Consumer Health Data Privacy Policy

Last Updated: October 24, 2026

1. Introduction and Scope

This Consumer Health Data Privacy Policy (“CHD Policy”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) and provides the specific disclosures required for “consumer health data” under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act, and similar state laws, as they relate to Mirri Cloud.

Mirri Cloud is the service that keeps the health record a person creates in MIRRI One, Mirri’s mobile app, in sync between that person’s own devices and shares it with the people they choose, together with the Mirri Cloud website at cloud.mirridiabetes.com, where people read and analyze their own record and records shared with them. This CHD Policy supplements, and should be read together with, the Mirri Cloud Privacy Policy and the Mirri Cloud Terms of Service. If anything here conflicts with the Mirri Cloud Privacy Policy regarding consumer health data, this CHD Policy controls as to that data, except that our U.S. State Health Privacy Notice controls for residents of the states it names.

“Consumer health data” means personal information that identifies a consumer’s past, present, or future physical or mental health status — here, the diabetes and related health information described below.

Mirri is not a HIPAA covered entity or business associate, and Mirri Cloud is not offered to covered entities or business associates for protected health information. This CHD Policy addresses consumer-health-privacy laws, not HIPAA.

2. How Mirri Cloud Holds Consumer Health Data

MIRRI One seals each health entry on the person’s phone before it is uploaded. Our servers store the entry in sealed form and hold no key that can open it, and entries are opened only on the person’s own approved devices and those of the Followers they choose. We still treat sealed entries as consumer health data. We also treat as consumer health data the information about those entries that our servers can read — each entry’s kind, times, local date, and time zone — and the record’s display name, because together they can show that a person records diabetes-related information. MIRRI One does not send cycle or other reproductive-health information to Mirri Cloud.

3. Categories of Consumer Health Data

Kept in Mirri Cloud in sealed form. Once the person turns Mirri Cloud on in MIRRI One, MIRRI One keeps their record there, whether or not anyone follows it yet. Depending on the version of MIRRI One and what the person records, a record can hold:

• glucose readings, including meter readings;
• insulin doses, mealtime and long-acting;
• carbohydrates, foods and meals with their nutrients, and saved meals;
• workouts and activity, steps, and sleep;
• therapy settings recorded in MIRRI One, such as ratios and target ranges;
• medicines on the person’s list, and when they were taken;
• supplies, such as sensor, infusion-set, and pen changes, and injection or wear sites;
• Playbook plays.

Readable by Mirri. Each entry’s kind, times, local date, and time zone; and the record’s display name.

Never sent to Mirri Cloud. The person’s notes, photos, conversations with Iris (MIRRI One’s in-app assistant), and cycle or other reproductive-health information.

Visual Share. A Visual Share (called Offline Sharing in MIRRI One) goes from the person’s phone screen to a browser tab in person, and can carry information a record does not, such as workout distance and heart rate and the names of the apps the data came from. It is never sent to Mirri, and we do not collect it.

We do not collect precise location, and we do not use location to infer health conditions.

4. Sources of Consumer Health Data

Consumer health data reaches Mirri Cloud only from MIRRI One on the record holder’s phone: information the person enters in MIRRI One, and information MIRRI One reads, with the person’s permission, from Apple Health or Android Health Connect, which may include information other apps wrote there. The Mirri Cloud website does not collect consumer health data from anyone; it opens what MIRRI One sealed, in the reader’s own browser.

5. Purposes for Using Consumer Health Data

• To keep a person’s record in sync between their own devices.
• To make it available to the Followers and devices the person approves.
• To operate, secure, and support Mirri Cloud, and to carry out the person’s requests, including deletion.

We do not use consumer health data for advertising or data mining, and we do not use it for research or any other secondary purpose except with the person’s separate, explicit permission. We cannot use the content of entries for any purpose, because we cannot open them.

6. How We Share Consumer Health Data

We share consumer health data only:

• With the Followers the person chooses. The person confirms each Follower, chooses the kinds of information that Follower may read, and can change or end that access at any time in MIRRI One. Cycle and other reproductive-health information is never in Mirri Cloud, so it cannot be shared through it. Followers are chosen by the person and are not vetted, controlled, or supervised by Mirri.
• With our service providers, who process data on our behalf under contracts that require them to protect it and use it only to provide services to us: Supabase, our database host in the United States, which stores sealed entries and the readable information described in Section 3; Cloudflare, which carries requests to our servers, including sealed entries and routing information, as the network in front of our hosting provider; and Apple and Google, which deliver notices to MIRRI One that carry no health information.

We do not share consumer health data with any other third parties, we have no affiliates that receive it, and we do not sell consumer health data. We do not allow third parties to collect consumer health data about your online activities over time and across different websites or online services through Mirri Cloud, and we use no analytics, advertising, or tracking tools.

7. Consent and Authorization

Mirri Cloud is off by default in MIRRI One, and nothing is uploaded until the person turns it on. Turning it on is the person’s affirmative, opt-in consent to Mirri Cloud collecting the categories in Section 3 to keep their record in sync. Sharing with each Follower is a separate choice, which the person makes when they invite and confirm that Follower and choose what the Follower may read.

A person may withdraw consent at any time by ending a Follower’s access, deleting their record, or closing their account. When a Follower’s access ends, the Follower can no longer read the record; we cannot recall what a Follower has already opened.

We do not sell consumer health data, and we would not do so without first obtaining a separate, valid written authorization containing all elements required by applicable law.

8. No Geofencing

We do not use a geofence to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements based on a consumer’s proximity to any health-care facility, provider, or other location that could indicate an attempt to receive health-care services.

9. Your Rights

Subject to applicable law, you have the right to: confirm whether we are collecting, sharing, or selling your consumer health data, and access it, including a list of all third parties and affiliates with which we have shared or sold it, with an email address or other online way to contact each of them; withdraw consent to our collection and sharing; have your consumer health data deleted (and have us notify the service providers that received it to delete it); and appeal a decision we make about a request. We do not discriminate against you for exercising these rights.

Entries we cannot open. Because we cannot open your entries, we cannot produce a readable copy of them. We can tell you the readable information we hold, and you can read your entries in MIRRI One or on the Mirri Cloud website on your own approved devices.

How to exercise them. Delete a record or close your account in MIRRI One (open the Menu, then Mirri Cloud, then Settings, then Delete & close account) or at cloud.mirridiabetes.com/delete-my-data, or contact us at support@mirridiabetes.com. We will confirm receipt within 10 days and respond within 45 days (extendable once by an additional 45 days with notice), and we take reasonable steps to verify identity before acting. If we deny a request, you may appeal by replying to our decision or contacting support@mirridiabetes.com; if the appeal is denied, you may contact your state Attorney General.

State-specific disclosures. Our U.S. State Health Privacy Notice gives the additional disclosures for Washington, Nevada, Connecticut, and other states, including when deletion is complete (a Mirri Cloud deletion you start yourself usually runs 24 hours after you ask; a request is always completed within 30 days of verifying it), and the Attorneys General you may contact if we deny an appeal.

10. Retention of Consumer Health Data

We keep consumer health data only while the record exists. When a record is deleted, the deletion runs 24 hours after the request unless it is cancelled, destroys the record’s keys, and removes its entries and Followers’ access; copies in our hosting provider’s routine backups keep the entries sealed and expire, with everything else they hold, within 30 days. When an account is closed, the records only that account holds are deleted the same way, and the email address is erased within about an hour. After a deletion we keep a record that it was requested and carried out, with its times and the identifiers needed to show it, such as the record’s display name, and nothing about the contents of any entry. Information a Follower has already opened on their own device is outside our control.

11. Security

We use administrative, technical, and physical safeguards designed to protect consumer health data. The main one is sealing entries on the person’s phone, so that our servers, our staff, and our service providers cannot open them; others are the access controls and logging described in the Mirri Cloud Privacy Policy. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting health information occurs, we will provide notice as required by law, including the FTC Health Breach Notification Rule and applicable state laws.

12. Changes to This CHD Policy

We may update this CHD Policy from time to time. We will revise the “Last Updated” date and, for material changes affecting how we handle consumer health data, obtain any consent required by law before the change applies.

13. Legal Process and Government Requests

Legal process and government requests. We disclose information only when valid legal process (such as a subpoena, court order, or search warrant) requires it, or when the law otherwise requires us to. We cannot produce the contents of your entries, because we hold no key that opens them. We review every request for scope and validity, we object to requests that are overbroad or that seek more than the law requires, and we provide only what the request lawfully requires. Unless we are legally prohibited from doing so, we tell you about a request for your information before we respond, so that you can object. We do not voluntarily disclose information to any government body, and we treat requests concerning reproductive or sexual health exactly as we treat every other request. If we receive a request, we record it in our security log.

14. Contact Us

For questions about this Consumer Health Data Privacy Policy, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com