Research Participation Consumer Health Data Privacy Policy

In effect Effective September 3, 2026

Applies to

Mirri focus groups and research panels

Last Updated: September 3, 2026

1. Introduction and Scope

This Research Participation Consumer Health Data Privacy Policy (“Research CHD Policy”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) and provides the specific disclosures required for “consumer health data” under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act, and similar state laws, for the consumers those laws protect.

This policy applies to one thing only: the information you give us when you ask to join a Mirri focus group or research panel by submitting our signup form — for example, a form you reach by scanning a QR code at an event, in an email, or on a screen. We call this a “Research Signup.”

A Research Signup is not part of any Mirri product. You do not need to own a device, use Mirri One, use Mirri Navigator, or be a Mirri Studio user to submit one, and submitting one does not create an account, install anything, or license any software to you.

Our other policies do not cover this. The Consumer Health Data Privacy Policies for Mirri One and Mirri Navigator, and for Mirri Studio, describe data handled by software you or your organization use. A Research Signup is collected directly by Mirri from a member of the public, for recruitment rather than to deliver a service, so it is disclosed separately here.

Mirri is not a HIPAA covered entity or business associate, and a Research Signup is not treatment, payment, or health-care operations. This policy addresses consumer-health-privacy laws, not HIPAA.

Nothing you type into the signup form is a health fact on its face. Your name, your email address, and your phone number say nothing about your health.

We treat it as consumer health data anyway, because of what can be inferred from the act of signing up. If you scan a Mirri Diabetes code and ask to join a diabetes focus group, the request itself may suggest something about your health status, or a family member’s. State consumer health privacy laws reach information used to identify a health status by inference, not only information you state outright. We would rather disclose more than the law may require than argue afterward that a signup was outside it.

3. Categories of Consumer Health Data We Collect

When you submit a Research Signup, we store the following, and nothing else from that submission:

Your name, as you type it.
Your email address. This is how we contact you, and it is how we match a later request to be removed.
Your phone number, if you choose to give one. This field is optional and the form can be submitted without it.
Which group you signed up for. This is determined by which code or link you used, not chosen by you — for example, a code printed for a particular event corresponds to a particular group.
The fact that you ticked the consent box, and the date and time you ticked it.
The version of this policy that was published when you submitted, so that we can later show you the exact text you agreed to.

4. What We Deliberately Do Not Collect

The signup form does not ask for, and we do not store from it:

Whether you have diabetes, or any diagnosis, or the date of any diagnosis.
Any A1c, glucose, insulin, medication, device, or therapy information.
Your date of birth or age.
Your IP address. We do not log or retain the IP address of a Research Signup submission.
Any free-text field. There is no “tell us about yourself” box, so there is no place for you to volunteer health details, and we do not want them.

We do not use geolocation, and we do not infer your location, to collect this information or to decide what to send you.

5. Sources of Consumer Health Data

There is one source: you. Every field described in Section 3 either comes from what you typed into the form or is recorded automatically at the moment you submit it (the group, the consent timestamp, and the policy version). We do not buy, rent, or receive Research Signup information from data brokers, advertisers, event organizers, or any other third party, and we do not combine it with information from other sources.

6. Purposes for Collecting and Using Consumer Health Data

We use a Research Signup for one purpose: to contact you about taking part in the focus group or research panel you signed up for, and to keep an accurate record of the consent you gave.

We do not use it for advertising, marketing of our products, profiling, automated decision-making, or data mining. Signing up does not add you to a product mailing list. If we later want to use your information for any purpose other than the one above, we will ask you first and you are free to say no.

We do not share Research Signup information with any third party, and we do not share it with any affiliate of Mirri Diabetes LLC. We do not sell it.

Stated in the terms the law uses: the categories of third parties with whom we share this consumer health data are none, and the specific affiliates with whom we share it are none.

Research Signup information is stored in Mirri’s own internal system on infrastructure we control. It is not sent to analytics services, advertising networks, third-party marketing tools, or any other vendor. No third-party tracking tags run on the signup form.

We do not sell consumer health data. We would not do so without first obtaining a separate, valid written authorization from you containing all of the elements required by applicable law.

We collect a Research Signup only with your affirmative, opt-in consent.

The consent box is not ticked for you. It starts empty, the submit button does not work until you tick it, and we never treat submitting the form, scanning a code, or staying silent as consent. Your consent to this collection is asked for on its own and is not bundled with any Terms of Service, End User License Agreement, or any other agreement.

We record which version of this policy was published at the moment you consented, so that if there is ever a question about what you agreed to, it can be answered with the exact text you saw rather than with whatever this page says later.

You may withdraw your consent at any time, and doing so is described in Section 10.

9. No Geofencing

We do not use a geofence to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements based on your proximity to any health-care facility, provider, or other location that could indicate an attempt to receive health-care services.

You can ask to be removed at any time, for any reason, and you do not have to explain why. Email us at support@mirridiabetes.com from the address you signed up with, or reply to any message we send you about the group, and say that you want to be removed.

What we do when you ask. We delete your Research Signup — your name, your email address, your phone number, your group, and the associated records — from our live system. This is a real deletion, not a flag that hides you from a list, and once it is done we can no longer contact you.

Backups. Copies of the deleted record can survive for a short time in our routine encrypted backups, which are not used to contact anyone. Those copies are purged within 90 days, as described in Section 12.

The one thing we keep after that. We retain a one-way, non-reversible cryptographic hash of your email address, and the date, as evidence that your request was received and carried out. The hash cannot be turned back into your email address and cannot be used to contact you. We keep it so that we can prove we honored your request, and so that a later signup with the same address is not mistaken for a failure to delete.

Withdrawing consent stops any future contact that depended on it. If we have already sent you a message, we cannot unsend it.

11. Your Rights

Subject to applicable law, you have the right to:

Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
Withdraw your consent to our collection of your consumer health data.
Delete your consumer health data, and have us notify anyone who received it to delete it. For Research Signups there is no such recipient, because we do not share this information.
Appeal a decision we make about your request.

We will not discriminate against you for exercising any of these rights. Declining to sign up, or asking to be removed, has no effect on your use of any Mirri product, on any support you receive from us, or on your eligibility for anything else we offer.

How to exercise them. Contact us at support@mirridiabetes.com. We will confirm receipt within 10 days and respond within 45 days, which may be extended once by a further 45 days if we tell you why. We take reasonable steps to verify your identity before acting, which for a Research Signup normally means a reply from the email address on the signup. We accept requests from authorized agents with proof of authorization. If we deny your request you may appeal by replying to our decision or writing to support@mirridiabetes.com, and if the appeal is denied you may contact your state Attorney General.

12. Retention

We keep a Research Signup only as long as it is needed for the purpose in Section 6.

If you ask to be removed, we delete it as described in Section 10.
If you tell us you do not want to take part, or you decline, we delete it within 30 days.
When the group you signed up for has finished, we delete the signups for that group within 12 months.
Copies in routine encrypted backups are purged within 90 days of deletion.

We do not keep a standing list of people to invite to future groups. A Research Signup is kept for the group it was submitted for and no other. If we ever want to contact you about a different group, we will ask you at the time, as described in Section 6, rather than keeping your information past the limits above in order to do so.

13. Children’s Information

The signup form is a general-audience form intended for adults and is not directed to children. We do not knowingly accept a Research Signup from anyone under 18, or the age of majority where you live, and we do not knowingly collect personal information or consumer health data from a child through it. If you believe a child has submitted a signup, write to us at support@mirridiabetes.com and we will delete it without asking the child to verify anything.

14. Security

We use administrative, technical, and physical safeguards designed to protect Research Signup information, including encryption in transit and at rest, access controls limiting it to the people who run the research program, and monitoring. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting this information occurs, we will provide notice as required by law, including the FTC Health Breach Notification Rule and applicable state laws.

15. Changes to This Policy

We may update this policy. We will revise the “Last Updated” date and publish the new version at this same address, and we keep every earlier version published so that the version you agreed to remains readable. For material changes to how we collect or use this information, we will obtain fresh, affirmative opt-in consent before the change applies to you — we will not apply a new version retroactively to a signup made under an older one.

16. Contact Us

For questions about this policy, to withdraw your consent, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com

Mirri Diabetes