Consumer Health Data Privacy Policy
Last Updated: July 20, 2026
1. Introduction and Scope
This Consumer Health Data Privacy Policy (“CHD Policy”) is published by Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) and provides the specific disclosures required for “consumer health data” under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act, and similar state laws, as they relate to Mirri Studio (“Studio”).
Studio is a portal that lets organizations — such as diabetes camps, community or support groups, and care teams — and their authorized staff (“Organization Users”) receive, view, and manage diabetes- and metabolic-health information that individuals choose to share with them through Mirri’s consumer applications, Mirri One and Mirri Navigator (the “Consumer Apps”). This CHD Policy supplements, and should be read together with, the Studio Privacy Policy and Studio Terms of Service. If anything here conflicts with the Studio Privacy Policy regarding consumer health data, this CHD Policy controls as to that data.
“Consumer health data” means personal information that identifies a consumer’s past, present, or future physical or mental health status — here, the diabetes- and metabolic-health information handled in Studio.
Studio is currently a non-HIPAA service. It is not offered to HIPAA covered entities or business associates for the handling of protected health information, and Mirri does not act as a business associate. This CHD Policy addresses consumer-health-privacy laws, not HIPAA.
2. Categories of Consumer Health Data in Studio
- Health information an individual logs in a Consumer App and chooses to share with an organization, such as glucose values, insulin doses, medications, meals and carbohydrates, physical activity, symptoms, and notes.
- Health-platform categories the individual authorized a Consumer App to read (such as glucose, insulin, medications, meals/carbohydrates, and activity) and chose to share.
- Information about the individual’s health conditions and care that the individual chooses to share.
Studio receives only the categories that individuals choose to share. We do not use geolocation to infer health conditions.
3. Sources of Consumer Health Data
We receive consumer health data in Studio from the individual, through the Consumer Apps, when the individual (or an adult managing another person’s profile) chooses to share it with an organization and its Organization Users. Studio does not collect consumer health data directly from individuals.
4. Purposes for Using Consumer Health Data
- To make the shared information available to, and displayable by, the organization and Organization Users the individual selected.
- To deliver, route, secure, and support Studio and respond to requests.
We do not use consumer health data for advertising or data mining, and we do not use it for any research or other secondary purpose except with the individual’s separate, explicit permission.
5. How We Share Consumer Health Data
We share consumer health data only:
- With the organization and Organization Users the individual selected through the Consumer Apps’ Sharing feature, within the permissions the organization sets. The organization and its users are chosen by the individual and are responsible for their own use of the information.
- With our service providers — such as cloud hosting and infrastructure providers — who process data on our behalf under contracts that require them to protect it and use it only to provide services to us.
We do not share consumer health data with any other third parties or affiliates, and we do not sell consumer health data.
6. Consent and Authorization
Consumer health data is received in Studio at the individual’s direction, based on the affirmative, opt-in consent the individual provided in the Consumer App before sharing began. Individuals may withdraw consent and stop sharing at any time from the Consumer App; when they do, the organization’s access to further shared information ends. We do not sell consumer health data, and we would not do so without first obtaining a separate, valid written authorization containing all elements required by applicable law.
7. No Geofencing
We do not use a geofence to identify or track consumers seeking health-care services, to collect consumer health data, or to send notifications, messages, or advertisements based on a consumer’s proximity to any health-care facility, provider, or other location that could indicate an attempt to receive health-care services.
8. Your Rights
Subject to applicable law, individuals have the right to: confirm whether we are collecting, sharing, or selling their consumer health data, and access it; withdraw consent to our collection and sharing; have their consumer health data deleted (and have us notify service providers that received it to delete it); and appeal a decision we make about a request. We do not discriminate against individuals for exercising these rights.
How to exercise them. Individuals may exercise these rights primarily through the Consumer Apps and their sharing settings, or by contacting us at support@mirridiabetes.com. We will confirm receipt within 10 days and respond within 45 days (extendable once by an additional 45 days with notice), and we take reasonable steps to verify identity before acting. If we deny a request, you may appeal by replying to our decision or contacting support@mirridiabetes.com; if the appeal is denied, you may contact your state Attorney General. Organizations and Organization Users will reasonably assist individuals in exercising these rights.
9. Retention of Consumer Health Data
We do not retain consumer health data longer than necessary to make it available in Studio. Shared information is available only while the individual’s sharing to the organization remains active; when the individual disables Sharing or revokes access, or the organization relationship ends, we delete it from active systems within 30 days and purge it from routine backups within 90 days — or sooner on request. We will delete consumer health data on request, unless we are required to retain it to comply with applicable law. Information an organization or its users have already accessed, exported, or recorded in their own systems is outside our control.
10. Security
We use administrative, technical, and physical safeguards designed to protect consumer health data, including encryption in transit and at rest, role-based access controls, and monitoring. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting health information occurs, we will provide notice as required by law, including the FTC Health Breach Notification Rule and applicable state laws.
11. Changes to This CHD Policy
We may update this CHD Policy from time to time. We will revise the “Last Updated” date and, for material changes affecting how we handle consumer health data, obtain any consent required by law before the change applies.
12. Contact Us
For questions about this Consumer Health Data Privacy Policy, or to exercise your rights, contact us at:
Mirri Diabetes LLC
300 Main St., Ste. 900
Lafayette, IN 47901, United States
Mirri Diabetes