Privacy Policy

Last Updated: October 24, 2026

1. Introduction

Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) develops and operates MIRRI One, a diabetes and metabolic health management app for Apple iOS and Android, together with related services (the “App”). This Privacy Policy explains what information the App handles, what stays on your device, and what happens when you use the App’s two optional ways to share: Mirri Cloud, which keeps your record in sync between your devices and lets the people you choose follow it, and Offline Sharing, which shows your data from your screen to another device in person.

This Privacy Policy replaces all prior versions. The App offers Mirri Cloud, an optional, opt-in service that, when you turn it on, seals your health information on your device and uploads it to our servers in that sealed form, so that it stays in sync between your devices and can be read by the Followers you choose. We hold no key that can open it. Nothing is uploaded to our servers until you turn Mirri Cloud on. If you do not turn it on, the App keeps your health information on your device as described below.

Please read this Privacy Policy together with our Terms of Service. If you use Mirri Cloud, the Mirri Cloud Privacy Policy describes it in full.

2. About This Policy; Our Role; HIPAA

The App is a consumer app intended to help you record, understand, and — at your option — share diabetes- and metabolic-health-related information (covering type 1 diabetes, type 2 diabetes, and general metabolic health) (“health information” or “Health Data”). Some users refer to this as “personal health information” or “PHI”; we use those terms descriptively only.

Mirri is a consumer app and is not a HIPAA covered entity or business associate, and HIPAA does not govern the App. We provide the App to you as an individual. If you choose to share information with a healthcare provider, you do so as an individual directing the disclosure of your own information; we do not act on behalf of, or under contract with, any provider.

Your health information is sensitive, and we handle it in accordance with this Policy and applicable privacy laws, including the Federal Trade Commission’s Health Breach Notification Rule; the Washington My Health My Data Act; the Nevada Consumer Health Data Privacy Law; the Connecticut Data Privacy Act; the Indiana Consumer Data Protection Act; the California Consumer Privacy Act (as amended by the California Privacy Rights Act); and similar state laws, where they apply to you.

3. Consent

Where required by law, we obtain your affirmative, opt-in consent before we collect or process your health information. Turning on Mirri Cloud is a separate choice, made in the App, before any of your health information is uploaded. Sharing your record with each Follower is a further, separate choice that you make when you invite and confirm that Follower and choose what they may read. These consents are requested through clear, unbundled choices in the App — not merely by your acceptance of our Terms of Service — and you can withdraw your consent at any time (see Section 12). Withdrawing consent stops future collection or sharing that depended on it, and we will act on your withdrawal as described in Sections 6 and 11.

4. Information We Handle

a. Health information from your device’s health platform. With your permission, and only for the types you authorize, the App reads health data from your device’s health platform. From Apple Health (HealthKit) on iOS: blood glucose; insulin delivery; carbohydrates, dietary energy, protein, fats, sugar, fiber, sodium, potassium, and cholesterol; alcohol and caffeine; steps, distance, flights climbed, exercise time, active energy, and workouts; heart rate, resting heart rate, heart-rate variability, and respiratory rate; VO2 max, body temperature, body mass, and body fat percentage; sleep; mindful sessions; and menstrual flow and spotting. From Android Health Connect: blood glucose, heart rate, exercise, active calories burned, steps, sleep, menstruation, and intermenstrual bleeding. With your permission, the App writes insulin doses, carbohydrates, and glucose readings you import to Apple Health, and nutrition to Health Connect. You can change or revoke these permissions at any time in the Apple Health app (iOS) or in Android Health Connect or your device settings (Android).

b. Information you log. You can enter information such as glucose values, insulin doses, medications, meals, foods and carbohydrates, physical activity, supplies, symptoms, notes, and photos of meals. You can also ask Iris, the App’s assistant, questions; Iris answers on your device.

c. Account information. To use Mirri Cloud, you create an account with your email address (and, if you give one, a display name) and sign in with a one-time code we send to your email address. When you create your record, the App sends a display name for it. Each Follower uses their own Mirri Cloud account; you invite them with a single-use invitation (a QR code, a link, or a set of words), so we do not need their contact details from you.

d. Routing and technical information. When you use Mirri Cloud, our servers can read “routing information” needed to store and deliver your sealed entries — such as which record an entry belongs to, its kind (for example, “glucose”), the times it covers and its time zone, the device that wrote it, your Followers and what each may read, and delivery status — but not the values you recorded. Our servers also keep your devices’ labels and push tokens, and a security log that contains no health content. We use IP addresses only for rate limiting and security, and we do not use them to track your location. We may also receive limited technical and diagnostic information that Apple or Google make available to us through their standard app-store and developer tools, such as crash reports and app-performance figures. The App itself includes no analytics, advertising, or crash-reporting software. On Android, Google’s ML Kit libraries, which the App runs on your device to scan barcodes and read food labels and photos, may send Google information about how those libraries perform.

e. Age. Before you set up Mirri Cloud, the App asks for your birth year. The year stays on your device and is not sent to us.

5. How Your Information Is Stored

On your device (default). By default, the health information you log and the health-platform data you authorize remain on your device. If you never turn on Mirri Cloud, your health information is not uploaded to our servers.

On our servers (only when you turn on Mirri Cloud). When you turn on Mirri Cloud, the App seals your health information on your device and uploads it to our servers in that sealed form, as described in Sections 6 and 7. It uploads the kinds of information it syncs whether or not anyone follows your record yet; you choose which kinds each Follower may read. Your notes, your photos, your conversations with Iris, and your cycle and other reproductive-health information are not uploaded.

6. Sharing Your Health Information

Sharing is off by default and is entirely opt-in. You decide whether to share, what to share, and with whom, and you provide separate opt-in consent (Section 3) before sharing begins. If you do not share, this Section does not apply to you.

Mirri Cloud. When Mirri Cloud is on, you can let Followers read your record. A Follower is a person with their own Mirri Cloud account, such as a family member, a caregiver, or someone helping you understand your data, who reads your record in the App or on the Mirri Cloud website. You confirm each Follower, choose which kinds of information each of them may read, and can change or end their access at any time in the App. Cycle and other reproductive-health information is never uploaded to Mirri Cloud, so it cannot be shared through it; Offline Sharing can show it, only when you choose its Cycle option, in person. On a Follower’s phone, the App can show reminders and Lock Screen widgets about the followed person’s recent doses, such as when a prebolus time has passed; that phone makes them from the entries it opened.

Offline Sharing. Offline Sharing shows the days and kinds of information you choose, sealed, from your screen to another device in person — for example, a browser on the Mirri Cloud website or another phone — through that device’s camera. It does not use our servers, and nothing about it is sent to us. The receiving screen shows a one-time code first, and the App seals your days to that code, which is designed so that people who see or film the screens cannot read them.

Who you share with. Followers and the people you show your days to are chosen by you and are not vetted, controlled, or supervised by Mirri.

Ending sharing. When you end a Follower’s access, they can no longer read your record. Information a Follower has already opened — including the short-term copy, for up to 72 hours, that the App keeps of a followed person’s data on a Follower’s phone — and anything a Follower or the person you showed your days to has saved, written down, or photographed cannot be recalled, deleted, or controlled by us, and remains subject to that person’s own practices.

Not an alert system. As explained in our Terms of Service, Mirri Cloud and Offline Sharing are not a medical alert, monitoring, or emergency-notification system, and information may be delayed, incomplete, or undelivered. Do not rely on them for urgent or safety-critical purposes.

We do not sell your health information, and we do not use it for advertising (see Section 14).

7. How Mirri Cloud Handles Your Information

When you turn on Mirri Cloud, we handle your health information as follows:

• Sealed on your device. The App seals each entry on your device before it is uploaded. Our servers store the sealed entry and hold no key that can open it, and neither our staff nor our service providers have such a key. Your record’s keys stay on your devices, and copies of them are stored only in forms that your devices, a passphrase or passkey you set up, or your Recovery Code can open. On iPhone, the App also saves your Recovery Code in your iCloud Keychain, so anyone who can sign in to your Apple Account on a device that knows your passcode could use it.
• Opened only on approved devices. Mirri Cloud is designed so that entries are opened only on your own devices and on the devices of the Followers you approve, never on our servers.
• What our servers can read. Our servers can read the routing information described in Section 4(d), which can show that a kind of information was recorded at a certain time, but not the value that was recorded. The App does not send your cycle or other reproductive-health information to Mirri Cloud.
• If you lose your keys. If you lose every device that can open your record and your Recovery Code, no one can open your entries, including us.

No method of encryption, transmission, or storage is completely secure, and we do not guarantee that our security measures cannot be circumvented or that security will never fail. See Section 9 and the Mirri Cloud Privacy Policy.

8. Platform Health Data (Apple HealthKit and Android Health Connect)

If you grant the App access to your device’s health platform, we handle that data in accordance with the platform’s requirements and this Policy:

• We access platform health data only with your permission and only for the categories you authorize.
• We use it solely to provide the health-management features you request and, if you turn it on, Mirri Cloud.
• We do not use platform health data for advertising, marketing, or data-mining purposes, and we do not sell it.
• We do not share it with third parties except as you direct through Mirri Cloud, Offline Sharing, or the connections and voice assistants you choose to use (Section 15), or with service providers who process it on our behalf to operate the App.
• We do not use it for any research or other secondary purpose except with your separate, explicit permission and only as the platform permits.
• We handle Apple HealthKit data in accordance with Apple’s requirements, and Android Health Connect data in accordance with Google’s Health Connect permissions and applicable data-use requirements.
• You can revoke the App’s access at any time in the Apple Health app (iOS) or in Android Health Connect or your device settings (Android).

9. Security

We use administrative, technical, and physical safeguards designed to protect your information, including sealing health information on your device before Mirri Cloud uploads it, encryption in transit, access controls, and monitoring. These safeguards are designed to protect your information but are not a guarantee; no application, server, or transmission method is 100% secure, and we do not warrant that our safeguards will prevent every incident.

10. Data Breach Notification

If a breach of the security of your health information occurs — including any acquisition, access, use, or disclosure of your information without your authorization — we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, and we will notify the Federal Trade Commission, prominent media (where required by the number of affected residents), and applicable state authorities (including the Indiana Attorney General), as required by law, including the FTC Health Breach Notification Rule and applicable state breach-notification and consumer-health-privacy laws. Our notice will describe, to the extent required, what happened and when, the categories of information involved, the name of any third party that acquired the information (if known), steps you can take, what we are doing in response, and how to contact us.

11. Data Retention and Deletion

We retain your information only for as long as needed to provide the App and the features you use, and as required for legal, security, and record-keeping purposes.

• Information stored on your device remains until you delete it or uninstall the App.
• Sealed entries in Mirri Cloud are kept while your record exists. When you delete your record, the deletion runs 24 hours after you ask (you can cancel it until then), destroys the record’s keys, and removes its entries and Followers’ access; copies in our hosting provider’s routine backups keep the entries sealed and expire, with everything else they hold, within 30 days.
• When you close your Mirri Cloud account, closing runs 24 hours after you ask, or at once if you choose to delete now; your sign-in account, with its email address, is erased within about an hour.
• After a deletion, we keep a record that it was requested and carried out, with its times and the identifiers needed to show it; it contains no health content. Security records are kept for as long as needed to secure the service and show that requests were carried out.
• To delete your Mirri Cloud data, open the Menu in the App, then Mirri Cloud, then Settings, then Delete & close account, or go to cloud.mirridiabetes.com/delete-my-data. The Mirri Cloud Privacy Policy describes retention and deletion in full.
• Information a Follower has already opened, or that someone you showed your days to has kept, cannot be recalled.

12. Your Privacy Rights and Choices

Managing the App. You can control health-platform permissions in the Apple Health app (iOS) or in Android Health Connect or your device settings (Android); turn on Mirri Cloud; choose and remove Followers and what each may read; delete your Mirri Cloud record or close your account; choose what to show by Offline Sharing; and delete information you have logged.

Your rights. Depending on where you live, you may have the right to: confirm whether we process your information and access it; correct it; delete it; obtain a portable copy; withdraw consent to processing of your health information; opt out of any sale, sharing for targeted advertising, or certain profiling; limit the use of sensitive personal information; and appeal a decision we make about your request. We do not discriminate against you for exercising these rights. Because we cannot open your sealed entries, we cannot give you a readable copy of them; you can read them in the App and on the Mirri Cloud website on your own devices, and we can give you the other information we hold about you.

How to exercise them. Contact us at support@mirridiabetes.com, or delete your Mirri Cloud data as described in Section 11. We will confirm receipt within 10 days and respond within 45 days (extendable once by an additional 45 days with notice). We take reasonable steps to verify your identity before acting, and we accept requests from authorized agents with proof of authorization. If we deny your request, you may appeal by replying to our decision or contacting support@mirridiabetes.com; if your appeal is denied, you may contact your state Attorney General.

Opt-out preference signals. We honor the Global Privacy Control (GPC) and other recognized opt-out preference signals where required by law.

State privacy rights. Residents of Washington, Nevada, Connecticut, California, Virginia, Texas, Indiana, and other states should also read our U.S. State Health Privacy Notice, which gives additional disclosures and rights for health information in those and other states, and which we apply to everyone in the United States.

13. Consumer Health Data (Washington My Health My Data Act and Similar Laws)

This Section provides the disclosures required for “consumer health data” under the Washington My Health My Data Act and similar state laws, and applies to the consumers those laws protect. We also publish these disclosures as a standalone Consumer Health Data Privacy Policy, which we link from our homepage and within the App.

• Categories of consumer health data we collect: the health information you log and the health-platform categories you authorize (such as glucose, insulin, medications, meals, foods and carbohydrates, activity, sleep, and cycle information), and information about your health conditions and care that you choose to record or share. If you turn on Mirri Cloud, we hold these in sealed form, together with routing information about them.
• Sources: you (information you enter); your device’s health platform (Apple HealthKit or Android Health Connect, with your permission); and your use of the App.
• Purposes: to provide the App’s diabetes- and metabolic-health-management features and, if you turn on Mirri Cloud, to keep your record in sync and make it available to the Followers you choose.
• Categories of third parties and affiliates with whom we may share it: the Followers you choose through Mirri Cloud; and our service providers (such as our cloud hosting provider) who process data on our behalf under contract. We do not share consumer health data with any other third parties or affiliates, and we do not sell it.
• Consent and authorization: we collect consumer health data with your consent and share it only at your direction; we do not sell consumer health data, and we would not do so without first obtaining a separate, valid written authorization from you containing all elements the law requires.
• Your rights: to confirm whether we process your consumer health data, to access it, to withdraw consent, and to have it deleted (and to have us notify our service providers to delete it), subject to applicable law. To exercise these rights or to appeal, contact support@mirridiabetes.com (see Section 12).
• No geofencing: we do not use geofencing to identify or track consumers near, or to collect consumer health data or send notifications or advertisements based on proximity to, any health-care facility.

14. Do Not Sell or Share; No Advertising

We do not sell your health information, and we do not share it for cross-context behavioral advertising, as those terms are defined by applicable law. We do not use your health information for advertising or data mining, and we do not use third-party analytics or advertising software development kits (SDKs). Aside from limited information that Apple or Google may automatically collect as the app-store and platform providers (which is governed by their own privacy policies), we do not collect information about you beyond what you provide to us or authorize, or as described in Section 4(d). We do not allow third parties to collect personal information about your online activities over time and across different websites or online services through the App, other than what the connections you choose receive (Section 15), and because the App does no such tracking there is nothing for a browser’s “Do Not Track” signal to stop. We do not collect, use, or sell personal information from the App to train large language models.

15. Service Providers and Connections You Choose

Service providers. We use a small number of service providers to operate Mirri Cloud. They process information on our behalf under contracts requiring them to protect it at least as well as this Policy does and to use it only to provide services to us: Supabase, which hosts our database and sign-in system on Amazon Web Services in Ohio, United States, and holds your entries only in sealed form; Amazon Web Services (Simple Email Service), which sends your sign-in codes; and Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging), which deliver notices to the App that carry no health information; and Cloudflare, which carries requests to our servers, including sealed entries and routing information, as the network in front of our hosting provider. On Android, Google’s messaging service may create an installation identifier for the App. We do not sell your personal information, and we do not share it with third parties for their own marketing.

Connections you choose. Some App features connect your device directly to another company’s service, only when you use them. That company receives what the feature sends, under its own privacy policy, and we do not receive it:

• Food lookups. When you scan a barcode or search for a food, the barcode or search words go to Open Food Facts, a public food database, and to any other food database you add with your own key.
• Photo analysis. Meal photos are analyzed on your device. If you turn on cloud analysis and add your own Anthropic API key, a photo you choose to analyze is sent from your device directly to Anthropic under your own account with Anthropic.
• Dictation. When you dictate, your device’s speech recognition (Apple’s on iOS, Google’s on Android) converts your words to text, on your device where your device supports it and otherwise on Apple’s or Google’s servers.
• Voice assistants and shortcuts. If you use Siri, Shortcuts, or (on Android) your phone’s assistant with the App’s actions, the App gives that assistant the information the action asks for, such as your recent doses, carbohydrates, or glucose, or those of a person you follow; the assistant’s provider handles it under its own policy.

16. Children and Teens

The App is a general-audience service and is not directed to children under 13. You must be at least 13 years old to use the App. If you are under 18 (or the age of majority where you live), use the App and Mirri Cloud only with the permission of your parent or legal guardian.

Before you set up Mirri Cloud, MIRRI One asks for your birth year and keeps that year on your device: if you are 13 to 17, it shows a notice for you and your parent or guardian before setup continues, and if you are under 13, it stops setup. The App does not currently offer accounts, records, or profiles that a parent or guardian keeps for a child.

We do not knowingly collect personal information from a child under 13. If we learn that a child under 13 has created a Mirri Cloud account, we will delete that account and the associated information. If you believe a child’s information has been provided to us improperly, contact us at support@mirridiabetes.com and we will address it.

17. International Users

The App is intended for users in the United States, and we operate it and store information in the United States. We do not offer the App to individuals in the European Economic Area or the United Kingdom. If you use the App from outside the United States, you understand that your information will be processed in the United States.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date and, for material changes, provide additional notice as required by law (for example, in the App or by email). If a change materially affects how we collect, use, or share your health information, we will obtain your fresh, affirmative opt-in consent before it applies to you, rather than relying on your continued use.

19. Legal Process and Government Requests

Legal process and government requests. We disclose information only when valid legal process (such as a subpoena, court order, or search warrant) requires it, or when the law otherwise requires us to. We cannot produce the contents of your entries, because we hold no key that opens them. We review every request for scope and validity, we object to requests that are overbroad or that seek more than the law requires, and we provide only what the request lawfully requires. Unless we are legally prohibited from doing so, we tell you about a request for your information before we respond, so that you can object. We do not voluntarily disclose information to any government body, and we treat requests concerning reproductive or sexual health exactly as we treat every other request. If we receive a request, we record it in our security log.

20. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com