Consumer Health Data Privacy Policy

Last Updated: October 24, 2026

1. Introduction and Scope

This Consumer Health Data Privacy Policy (“CHD Policy”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) and provides the specific disclosures required for “consumer health data” under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act, and similar state laws, for the consumers those laws protect.

It supplements, and should be read together with, the MIRRI One Privacy Policy and Terms of Service. It applies to MIRRI One, our diabetes and metabolic health management app for Apple iOS and Android (the “App”), including Mirri Cloud and Offline Sharing when you use them in the App. Mirri Cloud also has its own Consumer Health Data Privacy Policy. If anything in this CHD Policy conflicts with the MIRRI One Privacy Policy regarding consumer health data, this CHD Policy controls as to that data, except that our U.S. State Health Privacy Notice controls for residents of the states it names.

“Consumer health data” means personal information that identifies your past, present, or future physical or mental health status — here, the diabetes- and metabolic-health-related information you record in, or authorize the App to access.

Mirri is a consumer app and is not a HIPAA covered entity or business associate. This CHD Policy addresses consumer-health-privacy laws, not HIPAA.

2. Categories of Consumer Health Data We Collect

• The health information you log, such as glucose values, insulin doses, medications, meals, foods and carbohydrates, physical activity, supplies, symptoms, cycle information, and notes.
• The health-platform categories you authorize the App to read (such as glucose, insulin, carbohydrates, activity, sleep, and cycle information) from Apple HealthKit (on iOS) or Android Health Connect (on Android).
• Information about your health conditions and care that you choose to record or share.

We collect only the categories you provide or authorize. If you turn on Mirri Cloud, the App seals this information on your device before uploading it, our servers hold no key that can open it, and we can read only routing information about each entry (such as its kind, times, and time zone) and your record’s display name; your notes, photos, conversations with Iris, and cycle or other reproductive-health information are never uploaded. Offline Sharing goes from your screen to another device in person and never reaches us. We do not use geolocation to infer health conditions.

3. Sources of Consumer Health Data

• You — the information you enter into the App.
• Your device’s health platform — Apple HealthKit or Android Health Connect, only with your permission and only for the categories you authorize.
• Your use of the App — for example, your Mirri Cloud sharing settings and delivery status.

4. Purposes for Collecting and Using Consumer Health Data

• To provide the App’s diabetes- and metabolic-health-management features.
• If you turn on Mirri Cloud, to keep your record in sync between your devices and make it available to the Followers you choose.
• To operate, secure, and support the App and respond to your requests.

We do not use your consumer health data for advertising or data mining, and we do not use it for any research or other secondary purpose except with your separate, explicit permission.

5. How We Share Consumer Health Data

We share consumer health data only:

• With the Followers you choose through Mirri Cloud — for example, family members or caregivers — for the kinds of information you allow each of them; cycle and other reproductive-health information is never uploaded to Mirri Cloud, so it cannot be shared through it. You choose your Followers; they are not vetted, controlled, or supervised by Mirri, and once a Follower has opened information we cannot recall or control it.
• With our service providers — such as our cloud hosting provider, which stores your entries only in sealed form, and Cloudflare, which carries requests to it — who process data on our behalf under contracts that require them to protect it and use it only to provide services to us.

We do not share consumer health data with any other third parties, we have no affiliates that receive it, and we do not sell consumer health data. We do not allow third parties to collect consumer health data about your online activities over time and across different websites or online services through the App, and we use no analytics, advertising, or tracking tools.

6. Consent and Authorization

We collect and process your consumer health data only with your affirmative, opt-in consent where required. Turning on Mirri Cloud is a separate choice, and sharing with each Follower is a further, separate choice that you make when you invite and confirm that Follower. These consents are presented as clear, unbundled choices in the App and are not bundled into your acceptance of our Terms of Service. You may withdraw your consent at any time (see Section 8); withdrawal stops future collection or sharing that depended on that consent.

We do not sell consumer health data. We would not do so without first obtaining a separate, valid written authorization from you that contains all of the elements required by applicable law.

7. No Geofencing

We do not use a geofence to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements based on your proximity to any health-care facility, provider, or other location that could indicate an attempt to receive health-care services.

8. Your Rights

Subject to applicable law, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of all third parties and affiliates with which we have shared or sold it, with an email address or other online way to contact each of them.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data, and have us notify our service providers that received it to delete it.
• Appeal a decision we make about your request.

We will not discriminate against you for exercising these rights.

How to exercise them. Contact us at support@mirridiabetes.com, or delete your Mirri Cloud data in the App (open the Menu, then Mirri Cloud, then Settings, then Delete & close account) or at cloud.mirridiabetes.com/delete-my-data. We will confirm receipt within 10 days and respond within 45 days (extendable once by an additional 45 days with notice). We take reasonable steps to verify your identity before acting and accept requests from authorized agents with proof of authorization. If we deny your request, you may appeal by replying to our decision or contacting support@mirridiabetes.com; if your appeal is denied, you may contact your state Attorney General.

State-specific disclosures. Our U.S. State Health Privacy Notice gives the additional disclosures for Washington, Nevada, Connecticut, and other states, including when deletion is complete (a Mirri Cloud deletion you start yourself usually runs 24 hours after you ask; a request is always completed within 30 days of verifying it), and the Attorneys General you may contact if we deny an appeal.

9. Retention of Consumer Health Data

We retain consumer health data only for as long as needed to provide the features you use and as required for legal, security, and record-keeping purposes. Health information you log remains on your device until you delete it or uninstall the App. If you turn on Mirri Cloud, your sealed entries are kept while your record exists; when you delete your record, the deletion runs 24 hours after you ask, destroys the record’s keys, and removes its entries and Followers’ access, and copies in our hosting provider’s routine backups keep the entries sealed and expire, with everything else they hold, within 30 days. Information a Follower has already opened cannot be recalled.

10. Security

We use administrative, technical, and physical safeguards designed to protect consumer health data, including sealing entries on your device before Mirri Cloud uploads them, encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting your health information occurs, we will provide notice as required by law, including the FTC Health Breach Notification Rule and applicable state laws.

11. Changes to This CHD Policy

We may update this CHD Policy from time to time. We will revise the “Last Updated” date and, for material changes affecting how we collect, use, or share consumer health data, obtain your fresh, affirmative opt-in consent before the change applies to you.

12. Legal Process and Government Requests

Legal process and government requests. We disclose information only when valid legal process (such as a subpoena, court order, or search warrant) requires it, or when the law otherwise requires us to. We cannot produce the contents of your entries, because we hold no key that opens them. We review every request for scope and validity, we object to requests that are overbroad or that seek more than the law requires, and we provide only what the request lawfully requires. Unless we are legally prohibited from doing so, we tell you about a request for your information before we respond, so that you can object. We do not voluntarily disclose information to any government body, and we treat requests concerning reproductive or sexual health exactly as we treat every other request. If we receive a request, we record it in our security log.

13. Contact Us

For questions about this Consumer Health Data Privacy Policy, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com