Luna Solutions, LLC and its affiliate, 6over6 Vision Ltd., (hereinafter “Luna”, “we”, “us”, or “our”), and their affiliates offer an integrated suite of technologies and services to individuals (“End-Users”), eyewear retailers, brands and doctors (the “Customer(s)”).

There are a few different ways to interact with us. You may use our services while engaging with one of our Customers (for example, by taking an eye test offered as part of an online eyewear purchase), or you may engage with us directly, through our website at www.luna.io or mobile application where you may take certain optical exams. In each case, our role with respect to your personal data may differ. Please see Section 10 for more information on our different roles under data protection laws.

This Privacy Policy describes how we collect, store, use, and disclose personal data (as defined below) about End-Users who use one (or more) of the following services and products (“Solutions”):

myRx Refraction Exam - GoEyes app

myRx Lens Scanner

myRx PD Reader

Please note that this Privacy Policy does not apply to your use of our website. If you are a website visitor, please refer to our Website Privacy Policy at https://luna.io/trust/website-privacy-policy/.

Specifically, this Privacy Policy describes our practices regarding:

Data Collection & Processing	Communications
Data Uses	Data Security
Data Location	Data Subject Rights
Data Retention	Data Controller/Processor
Data Disclosure	Additional Notices
Cookies and Data Collection Technologies

Please read this Privacy Policy carefully and make sure that you fully understand and agree to it. If you do not agree to this Privacy Policy, please discontinue and avoid using our Solutions.

You are not legally required to provide us with any personal data (defined below) and may do so (or avoid doing so) at your own free will. If you do not wish to provide us with your data, or to have it processed by us or any of our services providers, please simply do not enter or interact with our Sites, nor use our Solutions. You may also choose not to provide us with “optional” personal data (when applicable), but please keep in mind that without it we may not be able to provide you with the full range of our Solutions or with the best user experience when using our Solutions.

1. Data Collection & Processing

When we use the term “personal data” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or deidentified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

The list below describes what categories of personal data we collect and process about End-Users through our Solutions.

Please note that in some cases, we may process personal data on behalf of a business partner or one of our Customers in according with their instructions and the data processing agreement we have in place with them. See Section 10 for more information on our different roles under data protection laws.

Account Data: There are certain Solutions in relation to which we are the data controller (as further detailed in Section 10). With these Solutions, we may collect first and last name, date of birth, address, email, phone number, and other basic contact details, as well as any other personal data the End-User chooses to provide when they create an account with a Solution, contact support, and/or in order for us to provide them with a prescription.

Optical Data: We may process corrective lenses parameters; lens analysis, lens power, eyes’ refraction error, and pupillary distance; your optical prescription; updated comprehensive eye exam and; personal data received through a personal eye health questionnaire; depth data (which is required to measure eyes’ distance and head angle in real-time);

Usage Data. When you install or use our Solutions, we will automatically collect or generate technical personal data about you. We collect or generate such Usage Data either independently or with the help of third-party services (as detailed in Section 4 below), including through the use of “cookies” and other data collection technologies (as further detailed in Section 5 below). Such Usage Data mainly consists of connectivity, technical and aggregated information, such as IP addresses, session ID, non-identifying data regarding a device (such as device type, screen resolution, etc), operating system, various apps usage statistics, browser version, locale and language settings used, general location (country), date and time stamp, and otherwise data collected by Cookies and other data collection technologies, as further explained in Section 6 below.

Facial Images: Our myRx PD Reader requires us to process frontal facial pictures (which are shrunk and obfuscated, and therefore do not allow the reidentification of any given individual in any way); and a "Calibration Image" (which is an image with a standard size such as plastic standard magnetic card to set as a reference object). Once the “Calibration Image” is identified within the image you have provided, we make reasonable efforts to apply an obfuscation process to avoid saving any recognizable details that may exist on the card “Calibration Image” on our systems. This “Calibration Image” will not be linked to you or any of your personal data;

2. Data Uses

When we process personal data as a data controller (as further explained in Section 10 below), we use it for the following purposes (and in reliance on the lawful bases for processing noted next to them, as appropriate):

To facilitate, operate, and provide our Solutions	Performance of Contract (to the extent applicable); Legitimate Interest; Consent (if special categories of personal data are processed);
To gain a better understanding on how individuals use and interact with our Solutions, and how we can improve their and others’ user experience and the value they can generate from using the Solutions, so we could continue improving our products, offerings, and the overall performance of our Solutions	Legitimate Interest (improving our services);
To contact our Customers or End-Users with general or personalized service-related messages, as well as promotional messages that may be of specific interest to them where permitted under applicable laws	Legitimate Interest (sending service-related messages); Consent (sending promotional messages);
To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error, or any illegal, criminal, or prohibited activity	Performance of Contract (to the extent applicable); Legitimate Interest (securing our data and services); Legal Obligation (implementing technical and organizational measures to protect data);
To create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which we use to improve our Solutions, or for any other purpose	Legitimate Interest (improving our services);
To enforce our Terms of Use, to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and right of third parties	Legitimate Interest (dispute resolutions);
To comply with our contractual and legal obligations and requirements, and maintain our compliance with applicable laws, regulations and standards	Performance of Contract (to the extent applicable); Legitimate Interest (maintaining compliance); Legal Obligation (to the extent applicable);
To provide our Customers and End-Users with assistance and support, to test and monitor the Solutions, or diagnose or fix technology problems	Performance of Contract (to the extent applicable); Legitimate Interest (ensuring the ongoing availability of our services);
To personalize our Solutions, including by recognizing an individual and remembering their information when they return to our Solutions, and to provide further localization and personalization capabilities	Performance of Contract (to the extent applicable); Legitimate Interest (providing a better user experience);

If you are using the Solutions in a territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for the Processing of personal data as described in this Privacy Policy (“Consent”), your acceptance of our Terms of Use and this Privacy Policy will be deemed as your Consent to the processing of your personal data for all purposes detailed in this Privacy Policy. If you wish to revoke such consent, please contact us at privacy@luna.io.

3. Data Location

Your personal data may be maintained, processed and stored by Luna and its Service Providers and Affiliates (as these terms are defined below in Sections 4 and 5) in the USA, Canada, the EEA, Israel and other jurisdictions, as necessary for the proper delivery of our Solutions, for support and maintenance, or as may be required by law.

While privacy laws may vary between jurisdictions, Luna, its Affiliates and Service Providers are each committed to protect personal data in accordance with this Privacy Policy and customary industry standards, regardless of any lesser legal requirements that may apply in their jurisdiction.

Luna’s authorized employees may have access to personal data originating from the EEA or UK for the purposes of support and maintenance from within the EEA and/or Israel, a jurisdiction considered by the European Commission and the UK Secretary of State to be offering an equally adequate level of protection to personal data as is granted in the EU and the UK, respectively. For data transfers from the EEA or UK to countries which are not considered to be offering an adequate level of data protection, we and the relevant data exporters and importers have entered into Standard Contractual Clauses as approved by the European Commission and UK ICO. You can obtain a copy by contacting us as indicated in Section ‎11 below.

4. Data Retention

Data Retention: We retain personal data for as long as a session has not been completed, and we have not been notified otherwise, or as long as we consider necessary for the purposes described herein.

Additionally, we will also retain personal data for as long as is required in order to comply with our legal and contractual obligations, or to protect ourselves from any potential disputes (i.e. as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), in accordance with our data retention policy.

Please note that except as required by applicable law, we will not be obligated to retain your personal data for any particular period, and we are free to securely delete it for any reason and at any time, with or without notice to you. If you have any questions about our data retention policy, please contact us at privacy@luna.io.

When we process such End-Users’ personal data as a data processor on behalf of a Customer, we will only retain it as instructed by the respective Customer through the Data Processing Addendum we have in place.

5. Data Disclosure

Legal Compliance: We may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that we are legally compelled to do so, or that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing.

Service Providers: We may engage selected Third-Party companies and individuals to perform services complementary to our own (e.g. hosting services, data analytics services, user engagement services, e-mail distribution and monitoring services, and our business, legal and financial advisors) (collectively, “Service Providers“). These Service Providers may have access to your personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Solutions, and may only use it for such purposes.

Our Partner ECP (Eye Care Professional): When you use myRx Refraction Exam, we will disclose your Optical Data to our partner ECP in order to provide you with an ECP-approved prescription. Each ECP used by us is authorized to receive your Optical Data and is instructed to process it only in accordance with our instructions.

Business Transactions: We may share your personal data with an approved business associate only for the purpose of allowing you to make business transactions upon your request (e.g. transferring your eye glasses parameters (using a standard SSL and HTTPS protocols) to an online retailer selected by you, for you to be able to purchase glasses).

Protecting Rights and Safety: We may share your personal data with others if we believe in good faith that this will help protect the rights, property or personal safety of Luna and its Affiliates, any of our End-Users, Customers or any members of the general public.

Our Group of Companies: We may disclose personal data internally within our group of companies which includes SeekWell Companies, Inc., 6over6 Vision Ltd., 1-800 Contacts Inc. and Hello Eyes Services, ULC, (each an “Affiliate”) for the purposes described in this Privacy Policy. In addition, should any Affiliate undergo any change in control, including by means of merger, acquisition or purchase of substantially all of its assets, your personal data may be shared with the parties involved in such event. If we believe that such change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via e-mail or prominent notice on the respective Solution or via our website at www.luna.io.

Other: For the avoidance of doubt, we may share your personal data in additional manners, pursuant to your explicit approval, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal and anonymous. We may transfer, share or otherwise use non-personal data at our sole discretion and without the need for further approval.

6. Cookies and Data Collection Technologies

We and our Service Providers use cookies and other technologies for performance, tracking analytics, and personalization purposes. We may share non-identifiable or aggregated extracts of such information with our partners or Service Providers for our legitimate business purposes.

Cookies are packets of information sent to your web browser and then sent back by the browser each time it accesses the server that sent the cookie. Some cookies are removed when you close your browser session. These are the “Session Cookies”. Some last for longer periods and are called “Persistent Cookies”. We use both types.

To learn more about our cookies and data collection technologies practices, please see our Cookie Policy.

7. Communications

Service Communications: We may contact you with important information regarding our Solutions. For example, we may notify you (through any of the means available to us) of changes or updates to our Solutions, reports, service changes, etc. We may also send you notifications, messages and other updates. Typically, you will not be able to opt-out of receiving such service communications while using our Solutions, as they are integral to such use.

Notifications and Promotional Communications: We may send you notifications concerning messages and other updates in your account. We may also send you notifications about new features, offerings, events and special opportunities or any other information we think our End-Users will find valuable. We may provide such notices through any of the contact means available to us (e.g. phone, push notifications or e-mail), through the Solutions, or through our marketing campaigns on any other sites or platforms.

If you do not wish to receive such promotional communications, you may notify us at any time by sending an e-mail to privacy@luna.io, or by following the “unsubscribe”, “stop”, “opt-out” or “change e-mail preferences” instructions contained in the promotional communications you receive.

8. Data Security

In order to protect your personal data held with us and our Service Providers, we are using industry-standard physical, procedural and electronic security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any Third Parties as described in Section 4 above.

9. Data Subject Rights

Individuals have rights concerning their personal data. Please contact us by email at: privacy@luna.io if you wish to exercise your privacy rights under any applicable law, including the EU or UK General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), such as – to the extent applicable – the right to know/request access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request rectification or erasure of your personal data held with Luna, or to restrict or object to such personal data’s processing (including the right to direct us not to sell your personal data to third parties now or in the future), or to port such personal data, or the right to equal services and prices (e.g. freedom from discrimination) (each to the extent available to you under the laws which apply to you). If you are a GDPR-protected individual, you also have the right to lodge a complaint with the relevant supervisory authority in the EU or the UK, as applicable.

Please note that when you ask us to exercise any of your rights under this policy or applicable law, we may need to ask you to provide us certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of personal data related to others and to ask you to provide further information to better understand the nature and scope of data that you request to access. Such additional data will be then retained by us for legal purposes (e.g., as proof of the identity of the person submitting the request). We may redact from the data which we will make available to you, any personal data related to others. If you are a GDPR-protected individual, you also have the right to lodge a complaint with an EU supervisory authority.

10. Data Controller/Processor

Data protection laws and regulations typically distinguish between two main roles for parties who process personal data: the “Controller”/”Business”, and the “Processor”/”Service Provider” (as such terms are defined in the GDPR and CCPA, respectively). The Controller determines the purposes and means of the personal data processing, and the Processor processes the data on behalf of the Controller.

We will always be the Controller of Account Data when collected, and Usage Data. However, depending on the nature of your engagement with our Solutions, we may be either the Controller or Processor of the other categories of your personal data enumerated in Section 1 (i.e., your Optical Data or Facial Images).

When you use our Solutions as part of another company’s services, i.e. when you are not directly engaging with us, we will be the Processor of your personal data, and the company you are engaging with directly is the Controller.

The following chart describes our typical role in relation to the categories of personal data we process.

Solution	Controller/Processor
myRx Refraction Exam	Controller of Account Data; Optical Data, Facial Image (Calibration Image) & Usage Data
myRx PD Reader	Controller of Account Data and Usage Data. Processor of Facial Images, Optical Data & Usage Data
myRx Lens Scanner	Controller of Account Data, and Usage Data Processor of Optical Data

Accordingly, if you would like to make any requests or inquiries regarding personal data we process on our Customer’s behalf (i.e. where we are the Processor and our Customer is the Controller over the personal data in question), please contact such Customer directly. 

Please note that if you engage with us directly, then we are the Controller of the personal data processed through the Solution(s). In addition, when you receive services from any of our Affiliates (as defined in Section 5 above), such Affiliates may process your personal data in accordance with their privacy policies as data controllers. See the 1-800 Contacts privacy policy and the hello:eyes privacy policy for more information on their privacy practices.

11. Additional Notices

Updates and Amendments: We may update and amend this Privacy Policy from time to time by posting an amended version on our Solutions or website at www.luna.io. The amended version will be effective as of the date it is so published. We will provide a 10-day prior notice if we believe any substantial changes are involved via any of the communication means available to us or via the Solutions. After such notice period, all amendments shall be deemed accepted by you.

External Links: While our Solutions may contain links to other websites or services, we are not responsible for their privacy practices, and encourage you to pay attention when you leave our Solutions for the website or application of such third parties and to read the privacy policies of each and every website and service you visit. This Policy applies only to our Solutions.

Children Privacy: Our Solutions are intended for people over the age of 16. We do not knowingly collect information from children under 16. If we learn that a person under the age of 16 is using the Solutions we will prohibit and block such use and delete any personal data stored with us with regards to such child. If you believe that we might have any such data, please contact us by email at privacy@luna.io.

Questions, Concerns or Complaints: If you have any comments or questions about this Privacy Policy or if you have any concerns regarding your personal data, please contact us by email at privacy@luna.io. 

EU & UK Representative: Prighter has been designated as Luna’s representative in the European Union and the UK for data protection matters pursuant to the GDPR or UK GDPR, as applicable. Prighter may be contacted only on matters related to the processing of personal data. To make such an inquiry, please send an email to privacy@luna.io or visit https://prighter.com/q/15084591.

Data Protection Officer (DPO): Data Protection Officer (DPO): Luna has appointed PrivacyTeam as its Data Protection Officer (DPO), for monitoring and advising on ongoing privacy compliance and serving as a point of contact on privacy matters for data subjects and supervisory authorities. If you have any concerns regarding your privacy, or if you wish to make a complaint about how your personal data is being processed, you can contact privacy@luna.io.

Luna.io Solutions Privacy Policy