Website Privacy Policy

Last Updated: October 27, 2026

Version 1.3

1. Introduction and Scope

Mirri Diabetes LLC (“Mirri,” “we,” “us,” or “our”) runs the website at www.mirridiabetes.com (the “Website”). This Website Privacy Policy explains what the Website collects when you visit it, join our mailing list, tell us you are interested in clinical use, or book a call with us, and what we do with it.

It does not cover our software. MIRRI One, our mobile app, and Mirri Cloud, including its website at cloud.mirridiabetes.com, have their own Privacy Policies and Consumer Health Data Privacy Policies, and asking to join a Mirri focus group or research panel is covered by our Research Participation Consumer Health Data Privacy Policy. Each is published at www.mirridiabetes.com/legal.

2. What the Website Collects

Visiting the Website. You can read the Website without telling us who you are. The Website has no accounts and no sign-in, and its own code includes no advertising or session-recording tools and no third-party analytics. Like every website, it receives the technical details your browser sends with each request, such as your IP address, your browser type, and the page you asked for; Cloudflare, which hosts the Website, handles those requests for us (Section 5). The Website’s typefaces are served from the Website itself, so your browser does not contact a font service or any other company to show them. Cloudflare also gives us daily totals of the requests it handles for each of our web addresses (how many, how much data, and how many failed), which identify no one; we use them to check that the Website is working.

Counting visits. To see which pages people read and how the Website is working, the Website counts visits itself. When a page opens, a small script on it tells our own server which page it is, whether you came from another website (and, if so, only that website's name, never the page you came from), and any campaign tag in the link you followed (such as "utm_source=linkedin"). When you leave the page, it tells our server whether you went on to another page of the Website, roughly how long the page was in view, in one of four bands (under 10 seconds, 10 to 30 seconds, 30 seconds to 2 minutes, or longer), and how well the page performed as your browser measured it: how quickly its main content appeared, how quickly it responded to a tap or a key, and how much its layout moved, each only as one of three grades (good, needs improvement, or poor), never as a timing. Our server works out whether you are on a phone, a tablet, or a computer from the description your browser sends, and takes the country and the region (for the United States, the state) that Cloudflare already works out from your network address. It never keeps your city, your postal code, or a precise location. The region is counted once per visit, as a daily total of its own that is never combined with the pages you read, your device, or where you came from, and our internal dashboard shows a region with fewer than five visits only as part of “other regions.” It then adds one to a count for the day, such as "views of the Press page" or "visits from phones", and keeps nothing else: it does not store your IP address or your browser's description, it sets no cookie, the script stores nothing in your browser, and nothing links one page view to another, so the counts cannot tell us who you are or follow you from page to page. The script sends nothing if your browser sends a Do Not Track or Global Privacy Control signal, or if it is run by an automated browser. The daily counts are kept in our Cloudflare account (Section 5) for about 25 months. They are aggregate information that cannot be associated with any visitor, and we handle them as deidentified data under the Washington My Health My Data Act (RCW 19.373.010) and similar state laws: we commit publicly here not to try to identify anyone from them, and Cloudflare, which stores them for us, may use them only to provide services to us.

Mailing list. On our home page you can join our mailing list with your email address. On our QR-code page (www.mirridiabetes.com/qr) you can join it with your first and last name and your email address. Pressing “Join” confirms that you are 18 or older and that you want emails from Mirri. When you book a call on our booking page (www.mirridiabetes.com/booking), you can also join the mailing list by ticking “Add me to Mirri’s mailing list.” The box is optional and starts unticked. Ticking it confirms that you want emails from Mirri; the booking page already asks you to confirm that you are 18 or older. The page sends your first and last name and your email address to our customer-relationship system’s sign-up function, the same one our sign-up forms use, and only after your booking request goes through. If you leave the box unticked, nothing is sent to the mailing list. We store your email address (and, from the QR-code page or the booking page, your name), the list you joined, whether you joined with your name or with your email address alone, and when you joined and confirmed, in our customer-relationship system. We send one email to confirm, and you are added to the list only if you confirm it. Every list email has a one-click unsubscribe.

Clinical interest. On our page for clinicians and researchers you can tell us you are interested in clinical use of Mirri Cloud, with your first and last name and your work email address. Sending it confirms that you are 18 or older. We keep these details only to contact you about clinical use of Mirri Cloud, and sending them does not sign you up for other emails.

Booking a call. On our booking page (www.mirridiabetes.com/booking) you can book a 15- or 30-minute call with us. You give your first and last name, your email address, and, if you choose, a short note about what you would like to talk about, and you confirm that you are 18 or older. The page sends these, with the time you picked, to the booking function of our customer-relationship system. Before you can book, Cloudflare Turnstile checks that a person, not an automated program, is using the page (Section 5). We email you a link to confirm the call, and nothing is booked until you do. We then keep your booking, with your name, email address, and note, in our customer-relationship system and our calendar, to hold the call and follow up on it. If you tick the mailing-list box, you join the mailing list as described above, and only once you confirm it.

Protecting the forms. To stop automated and abusive sign-ups, our customer-relationship system limits how many sign-ups it accepts from one network and for one email address. For that it keeps only scrambled (salted and hashed) forms of the network address your request comes from and of the email address you give, for 30 days, and it uses them for nothing else. Each form also has a hidden field that people never see; a program that fills it in is ignored. When Cloudflare Turnstile is turned on for our sign-up forms, it also checks that a person is using the form (Section 5).

Contacting us. The form on our Contact page sends nothing to us: it opens a pre-filled email in your own email app or email website, and we receive only what you choose to send.

3. Sign-ups on a Website About Diabetes

None of our forms asks about your health. We still treat a mailing-list sign-up, a clinical-interest request, and a booking made on the Website as consumer health data under laws such as the Washington My Health My Data Act and the Nevada Consumer Health Data Privacy Law, because signing up on a website about diabetes, or from a page about living with type 1 or type 2 diabetes, may suggest something about your health or the health of someone close to you.

We collect it only with your consent, which you give by pressing the form’s button after reading what the form says. We use it only for what you asked for: emails from us, news about clinical use, or the call you booked. We do not sell it, use it for advertising, or share it except with the service providers in Section 5, and we do not combine it with any information in MIRRI One or Mirri Cloud, even if you use them with the same email address. You can withdraw your consent, and have your information deleted, at any time (Section 8).

4. How We Use Information

• To send the emails you asked for, and to confirm your sign-up or booking.
• To arrange, hold, and follow up on a call you booked.
• To keep the Website and our forms secure, and to stop automated or abusive use.
• To comply with law.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for profiling. We do not collect, use, or sell personal information from the Website to train large language models.

5. Service Providers

We use a small number of service providers to run the Website and its forms. They process information on our behalf and only to provide services to us.

• Cloudflare. Cloudflare hosts the Website, runs our domain’s name service, protects the Website from automated traffic, and stores the Website’s daily visit counts for us (Section 2). It receives the technical details of every visit, including your IP address and browser details. Cloudflare may add a small script to the Website’s pages to check for automated traffic, and may set a strictly necessary security cookie when it checks a visit. Cloudflare also provides the network in front of our customer-relationship system’s host, so it carries what our forms and booking page send.
• Cloudflare Turnstile. Turnstile runs a check in your browser on the booking page before you can book, and, when it is turned on for them, on our mailing-list and clinical-interest forms, including the booking page’s mailing-list box, the first time you use one; on those forms it loads only then, not when a page opens. It receives your IP address and browser details, and our booking function sends Cloudflare your IP address and the check’s result to confirm it. Our booking function also uses your IP address to limit repeated booking attempts.
• Supabase. Supabase hosts the database and functions of our customer-relationship system, which stores what you give us through our forms and the booking page. That system is separate from Mirri Cloud.
• Zoho and Resend. Our email providers, Zoho and Resend, send our confirmation, booking, and mailing-list emails. They receive your email address, your name if you gave one, and the email we send you. Resend delivers its emails through Amazon Web Services’ email infrastructure.

6. Cookies, Do Not Track, and the Global Privacy Control

The Website’s own code sets no cookies. It stores one setting in your browser: that you dismissed the cookie notice, so that the notice is not shown again. That setting says nothing about you, and clearing your browser’s data for the Website removes it. The only cookie a visit may receive is the strictly necessary security cookie that Cloudflare may set when it checks a visit for automated traffic. We do not use Cloudflare Web Analytics or any other third-party analytics service on the Website; the visit counts in Section 2 are our own, kept as daily totals that identify no one, and Cloudflare’s daily request totals (Section 2) come from its own records of the requests it handles, not from anything on the Website’s pages.

This section also says how the Website responds to Do Not Track signals, as California’s Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575) requires. Other than the requests your browser makes to Cloudflare described in Section 5, we do not allow third parties to collect personal information about your online activities over time and across different websites or online services through the Website. The Website does no such tracking. Even so, our visit counter treats a “Do Not Track” signal as a request not to be counted, and sends nothing. We honor the Global Privacy Control and other recognized opt-out preference signals, as California (Cal. Code Regs., tit. 11, § 7025) and other states require, as a request to opt out of any sale or sharing of personal information, although we do neither; on the Website they also turn off our visit counter (Section 2).

7. Retention

• Visit counts: daily totals, about 25 months (Section 2). They identify no one.
• Mailing list: until you unsubscribe or ask us to delete your information. After you unsubscribe, we keep a record that you did, so that we do not email you again.
• Clinical interest: until we have told you about clinical use of Mirri Cloud, or until you ask us to delete it.
• Bookings: for as long as we need them to hold the call and keep a record of our contact with you, or until you ask us to delete them.
• Scrambled network and email addresses used to limit sign-ups (Section 2): 30 days.
• Technical details of visits: for the short periods our hosting provider keeps them under its own practices. We read Cloudflare’s daily request totals when we look at them and keep no copy.

8. Your Rights

Wherever you live in the United States, you may ask us to confirm whether we hold personal information about you and to give you a copy of it; correct it; delete it; withdraw your consent to our collecting and sharing it; and give you a list of the third parties with which we have shared it, with a way to contact each. You may also opt out of any sale, targeted advertising, or profiling, none of which we do. You can unsubscribe from our mailing list at any time with the link in any list email.

To make a request, email support@mirridiabetes.com. We take reasonable steps to verify your identity, usually by confirming that you control the email address you gave us, and we accept requests from authorized agents with proof of authorization. We confirm receipt within 10 days and respond within 45 days, which we may extend once by 45 days with notice. If we decline your request, you may appeal by replying to our decision or by emailing support@mirridiabetes.com with “Appeal” in the subject line, and we will tell you in writing within 45 days what we decided and why. If we deny your appeal, you may contact your state Attorney General; our U.S. State Health Privacy Notice lists several. We do not discriminate against you for using these rights.

9. Children

The Website is not directed to children under 13, and we do not knowingly collect personal information from children under 13, as the Children’s Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and the Federal Trade Commission’s rule under it (16 C.F.R. Part 312) use those terms. Our forms and booking page are for people 18 or older. If you believe a child has given us information through the Website, contact us at support@mirridiabetes.com and we will delete it.

10. Security

We use administrative, technical, and physical safeguards designed to protect the information the Website collects, including encryption in transit and access controls on our customer-relationship system. No method of transmission or storage is completely secure, and we do not guarantee that our safeguards will prevent every incident. If a breach affecting your information occurs, we will provide notice as required by law.

11. Legal Process and Government Requests

We disclose information from the Website only when valid legal process requires it or the law otherwise requires us to. We review every request for scope and validity, provide only what it lawfully requires, and tell you about it before we respond unless we are legally prohibited from doing so. We do not voluntarily disclose information to any government body.

12. International Users

The Website is intended for people in the United States, and we operate it from the United States. If you use it from elsewhere, you understand that your information will be processed in the United States.

13. Changes to This Website Privacy Policy

We may update this Website Privacy Policy from time to time. When we do, we will revise the “Last Updated” date and post the new version on the Website. If a change materially affects how we collect, use, or share consumer health data, we will obtain any consent the law requires before the change applies to you.

14. Contact Us

For questions about this Website Privacy Policy, or to exercise your rights, contact us at:

Mirri Diabetes LLC

300 Main St., Ste. 900

Lafayette, IN 47901, United States

support@mirridiabetes.com