U.S. State Health Privacy Notice

Last Updated: October 26, 2026

Version 1.2

1. About This Notice

This U.S. State Health Privacy Notice (“State Notice”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”). It supplements the MIRRI One Privacy Policy, the MIRRI One Consumer Health Data Privacy Policy, the Mirri Cloud Privacy Policy, and the Mirri Cloud Consumer Health Data Privacy Policy (together, the “Policies”), and gives the additional disclosures and rights that certain state laws provide for health information.

It applies to MIRRI One, Mirri’s mobile app, and to Mirri Cloud, the service MIRRI One uses to keep a record (shown in the apps as your data) in sync and share it, including the Mirri Cloud website at cloud.mirridiabetes.com (together, the “Services”). For residents of a state named here, this State Notice controls where it conflicts with a Policy.

Wherever you live in the United States, you may use the rights described in Section 4, and we will respond to your request as described there.

Our website, www.mirridiabetes.com, has its own Website Privacy Policy, which covers its mailing-list, clinical-interest, and booking forms and gives the same rights for what they collect.

2. The Health Information We Handle

The Services handle diabetes and related health information, such as glucose readings, insulin, carbohydrates and foods, activity, sleep, medicines, supplies, and cycle information. MIRRI One keeps this information on your device. If you turn on Mirri Cloud, MIRRI One seals it on your device before uploading it, and our servers are designed to hold no key that can open it. Our servers can read only the routing, record, account, device, and Follower details described in the Policies (for example, which account holds a record, who follows it, how many sealed entries arrive and when, and which two-week periods have entries), never what you recorded, which kinds of information you record, when within a two-week period the things you recorded happened, or what you changed or deleted. From those details our servers also keep service-wide daily totals, never for any person, account, or record, which we handle as deidentified data and which the Mirri Cloud Privacy Policy describes. Cycle and other reproductive-health information is sealed like every other kind, stored in Mirri Cloud in that sealed form, and received by a Follower only if you turn on the Cycle category for that Follower, which is off by default and asks for its own confirmation; our servers cannot tell which entries are cycle entries, because the slot number is assigned at random for each record. This protection is designed to work as the Policies describe, and no method of transmission or storage is completely secure. The Policies list the categories we handle, their sources, our purposes, and who receives them.

3. Commitments That Apply in Every State

• We do not sell health information or any other personal information.
• We do not use or share personal information for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects.
• We do not collect, use, or sell personal information from the Services to train large language models.
• We do not use geofencing, at any distance, to identify or track people seeking health care, to collect health information, or to send notifications, messages, or advertisements.
• We do not allow third parties to collect personal information or health information about your online activities over time and across different websites or online services through the Services.
• We collect health information only with your consent, given on MIRRI One’s “Turn on Mirri Cloud” screen before anything is uploaded, and we share it only with the Followers you choose, each by your separate choice in MIRRI One, and with service providers that process it for us.
• We have no affiliates that receive your health information.
• We do not voluntarily disclose information to any government body; we respond only to valid legal process, review every request for scope, and tell you first unless the law prohibits it (see the Legal Process section of each Privacy Policy).

4. Your Rights and How to Use Them

You may:

• confirm whether we collect, share, or sell your health information, and access it;
• obtain a list of the third parties and affiliates with which we have shared your health information, with an email address or other online way to contact each of them (the list names our service providers and each Follower who has had access to your record, by the email address of their account; we have no affiliates);
• correct inaccurate information: you can edit or delete what you have recorded in MIRRI One at any time, and you can ask us to correct your account information;
• delete your health information and other personal information;
• obtain a portable copy of the personal information we can read;
• withdraw your consent to our collection or sharing of your health information;
• opt out of sale, targeted advertising, and profiling, none of which we do; and
• appeal our decision on your request.

How to make a request. Email support@mirridiabetes.com. You can also delete your Mirri Cloud data yourself in MIRRI One (open the Menu, then Mirri Cloud, then Settings, then Delete & close account) or at cloud.mirridiabetes.com/delete-my-data. You may use an authorized agent who has proof of your authorization. We take reasonable steps to verify your identity before acting, usually by confirming that you control the email address on your account. We do not charge for requests, except as the law allows for requests that are manifestly unfounded, excessive, or repetitive, and we do not discriminate against you for using these rights.

Response times. We confirm receipt within 10 days and respond within 45 days of receiving your request. When reasonably necessary, we may extend that once by 45 days, and we will tell you why within the first 45 days. When you ask us to delete health information, we delete it from our active systems within 30 days of verifying your request (a Mirri Cloud deletion you start yourself usually runs 24 hours after you ask, or at once when you close your account without waiting) and tell the service providers that received it to delete it, except the records that Section 9 of the Mirri Cloud Privacy Policy says we keep; copies in our hosting provider’s routine backups keep the entries sealed and expire, with everything else they hold, within 30 days.

Entries we cannot open. Because Mirri Cloud entries are sealed on your devices and Mirri Cloud is designed so that we hold no key, we cannot produce a readable copy of them. You can read them on your own approved devices, and we will give you the information we can read.

Appeals. If we decline your request, you may appeal by replying to our decision or by emailing support@mirridiabetes.com with “Appeal” in the subject line. Within 45 days of receiving your appeal, we will tell you in writing what we decided and why. If we deny your appeal, you may contact your state Attorney General; contact details for several states are in Section 6.

5. State-Specific Disclosures

Washington. The MIRRI One and Mirri Cloud Consumer Health Data Privacy Policies are our consumer health data privacy policies under the Washington My Health My Data Act, and each is linked separately from our homepage. We collect consumer health data only with your consent and only for the purposes those policies describe, we share it only with the Followers you choose, each by your separate consent, and with service providers that process it for us, and we never sell it. We have no affiliates that receive consumer health data. You may request the list of third parties described in Section 4.

Nevada. The same two policies are our consumer health data privacy policies under Nevada law (Chapter 603A of the Nevada Revised Statutes). Each states its effective date and how we notify you of material changes: we revise the “Last Updated” date and, for material changes, notify you and obtain any consent the law requires before the change applies. You can review and change the information you record in MIRRI One at any time. We do not allow third parties to collect consumer health data about your online activities over time and across different websites or online services through the Services, and we use no analytics, advertising, or tracking tools. We do not sell covered information; you may still send a request to opt out of any sale to support@mirridiabetes.com.

Connecticut. We treat health information as sensitive data under the Connecticut Data Privacy Act, and we process it only with your consent. We maintain a data protection assessment of our processing of health information in MIRRI One’s sharing and in Mirri Cloud, which we review at least once a year and whenever we change how Mirri Cloud seals or routes information. The rights in Section 4 apply to you, including the right to opt out of targeted advertising, sale, and profiling, none of which we do. We do not collect, use, or sell personal data from the Services to train large language models.

California. We treat the health information in the Services as medical information under the California Confidentiality of Medical Information Act. We disclose it only with your authorization or as the law requires or permits, and we never use it for marketing. You authorize each Follower in MIRRI One on a screen that names the device or account you are authorizing as it appears on the screen, lets you tick the kinds of information they may read, which they can read as earlier entries as well as new ones (every kind is off until you choose it), states that the purpose is to let them follow your data and that the authorization lasts until you end it, and has you confirm by tapping “Start sharing,” which is recorded as your signature; you can end it at any time in MIRRI One. The Services do not track you across third-party websites or online services, so there is no such tracking for a browser’s “Do Not Track” signal to stop; we honor the Global Privacy Control as a request to opt out of any sale or sharing, although we do neither. We do not disclose personal information to third parties for their own direct marketing.

Virginia. We treat information about menstruation, ovulation, pregnancy, and other reproductive or sexual health as reproductive or sexual health information under the Virginia Consumer Protection Act. MIRRI One obtains it only with your consent: when you record it, when you allow MIRRI One to read it from Apple Health or Android Health Connect, and, before it uploads anything to Mirri Cloud, when you tap “Agree and turn on” on the Mirri Cloud consent card. MIRRI One discloses it to a Follower only if you turn on the Cycle switch for that Follower, which is off by default and asks for its own confirmation; until then it stays in Mirri Cloud in sealed form, which our servers are designed not to be able to open. Offline Sharing can show it from your screen to a screen you choose, in person, only when you choose its Cycle option for that share, and it never reaches us. We never sell it.

Texas. Health information you record in MIRRI One may be disclosed electronically when you choose to share it. Mirri Cloud delivers it only to the Followers you authorize, each separately, on the screen described under California above; Offline Sharing goes from your screen to the screen you choose and never reaches us. We never sell it.

Indiana. Mirri is based in Indiana. The rights in Section 4 apply to Indiana residents as described there, and if we deny your appeal you may contact the Indiana Attorney General.

Other states. Residents of other states with consumer privacy or health information laws, such as Colorado, Delaware, Maryland, New Jersey, and Oregon, may have rights similar to those in Section 4. We honor the rights in Section 4 for every request, whether or not a particular state’s law applies to us.

6. State Attorneys General

If we deny your appeal, you may contact your state Attorney General, including:

• Washington: Office of the Attorney General, www.atg.wa.gov
• Nevada: Office of the Attorney General, ag.nv.gov
• Connecticut: Office of the Attorney General, portal.ct.gov/ag
• California: Office of the Attorney General, oag.ca.gov
• Virginia: Office of the Attorney General, www.oag.state.va.us
• Texas: Office of the Attorney General, www.texasattorneygeneral.gov
• Indiana: Office of the Attorney General, www.in.gov/attorneygeneral

7. Changes to This Notice

We may update this State Notice from time to time. We will revise the “Last Updated” date and, for material changes affecting how we handle health information, notify you and obtain any consent required by law before the change applies.

8. Contact Us

For questions about this State Notice, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com