Clinical Governance Statement

2. Therapist Vetting and Onboarding

All therapists admitted to the Platform are subject to a structured verification process before their profile becomes visible to patients. This process includes:

• Accreditation verification: Confirmation of current registration with a recognised professional body (BACP, UKCP, HCPC, BPS, or NCS), verified directly against the relevant body's public register
• Professional indemnity insurance: Confirmation that the therapist holds valid professional indemnity insurance at an appropriate level before commencement
• Identity verification: Identity is verified during the registration process
• DBS check: Therapists are required to hold and maintain appropriate DBS clearance where required by their professional body or clinical specialism
• Profile review: Therapist profiles are reviewed by Lumina staff before activation to ensure accuracy and compliance with platform standards

Therapists whose accreditation lapses, whose insurance expires, or who are suspended by a professional regulatory body are removed from the Platform upon discovery, with no new bookings permitted during any investigation period.

3. Ongoing Quality Assurance

Lumina maintains the following ongoing quality assurance mechanisms:

• Complaints monitoring: All complaints relating to therapist conduct are logged, investigated, and where appropriate, referred to the relevant professional body. Trends are reviewed periodically to identify systemic issues
• Patient feedback: Post-session feedback is collected from patients and monitored for patterns that may indicate quality or safety concerns
• Accreditation renewal reminders: Therapists are reminded to update their accreditation and insurance details annually, and Lumina reserves the right to verify these independently
• Profile review: Therapist profiles are subject to periodic review to ensure accuracy and continued compliance with platform standards
• Safeguarding referrals: All safeguarding concerns are handled by our Designated Safeguarding Lead and documented in accordance with our Safeguarding & Crisis Policy

4. Adverse Event and Incident Reporting

Lumina maintains an internal incident log for adverse events and near-misses relating to Platform operations and patient safety. This includes safeguarding concerns, platform security incidents, data breaches, and complaints alleging harm. Significant incidents are reviewed by senior leadership and acted upon promptly.

Where an incident involves a data breach, reporting obligations under UK GDPR are followed (notification to the ICO within 72 hours where required, and notification to affected individuals where applicable). Where an incident raises safeguarding concerns, our safeguarding protocols are activated.

Independent therapists are responsible for reporting clinical incidents and adverse events to their own professional body and, where applicable, to relevant authorities in accordance with their professional obligations.

5. Lumi AI Governance

Lumi is an AI-powered wellbeing support and therapist matching tool. Lumina maintains the following governance controls for Lumi:

• Lumi is clearly presented to users as an AI tool, not a human therapist or clinical service
• Lumi does not provide clinical diagnoses, treatment plans, or prescriptions
• Lumi includes built-in crisis signposting — where a user indicates distress or crisis, Lumi directs them to emergency services and crisis resources
• Lumi conversation data is not shared with therapists or third parties (other than OpenAI as sub-processor) without the user's consent
• Lumi is subject to periodic review of its outputs for quality, safety, and appropriateness
• A daily usage limit applies to prevent over-reliance

Lumi operates under Lumina's AI usage policy and is not used as a replacement for professional mental health care.

6. Data Protection and Information Governance

Lumina's information governance framework is described in our Privacy Policy and Data Processing Agreement. Key elements include:

• Compliance with UK GDPR and the Data Protection Act 2018
• Data Protection Impact Assessment (DPIA) completed for health data processing and telehealth
• Role-based access controls restricting access to patient data
• Encryption in transit and at rest
• Audit logging of access to sensitive data
• Transfer Risk Assessments for international data transfers
• ICO registration (registration number available on request)

7. Enterprise and NHS Procurement

Organisations, NHS trusts, or commissioners considering working with Lumina Care Therapy are welcome to request additional governance documentation including:

• Data Security and Protection (DSP) Toolkit alignment summary
• DPIA summary documentation
• Transfer Risk Assessment summaries
• Penetration testing and security assurance documentation (available under NDA)
• Sub-processor due diligence information
• Enterprise Data Processing Agreement
• Evidence of therapist accreditation verification processes

Please contact us at info@luminacaretherapy.co.uk to request any of the above or to discuss your organisation's specific due diligence requirements.

8. Review and Oversight

This Clinical Governance Statement is reviewed at least annually by Lumina's senior leadership and updated whenever there are material changes to our platform, services, or regulatory environment. Next review due: April 2027.

Questions about clinical governance should be directed to info@luminacaretherapy.co.uk.