Consumer Health Data Privacy Policy

In effect Effective October 26, 2026

Applies to

MIRRI One

Last Updated: October 26, 2026

Version 2.2

1. Introduction and Scope

This Consumer Health Data Privacy Policy (“CHD Policy”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) and provides the specific disclosures required for “consumer health data” under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act, and similar state laws, for the consumers those laws protect.

It supplements, and should be read together with, the MIRRI One Privacy Policy and Terms of Service. It applies to MIRRI One, our diabetes and metabolic health management app for Apple iOS and Android (the “App”), including Mirri Cloud and Offline Sharing when you use them in the App. Mirri Cloud also has its own Consumer Health Data Privacy Policy. If anything in this CHD Policy conflicts with the MIRRI One Privacy Policy regarding consumer health data, this CHD Policy controls as to that data, except that our U.S. State Health Privacy Notice controls for residents of the states it names.

“Consumer health data” means personal information that identifies your past, present, or future physical or mental health status — here, the diabetes- and metabolic-health-related information you record in, or authorize the App to access.

Mirri is a consumer app and is not a HIPAA covered entity or business associate. This CHD Policy addresses consumer-health-privacy laws, not HIPAA.

2. Categories of Consumer Health Data We Collect

The health information you log, such as glucose values, insulin doses, medications, meals, foods and carbohydrates, physical activity, supplies, symptoms, cycle information, and notes.
The health-platform categories you authorize the App to read (such as glucose, insulin, carbohydrates, activity, sleep, and cycle information) from Apple HealthKit (on iOS) or Android Health Connect (on Android).
Information about your health conditions and care that you choose to record or share.

We collect only the categories you provide or authorize. If you turn on Mirri Cloud, the App seals this information on your device before uploading it, our servers are designed to hold no key that can open it, and we can read only the routing information and the other details the MIRRI One Privacy Policy describes in Section 4(d): for each entry, which record it belongs to, a slot number that does not tell us its kind, the two-week period it falls in, its size rounded up to a fixed size, the version of your keys, the device that wrote it, and when we received it; and, for your record (shown in the App as your data), your account and email address, your devices, who follows you and since when, how many entries arrive and when, which slot paces wake-ups when background refresh pings are on, when your keys change, and your deletion, consent, and security records. We never read an entry’s kind or its contents. Your notes, photos, and conversations with Iris are never uploaded. Your cycle and other reproductive-health information is sealed on your device like every other kind and uploaded in that sealed form; because the slot number is assigned at random for each record, we cannot tell which entries are cycle entries. Offline Sharing goes from your screen to another device in person and never reaches us. We do not use geolocation to infer health conditions.

3. Sources of Consumer Health Data

You — the information you enter into the App.
Your device’s health platform — Apple HealthKit or Android Health Connect, only with your permission and only for the categories you authorize.
Your use of the App — for example, your Mirri Cloud sharing settings and delivery status.

4. Purposes for Collecting and Using Consumer Health Data

To provide the App’s diabetes- and metabolic-health-management features.
If you turn on Mirri Cloud, to keep your record in sync between your devices and make it available to the Followers you choose.
To operate, secure, and support the App and Mirri Cloud, including checking that Mirri Cloud is working, and to respond to your requests.

We do not use your consumer health data for advertising or data mining, and we do not use it for any research or other secondary purpose except with your separate, explicit permission.

We share consumer health data only:

With the Followers you choose through Mirri Cloud — for example, family members or caregivers — for the kinds of information you allow each of them, none by default; a Follower receives your cycle and other reproductive-health information only if you turn on the Cycle category for that Follower, which is off by default and asks for its own confirmation. You choose your Followers; they are not vetted, controlled, or supervised by Mirri, and once a Follower has opened information we cannot recall or control it.
With our service providers — Supabase, our cloud hosting provider, which stores your entries only in sealed form; Cloudflare, which carries requests to it; Resend, Inc., which sends our sign-in and account emails, delivers them through Amazon Web Services’ email infrastructure, and receives your email address and the content of those emails but no health information; and Apple and Google, which deliver notices that carry no health information — who process data on our behalf under contracts that require them to protect it and use it only to provide services to us.

We do not share consumer health data with any other third parties, we have no affiliates that receive it, and we do not sell consumer health data. We do not allow third parties to collect consumer health data about your online activities over time and across different websites or online services through the App, and we use no analytics, advertising, or tracking tools. Mirri Cloud keeps only the service-wide operating totals that the Mirri Cloud Privacy Policy, Section 4(l), describes, which are never kept for any person and identify no one.

We collect and process your consumer health data only with your affirmative, opt-in consent where required. Turning on Mirri Cloud is a separate choice, made on a screen titled “Turn on Mirri Cloud” that states, in labeled lines, what the App will send (the kinds that version of the App sends, which include cycle days, and that notes, photos, and Iris chats stay on your phone), where it goes (Mirri’s servers in the United States), why (to keep your record in sync between your devices and to let the Followers you choose see what you allow), who can read it (you, the devices you approve, and each Follower you confirm, for the kinds you allow), and how to change your mind (delete your record or close your account at any time in Mirri Cloud settings), with links to the Mirri Cloud documents. Tapping “Agree and turn on” is your consent; the same screen says that turning on Mirri Cloud accepts the Mirri Cloud Terms of Service, but the consent rests on the disclosures on that screen, not on accepting the Terms. The App records the version and time of your consent on your device and sends our servers a consent record that contains no health information. Our service providers, listed in Section 5, hold your entries only in sealed form. You start sharing by scanning the code the other person’s screen shows or, if you are apart, by sending them a link that they open. A Follower can read the earlier entries of each kind you allow, as well as new ones, not only entries made after you start sharing. Sharing with each Follower is a further, separate choice that you make on a screen where every kind of information is off until you choose it, which names the device or account you are authorizing as it appears on the screen, states which kinds they will be able to read (the kinds you tick) so that they can follow your record, and says that this lasts until you end it; you confirm by tapping “Start sharing,” which is recorded as your signature on that authorization and is your consent to that sharing. Cycle information has its own Cycle switch for each Follower, which is off by default and asks for its own confirmation before it turns on; that confirmation is your separate consent to disclose it to that Follower. You may withdraw your consent at any time (see Section 8); withdrawal stops future collection or sharing that depended on that consent.

We do not sell consumer health data. We would not do so without first obtaining a separate, valid written authorization from you that contains all of the elements required by applicable law.

7. No Geofencing

We do not use a geofence to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements based on your proximity to any health-care facility, provider, or other location that could indicate an attempt to receive health-care services.

8. Your Rights

Subject to applicable law, you have the right to:

Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data, including a list of all third parties and affiliates with which we have shared or sold it, with an email address or other online way to contact each of them.
Withdraw consent to our collection and sharing of your consumer health data.
Delete your consumer health data, and have us notify our service providers that received it to delete it.
Appeal a decision we make about your request.

We will not discriminate against you for exercising these rights.

The list of third parties. When you ask for it, we give you the service providers in Section 5, with a way to contact each, and each Follower who has had access to your record, by the email address of their account. We have no affiliates and sell to no one, so there is nothing else to list.

How to exercise them. Contact us at support@mirridiabetes.com, or delete your Mirri Cloud data in the App (open the Menu, then Mirri Cloud, then Settings, then Delete & close account) or at cloud.mirridiabetes.com/delete-my-data. We will confirm receipt within 10 days and respond within 45 days (extendable once by an additional 45 days with notice). We take reasonable steps to verify your identity before acting and accept requests from authorized agents with proof of authorization. If we deny your request, you may appeal by replying to our decision or contacting support@mirridiabetes.com; if your appeal is denied, you may contact your state Attorney General.

State-specific disclosures. Our U.S. State Health Privacy Notice gives the additional disclosures for Washington, Nevada, Connecticut, and other states, including when deletion is complete (a Mirri Cloud deletion you start yourself usually runs 24 hours after you ask, or at once when you close your account without waiting; a request is always completed within 30 days of verifying it), and the Attorneys General you may contact if we deny an appeal.

9. Retention of Consumer Health Data

We retain consumer health data only for as long as needed to provide the features you use and as required for legal, security, and record-keeping purposes. Health information you log remains on your device until you delete it or uninstall the App. If you turn on Mirri Cloud, your sealed entries are kept while your record exists; when you delete your record, the deletion runs 24 hours after you ask, destroys the record’s keys, and removes its entries and Followers’ access (closing your account without waiting deletes the records only it holds at once), and copies in our hosting provider’s routine backups keep the entries sealed and expire, with everything else they hold, within 30 days. Information a Follower has already opened cannot be recalled.

10. Security

We use administrative, technical, and physical safeguards designed to protect consumer health data, including sealing entries on your device before Mirri Cloud uploads them, encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting your health information occurs, we will provide notice as required by law, including the FTC Health Breach Notification Rule and applicable state laws.

11. Changes to This CHD Policy

We may update this CHD Policy from time to time. We will revise the “Last Updated” date and, for material changes affecting how we collect, use, or share consumer health data, obtain your fresh, affirmative opt-in consent before the change applies to you.

12. Legal Process and Government Requests

Legal process and government requests. We disclose information only when valid legal process (such as a subpoena, court order, or search warrant) requires it, or when the law otherwise requires us to. We cannot produce the contents of your entries, because Mirri Cloud is designed so that we hold no key that opens them. Our servers are designed not to hold which kinds of information you record, when within a two-week period the things you recorded happened, your time zone, or what you changed or deleted, so we cannot produce those either; what we could be required to produce is limited to the information our servers can read, described in Section 2. We review every request for scope and validity, we object to requests that are overbroad or that seek more than the law requires, and we provide only what the request lawfully requires. Unless we are legally prohibited from doing so, we tell you about a request for your information before we respond, so that you can object. We do not voluntarily disclose information to any government body, and we treat requests concerning reproductive or sexual health exactly as we treat every other request; Cycle and other reproductive-health information is held, like every other kind, only in sealed form that we cannot open, and our servers cannot tell which entries are cycle entries, so we have no readable reproductive-health information to produce. We keep a record of each request we receive and how we answered it.

13. Contact Us

For questions about this Consumer Health Data Privacy Policy, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com

Mirri Diabetes