We process personal data only for specific, explicit and legitimate purposes directly related to delivering legal assistance and operating our services safely and effectively.

• To provide and manage legal services, case-related communications and document preparation tailored to seniors’ needs.
• To verify identity and eligibility and to perform necessary due diligence in line with professional and regulatory obligations.
• To process billing, invoicing and payments for services rendered.
• To communicate updates, notices and administrative information about your case and our services.
• To improve service delivery through analytics, secure system monitoring and training of staff on best practices.
• To cooperate with regulators, law enforcement or other authorities when required by law or to protect legal rights.
• To manage risks, prevent fraud and ensure the security of systems and client data.
• To obtain consent where marketing or non-service communications are proposed; marketing communications will only proceed where consent has been granted.

Under applicable Singapore law, including the PDPA, we rely on lawful bases such as consent, necessity for contractual performance, compliance with legal obligations, and legitimate interests where appropriate and proportionate.

• Consent: when individuals have explicitly agreed to processing for specific purposes, such as receiving marketing material.
• Contractual necessity: processing required to perform services you have requested, including document preparation and representation coordination.
• Legal obligation: processing necessary to comply with statutory or regulatory duties, such as mandatory reporting or recordkeeping.
• Legitimate interests: processing necessary for business operations such as security, fraud prevention and service improvement, balanced against individual privacy rights.

We share personal data only with parties necessary for delivering services or fulfilling legal obligations and require recipients to maintain confidentiality and appropriate safeguards.

• Service providers and processors who perform functions on our behalf, such as secure hosting, analytics and payment processing.
• Professional advisers engaged for case-specific purposes, including external counsel, accountants or expert witnesses, where needed for your matter.
• Government bodies, regulators or law enforcement when disclosure is legally required or for compliance purposes.
• Trusted community partners and social service organisations when you have authorised a referral or when it supports case outcomes.
• Successors or buyers in the event of a sale or reorganisation of our business, with measures to protect personal data post-transfer.
• Other parties where you have explicitly consented to the disclosure.

Lumiveil implements organisational and technical measures to protect personal data against unauthorised access, alteration, disclosure and destruction. Measures are scaled to the sensitivity of the data and include access controls, encryption, staff training and incident response procedures.

• Access control and role-based permissions to restrict data access to authorised personnel only.
• Encryption of data in transit using TLS and encryption at rest for stored sensitive data where appropriate.
• Regular staff training, audits, vulnerability scanning and an incident response plan to address potential security events promptly.

You have rights regarding your personal data, including accessing, correcting and deleting data, withdrawing consent where processing is consent-based, and objecting to certain processing activities. Requests are handled in accordance with applicable law and our verification procedures.

• Access and correction: request a copy of personal data we hold and ask for inaccuracies to be corrected.
• Deletion, restriction and objection: request deletion or restriction of processing where lawful grounds permit, or object to processing based on legitimate interests; data portability requests may be considered where feasible.
• Right to rectification — request correction of inaccurate or incomplete personal data held by Lumiveil.
• Right to erasure (where applicable) — request deletion of personal data when legal bases no longer apply or retention is no longer necessary.
• Right to restriction of processing — ask Lumiveil to limit how personal data is processed while a dispute or verification is underway.
• Right to data portability — request a copy of personal data in a commonly used, machine-readable format where technically feasible.
• Right to object to direct marketing and certain automated processing — opt out of profiling or promotional communications processed on the basis of legitimate interest.
• Right to withdraw consent at any time for processing that relies on consent, without affecting the lawfulness of prior processing.

• Lawfulness, fairness and transparency: Personal data is processed on lawful grounds and in a clear, understandable manner.
• Purpose limitation: Data is collected for explicit, legitimate purposes and not processed in a manner incompatible with those purposes.
• Data minimization and accuracy: Lumiveil limits the data collected to what is necessary and takes reasonable steps to keep data accurate and up to date.
• Storage limitation and security: Personal data is retained only as long as necessary for the identified purposes and protected with appropriate technical and organisational measures.

If you are concerned about how Lumiveil processes your personal data, please contact our privacy team first so we can address the matter directly. For individuals in jurisdictions with a supervisory authority (for example, a data protection authority in the EEA), you also have the right to lodge a complaint with the relevant authority after contacting us. We will cooperate with legitimate inquiries from supervisory authorities as required by applicable law.

Lumiveil’s services and communications are directed at adults, particularly seniors and their families. We do not knowingly collect personal data from children under 16 for the purpose of our legal assistance services. If we become aware that we have collected data from a minor without appropriate consent, we will take steps to delete that data as appropriate and required by law.

Our site may include links to external websites, tools or resources operated by third parties. Those sites have their own privacy practices which may differ from Lumiveil’s. We are not responsible for the content or privacy practices of third-party sites and encourage you to review their policies before providing personal information.

Lumiveil may update this privacy information periodically to reflect changes to our practices, legal requirements or service features. Material changes will be posted on our site with an updated effective date. Continued use of our services after such updates constitutes acceptance of the revised policy where permitted by law.