U.S. State Health Privacy Notice

Last Updated: October 24, 2026

1. About This Notice

This U.S. State Health Privacy Notice (“State Notice”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”). It supplements the MIRRI One Privacy Policy, the MIRRI One Consumer Health Data Privacy Policy, the Mirri Cloud Privacy Policy, and the Mirri Cloud Consumer Health Data Privacy Policy (together, the “Policies”), and gives the additional disclosures and rights that certain state laws provide for health information.

It applies to MIRRI One, Mirri’s mobile app, and to Mirri Cloud, the service MIRRI One uses to keep a record in sync and share it, including the Mirri Cloud website at cloud.mirridiabetes.com (together, the “Services”). For residents of a state named here, this State Notice controls where it conflicts with a Policy.

Wherever you live in the United States, you may use the rights described in Section 4, and we will respond to your request as described there.

2. The Health Information We Handle

The Services handle diabetes and related health information, such as glucose readings, insulin, carbohydrates and foods, activity, sleep, medicines, supplies, and cycle information. MIRRI One keeps this information on your device. If you turn on Mirri Cloud, MIRRI One seals it on your device before uploading it, and our servers hold no key that can open it; our servers can read only the routing, record, account, device, and Follower details described in the Policies, never what you recorded. This protection is designed to work as the Policies describe, and no method of transmission or storage is completely secure. The Policies list the categories we handle, their sources, our purposes, and who receives them.

3. Commitments That Apply in Every State

• We do not sell health information or any other personal information.
• We do not use or share personal information for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects.
• We do not collect, use, or sell personal information from the Services to train large language models.
• We do not use geofencing, at any distance, to identify or track people seeking health care, to collect health information, or to send notifications, messages, or advertisements.
• We do not allow third parties to collect personal information or health information about your online activities over time and across different websites or online services through the Services.
• We collect health information only with your consent, and we share it only with the Followers you choose, each by your separate choice in MIRRI One, and with service providers that process it for us.
• We have no affiliates that receive your health information.
• We do not voluntarily disclose information to any government body; we respond only to valid legal process, review every request for scope, and tell you first unless the law prohibits it (see the Legal Process section of each Privacy Policy).

4. Your Rights and How to Use Them

You may:

• confirm whether we collect, share, or sell your health information, and access it;
• obtain a list of the third parties and affiliates with which we have shared your health information, with an email address or other online way to contact each of them;
• correct inaccurate information: you can edit or delete what you have recorded in MIRRI One at any time, and you can ask us to correct your account information;
• delete your health information and other personal information;
• obtain a portable copy of the personal information we can read;
• withdraw your consent to our collection or sharing of your health information;
• opt out of sale, targeted advertising, and profiling, none of which we do; and
• appeal our decision on your request.

How to make a request. Email support@mirridiabetes.com. You can also delete your Mirri Cloud data yourself in MIRRI One (open the Menu, then Mirri Cloud, then Settings, then Delete & close account) or at cloud.mirridiabetes.com/delete-my-data. You may use an authorized agent who has proof of your authorization. We take reasonable steps to verify your identity before acting, usually by confirming that you control the email address on your account. We do not charge for requests, except as the law allows for requests that are manifestly unfounded, excessive, or repetitive, and we do not discriminate against you for using these rights.

Response times. We confirm receipt within 10 days and respond within 45 days of receiving your request. When reasonably necessary, we may extend that once by 45 days, and we will tell you why within the first 45 days. When you ask us to delete health information, we delete it from our active systems within 30 days of verifying your request (a Mirri Cloud deletion you start yourself usually runs 24 hours after you ask) and tell the service providers that received it to delete it, except the records that Section 9 of the Mirri Cloud Privacy Policy says we keep; copies in our hosting provider’s routine backups keep the entries sealed and expire, with everything else they hold, within 30 days.

Entries we cannot open. Because Mirri Cloud entries are sealed on your devices and we hold no key, we cannot produce a readable copy of them. You can read them on your own approved devices, and we will give you the information we can read.

Appeals. If we decline your request, you may appeal by replying to our decision or by emailing support@mirridiabetes.com with “Appeal” in the subject line. Within 45 days of receiving your appeal, we will tell you in writing what we decided and why. If we deny your appeal, you may contact your state Attorney General; contact details for several states are in Section 6.

5. State-Specific Disclosures

Washington. The MIRRI One and Mirri Cloud Consumer Health Data Privacy Policies are our consumer health data privacy policies under the Washington My Health My Data Act, and each is linked separately from our homepage. We collect consumer health data only with your consent and only for the purposes those policies describe, we share it only with the Followers you choose, each by your separate consent, and with service providers that process it for us, and we never sell it. We have no affiliates that receive consumer health data. You may request the list of third parties described in Section 4.

Nevada. The same two policies are our consumer health data privacy policies under Nevada law (Chapter 603A of the Nevada Revised Statutes). Each states its effective date and how we notify you of material changes: we revise the “Last Updated” date and, for material changes, notify you and obtain any consent the law requires before the change applies. You can review and change the information you record in MIRRI One at any time. We do not allow third parties to collect consumer health data about your online activities over time and across different websites or online services through the Services, and we use no analytics, advertising, or tracking tools. We do not sell covered information; you may still send a request to opt out of any sale to support@mirridiabetes.com.

Connecticut. We treat health information as sensitive data under the Connecticut Data Privacy Act, and we process it only with your consent. The rights in Section 4 apply to you, including the right to opt out of targeted advertising, sale, and profiling, none of which we do. We do not collect, use, or sell personal data from the Services to train large language models.

California. We treat the health information in the Services as medical information under the California Confidentiality of Medical Information Act. We disclose it only with your authorization — for example, when you confirm a Follower and choose what they may read — or as the law requires or permits, and we never use it for marketing. The Services do not track you across third-party websites or online services, so there is no such tracking for a browser’s “Do Not Track” signal to stop; we honor the Global Privacy Control as a request to opt out of any sale or sharing, although we do neither. We do not disclose personal information to third parties for their own direct marketing.

Virginia. We treat information about menstruation, ovulation, pregnancy, and other reproductive or sexual health as reproductive or sexual health information under the Virginia Consumer Protection Act. MIRRI One obtains it only with your consent: when you record it, or when you allow MIRRI One to read it from Apple Health or Android Health Connect. MIRRI One never uploads it to Mirri Cloud. Offline Sharing can show it from your screen to a screen you choose, in person, only when you choose its Cycle option for that share, and it never reaches us. We never sell it.

Texas. Health information you record in MIRRI One may be disclosed electronically when you choose to share it. Mirri Cloud delivers it only to the Followers you authorize, each separately; Offline Sharing goes from your screen to the screen you choose and never reaches us. We never sell it.

Indiana. Mirri is based in Indiana. The rights in Section 4 apply to Indiana residents as described there, and if we deny your appeal you may contact the Indiana Attorney General.

Other states. Residents of other states with consumer privacy or health information laws, such as Colorado, Delaware, Maryland, New Jersey, and Oregon, may have rights similar to those in Section 4. We honor the rights in Section 4 for every request, whether or not a particular state’s law applies to us.

6. State Attorneys General

If we deny your appeal, you may contact your state Attorney General, including:

• Washington: Office of the Attorney General, www.atg.wa.gov
• Nevada: Office of the Attorney General, ag.nv.gov
• Connecticut: Office of the Attorney General, portal.ct.gov/ag
• California: Office of the Attorney General, oag.ca.gov
• Virginia: Office of the Attorney General, www.oag.state.va.us
• Texas: Office of the Attorney General, www.texasattorneygeneral.gov
• Indiana: Office of the Attorney General, www.in.gov/attorneygeneral

7. Changes to This Notice

We may update this State Notice from time to time. We will revise the “Last Updated” date and, for material changes affecting how we handle health information, notify you and obtain any consent required by law before the change applies.

8. Contact Us

For questions about this State Notice, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com