Effective date: September 12, 2026
Last updated: September 12, 2026

Applies to:

• The website cehalo.com and any subdomains or successor sites operated by CE HALO LLC
• All Luma Educational Apps (iOS and Android) published by CE HALO LLC, including without limitation Luma Anesthesia, Luma Nurse, Luma NP, Luma ICU, and any current or future Luma-branded mobile apps that link to this statement
• CE HALO AANA-approved MAC Ed continuing education (CE) courses for CRNAs and other clinicians, whether delivered on cehalo.com, on a hosted learning platform (such as Thinkific), or through partner learning management systems
• Any other digital products, downloads, calculators, AI features, or services offered by CE HALO LLC that link to this statement

Each of the items above is referred to as a "Service," and together they are the "Services."

CE HALO LLC ("CE HALO," "we," "us," "our") provides this Data Protection & HIPAA Statement to explain how the Services relate to Protected Health Information (PHI), clinical use, and the limited non-PHI data we handle. This statement works together with our Privacy Policy, Medical Disclaimers, and Terms of Use / EULA.

The Services are educational reference, study, and continuing education tools. They are not designed to collect, store, transmit, or process Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) and related regulations.

We do not want, expect, or accept PHI. The Services are not electronic health records, not clinical documentation systems, and not intended for patient charting, care coordination, or any workflow that involves identifiable patient data.

You must not enter, upload, paste, dictate, photograph, or otherwise input any patient-identifiable information into any field or feature of any Service, including but not limited to:

• Account profile fields
• Community posts, comments, or shared content
• Notes, checklists, bookmarks, or custom content fields
• Search fields
• CE course discussion boards, quiz free-text answers, reflection prompts, or case-write-up fields
• AI assistant / chat prompts and search
• Contact forms on cehalo.com
• Support emails or in-app feedback
• Screenshots, uploads, or attachments that contain patient data

Patient-identifiable information includes, without limitation: names, initials in combination with other identifiers, medical record numbers, dates of birth, addresses, phone numbers, email addresses, full-face photos or identifiable images, biometric identifiers, device serial numbers tied to a patient, precise locations, and any other data that could reasonably identify a patient alone or in combination with other information (the HIPAA 18 identifiers and equivalent identifiers under other laws).

If you enter patient information despite this warning, you do so entirely at your own professional and legal risk. CE HALO LLC cannot protect information it never intended to receive and does not operate the Services as a PHI repository.

For learning scenarios, CE course reflections, and clinical case discussions, use only de-identified, hypothetical examples.

For ordinary use of the Services as educational, reference, and continuing education products:

• CE HALO LLC is not acting as a HIPAA-covered entity in providing the Services.
• CE HALO LLC is not your HIPAA business associate for routine use of the Services.
• The Services are not represented as a HIPAA-compliant clinical environment.
• The Services must not be used in place of your institution's Electronic Health Record (EHR) or approved clinical systems.
• Completion of a CE HALO AANA-approved MAC Ed course, or any other CE HALO course, does not create a HIPAA relationship between you (or your employer) and CE HALO LLC.

If a separate written Business Associate Agreement (BAA) is ever required for a different CE HALO LLC product or service, that would be documented in a signed contract. No BAA is created by downloading, installing, browsing, subscribing to, or purchasing any of the Services.

The Services may handle the following categories of data. None of these are intended to be PHI. Full details are in the Privacy Policy.

You can download and browse the Luma Educational Apps without creating an account. When you use the apps this way, we do not create a server-side User record and we do not collect your name, email, or other account information. Only the limited technical and local-device data described below (d, and Section 4(e) of the Privacy Policy) is processed.

An account is only required to subscribe, purchase or enroll in a CE course, sync progress across devices, or use certain account-based features. When you create an account, we maintain a server-side User record that may include:

• Email address (or Apple private relay address, if you use Sign in with Apple and choose "Hide My Email")
• Account / user identifier
• Name or display name (if provided)
• Authentication provider (email/password, Sign in with Apple, and/or Sign in with Google where enabled)
• Hashed password credentials (email/password accounts only — no plain-text passwords)
• Optional profile fields you choose to add (for example clinical role, credentials, or institution)
• Preferences, onboarding status, saved items (such as favorites, notes, or history), and feature settings
• Subscription and entitlement status linked to your account

For CE HALO AANA-approved MAC Ed courses and other CE courses, we (and our learning-platform provider, currently Thinkific) maintain the enrollment, progress, quiz, certificate, and CE credit records needed to deliver the course and satisfy accreditor and state-board recordkeeping requirements. Details are in the Privacy Policy. These records are professional education records, not PHI.

• In-app purchases are managed by Apple's App Store or Google Play. We do not receive or store your full payment card number.
• RevenueCat processes purchase events, product identifiers, expiration/renewal status, and app user identifiers used to deliver entitlements.
• Web / course purchases on cehalo.com or Thinkific are processed by a PCI-compliant payment processor (currently Stripe, and/or the payment processor integrated with Thinkific). We receive order confirmation and limited billing information, not full card data.

Cached reference content (often with a short expiry, such as about 7 days), session/auth tokens, onboarding flags, cookies, and similar on-device or in-browser storage for performance, security, and offline use.

App version, device/OS information, browser type, IP address, and HTTPS request metadata needed to operate the Services. Optional Apple crash/performance diagnostics if you enable Share App Analytics on iOS; comparable optional diagnostics on Android per your device and Google Play settings. Website analytics on cehalo.com is aggregated and non-advertising.

Text you voluntarily enter into AI assistant or search features may be sent to third-party AI processors (for example Perplexity AI and/or OpenAI) to generate a response. Never include PHI in AI prompts. Where required by Apple, Google, or applicable law, we disclose and obtain your permission before sharing personal data with a third-party AI provider.

Emails, contact-form submissions, and messages you send to info@cehalo.com or through cehalo.com are retained as reasonably needed to handle your request and maintain business records.

We apply reasonable administrative, technical, and physical safeguards appropriate to an educational and continuing education service that handles account, course, and subscription data — not a clinical PHI system. Measures include:

• HTTPS/TLS for all server communication
• Secure password hashing for email/password accounts (no plain-text password storage)
• Payment card data handled by Apple, Google, or our PCI-compliant payment processor only — not by CE HALO
• Access to production systems limited to personnel who need it for operations, support, and CE recordkeeping
• No third-party advertising SDKs and no cross-app advertising trackers in our iOS or Android apps
• Analytics practices configured to avoid unnecessary collection
• Vendor selection focused on providers that support industry-standard security practices (see the Privacy Policy for the current list, including Thinkific, RevenueCat, Stripe, and hosting/backend providers such as Base44 infrastructure where used)

No security measure is perfect. The Services are not warranted as a HIPAA-compliant or zero-risk environment. Do not use them to store or transmit PHI.

You are solely responsible for complying with:

• Your employer's and institution's policies on third-party apps, mobile devices, continuing education, and clinical settings
• Your professional licensing board rules and ethical obligations
• Applicable privacy, confidentiality, and data-protection laws in your jurisdiction (including HIPAA, state medical/nursing privacy laws, GDPR, UK GDPR, and CCPA/CPRA as applicable)
• Any prohibition on using unaffiliated apps on institution-issued devices or networks
• Any workplace policy on completing continuing education on employer time, devices, or accounts

If your workplace restricts or bans these Services in clinical areas or on institutional devices, follow those rules. Educational reference or CE use does not override institutional policy.

Because the Services are not designed to collect PHI, a security incident involving our systems should not expose patient health information unless a user improperly entered PHI contrary to this statement.

In the event of a security incident affecting personal data we do handle (for example account data, course/CE credit records, subscription-related identifiers, or AI prompt content we process), we will investigate and notify affected users and, where required, regulators, in accordance with applicable law. Notification may be provided in the app, on cehalo.com, and/or by email when we have a valid contact address.

Improper user entry of PHI does not convert the Services into a HIPAA service or create a business associate relationship.

You may request access to, correction of, or deletion of your account and course personal data as described in the Privacy Policy, including in-app account deletion where implemented, an equivalent web request path, or email to info@cehalo.com with subject line "Privacy Request."

Please note:

• CE credit records (name, credential, course, date, and credit hours) may be retained after account deletion for the period required by AANA, other accreditors, and applicable state boards, so you and auditors can verify your credit in the future. All other associated personal data will be deleted or de-identified.
• Deleting your app account does not automatically cancel an Apple or Google subscription. Manage subscriptions in iOS Settings or Google Play.
• Where GDPR, UK GDPR, CCPA/CPRA, or another comprehensive privacy law applies to you, additional rights (portability, restriction, objection, opt-out of "sale/share," and complaint to a supervisory authority) are described in the Privacy Policy.

DocumentWhat it coversPrivacy PolicyAccount and course data, subscriptions, third parties, retention, GDPR/CCPA and other rightsMedical DisclaimersEducational-only use, clinical judgment, no medical device claims, CE course scopeTerms of Use / EULALicense, acceptable use, accounts, payments, subscriptions, course accessThis statementPHI prohibition, HIPAA posture, clinical-setting and CE recordkeeping responsibilities

If documents conflict on a privacy detail, the Privacy Policy controls for data practices. If they conflict on clinical use, the Medical Disclaimers control. If they conflict on contract, licensing, or payment terms, the Terms of Use / EULA controls.

We may update this statement from time to time. The "Last updated" date will change when we do. Material changes may be surfaced in the apps, on cehalo.com, or by email to CE course participants. Continued use after an update constitutes acceptance, except where applicable law requires additional consent.

Questions about data protection or this HIPAA statement:

• Email: info@cehalo.com
• Website: https://cehalo.com
• Company: CE HALO LLC
• Location: Buffalo, New York, United States

By browsing or using any Service, creating an account, subscribing, enrolling in or purchasing a CE course, downloading a resource, or checking the "Data Protection & HIPAA" box on a Terms & Agreements screen in an app or on cehalo.com, you confirm that you understand and agree that:

• The Services are not HIPAA-compliant clinical systems
• The Services do not accept PHI and are not intended to receive PHI
• You will not enter patient-identifiable information into any feature of any Service
• You will follow your institution's rules on third-party app and CE use
• Account, course, and related non-PHI data are handled as described in the Privacy Policy
• CE credit records may be retained after account deletion as required by AANA, other accreditors, and applicable regulators

If you do not agree, do not use the Services.