Consumer Health Data Privacy Policy

Last Updated: July 20, 2026

1. Introduction and Scope

This Consumer Health Data Privacy Policy (“CHD Policy”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) and provides the specific disclosures required for “consumer health data” under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act, and similar state laws, for the consumers those laws protect.

It supplements, and should be read together with, our general Privacy Policy and Terms of Service. It applies to our diabetes and metabolic health management applications, including Mirri One (for Type 1 diabetes) and Mirri Navigator (for general metabolic health and Type 2 diabetes), on Apple iOS and Android (each, an “App”). If anything in this CHD Policy conflicts with our general Privacy Policy regarding consumer health data, this CHD Policy controls as to that data.

“Consumer health data” means personal information that identifies your past, present, or future physical or mental health status — here, the diabetes- and metabolic-health-related information you record in, or authorize an App to access.

Mirri is a consumer app and is not a HIPAA covered entity or business associate. This CHD Policy addresses consumer-health-privacy laws, not HIPAA.

2. Categories of Consumer Health Data We Collect

• The health information you log, such as glucose values, insulin doses, medications, meals and carbohydrates, physical activity, symptoms, and notes.
• The health-platform categories you authorize an App to read (such as glucose, insulin, medications, meals/carbohydrates, and activity) from Apple HealthKit (on iOS) or Android Health Connect or Google Fit (on Android).
• Information about your health conditions and care that you choose to record or share.

We collect only the categories you provide or authorize. We do not use geolocation to infer health conditions.

3. Sources of Consumer Health Data

• You — the information you enter into an App.
• Your device’s health platform — Apple HealthKit or Android Health Connect (or Google Fit), only with your permission and only for the categories you authorize.
• Your interactions with the App — for example, your sharing settings and delivery status.

4. Purposes for Collecting and Using Consumer Health Data

• To provide the diabetes- and metabolic-health-management features of the Apps that you use.
• If you enable the optional Sharing feature, to deliver the health information you choose to the recipients you select.
• To operate, secure, and support the Apps and respond to your requests.

We do not use your consumer health data for advertising or data mining, and we do not use it for any research or other secondary purpose except with your separate, explicit permission.

5. How We Share Consumer Health Data

We share consumer health data only:

• With recipients you designate through the optional Sharing feature — for example, family members, caregivers, or your healthcare providers or care team. You choose these recipients; they are not vetted, controlled, or supervised by Mirri, and once information is delivered to a recipient we cannot recall or control it.
• With our service providers — such as cloud hosting and infrastructure providers — who process data on our behalf under contracts that require them to protect it and use it only to provide services to us.

We do not share consumer health data with any other third parties or affiliates, and we do not sell consumer health data.

6. Consent and Authorization

We collect and process your consumer health data only with your affirmative, opt-in consent where required, and we obtain a separate consent before we share it through the Sharing feature. These consents are presented as clear, unbundled choices in the App and are not bundled into your acceptance of our Terms of Service. You may withdraw your consent at any time (see Section 8); withdrawal stops future collection or sharing that depended on that consent.

We do not sell consumer health data. We would not do so without first obtaining a separate, valid written authorization from you that contains all of the elements required by applicable law.

7. No Geofencing

We do not use a geofence to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements based on your proximity to any health-care facility, provider, or other location that could indicate an attempt to receive health-care services.

8. Your Rights

Subject to applicable law, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data, and have us notify our service providers that received it to delete it.
• Appeal a decision we make about your request.

We will not discriminate against you for exercising these rights.

How to exercise them. Contact us at support@mirridiabetes.com or use the in-app request option. We will confirm receipt within 10 days and respond within 45 days (extendable once by an additional 45 days with notice). We take reasonable steps to verify your identity before acting and accept requests from authorized agents with proof of authorization. If we deny your request, you may appeal by replying to our decision or contacting support@mirridiabetes.com; if your appeal is denied, you may contact your state Attorney General.

9. Retention of Consumer Health Data

We retain consumer health data only for as long as needed to provide the features you use and as required for legal, security, and record-keeping purposes. Health information you log remains on your device until you delete it or uninstall the App. When you enable Sharing, encrypted copies of shared information on our servers are deleted within 30 days after delivery or after you disable Sharing or revoke a recipient, and are purged from routine backups within 90 days. Information already delivered to a recipient cannot be recalled.

10. Security

We use administrative, technical, and physical safeguards designed to protect consumer health data, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting your health information occurs, we will provide notice as required by law, including the FTC Health Breach Notification Rule and applicable state laws.

11. Changes to This CHD Policy

We may update this CHD Policy from time to time. We will revise the “Last Updated” date and, for material changes affecting how we collect, use, or share consumer health data, obtain your fresh, affirmative opt-in consent before the change applies to you.

12. Contact Us

For questions about this Consumer Health Data Privacy Policy, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com