Privacy Policy

Privacy Policy for Miirror

MIIRROR INC. — PRIVACY POLICY

Last Updated: August 24, 2026

1. Introduction

Miirror ("Miirror," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Miirror mobile application (the "App") and the services connected to it, including the Miirror web dashboard your care team uses. Please read this policy carefully. If you do not agree with its terms, please discontinue use of the App.

Miirror is a recovery-support tool for people working through eating disorder recovery. It offers self-guided practices — a voice journal, urge surfing, coping skills, a self-compassion toolkit, guided meditations, daily mood check-ins, and affirmations — and it can also connect you, with your consent, to your clinical care team and to an organization that supports you. Because much of what you enter into Miirror is information about your health, we treat it with the highest level of care and discretion.

Miirror is a support tool, not a replacement for medical or mental-health care, and it does not provide emergency services. If you are in crisis, call or text 988 (988 Suicide & Crisis Lifeline), text HOME to 741741 (Crisis Text Line), or call the NEDA Helpline at 1-800-931-2237. These resources are reachable from the crisis button in the App at all times.

2. Information We Collect

2.1 Account and Profile Information

• Account credentials: your email address and a password. Passwords are stored only as salted hashes; we cannot read them. Miirror does not offer Sign in with Apple, Google sign-in, or any other social login.

• Profile details collected during onboarding: your first and last name and your date of birth (required), and optionally your pronouns, country, and postal/ZIP code.

• Optional contact details you can add in your Profile: a phone number.

• Care-record details that may be recorded by you, your care team, or your organization: a medical record number and the name and phone number of an emergency contact.

2.2 Onboarding and Check-In Responses

• Onboarding questionnaire: your answers about what feels hardest right now, your goals, what has and hasn't helped before, what recovery looks like for you, where you are in your journey, and how you'd like to be supported. Every question other than your name and date of birth can be skipped, and several allow a free-text "Other" answer.

• Check-ins: optional before-and-after "Quick check-in" questions around each practice, which can include free-text answers.

• Organization connection choice: if your email address belongs to an organization registered with Miirror, whether you chose to connect with that organization (see Section 4.3).

2.3 Mood and Practice Data

Everything you record in the App's practices is stored in your account:

• Daily feeling: the mood you select each day (Happy, Calm, Neutral, Sad, or Stressed).

• Voice Journal: the audio recordings you make (up to 10 minutes each), the title you give each one, and when it was recorded. Recordings are stored as audio files. They are not transcribed, and they are not processed by any artificial-intelligence or speech-recognition service.

• Urge Surfing: which urge you are experiencing (including any urge you describe in your own words), how strong it feels before and after the practice, whether you feel able to pause safely before acting on it, where you notice it in your body, what it feels like, and the words you use to name it.

• Coping Skills: for the Kindness Script, the observations you write about what you see in the mirror and your optional reflection on what prompted the practice and how you feel afterward; for Box Breathing, only that you completed it and for how long.

• Toolkit (Self-Compassion Toolkit): the feelings you identify, where you feel self-criticism in your body, your description of what you notice, the self-critical thought you choose to work with, and what you need right now.

• Meal Practice (where available): the meal type, whether you did or skipped the grounding practice, your hunger level, the plan you chose, and the mood you record before eating.

• Meditations: which meditations you listened to, for how long, and whether you finished.

• Affirmations: the affirmations you write and the ones you mark as favorites.

• Starred tools: which tools you have starred in the Tools grid.

• Tool activity: when you start and finish each practice. (The Daily Challenge's completion status is stored only on your device.)

2.4 Crisis Resource Use

When you open the crisis resources page in the App, or tap one of the crisis lines on it (988, the Crisis Text Line, or the NEDA Helpline), Miirror records that you did so and when. We record this because reaching for crisis support is the most important signal your care team can have. The calls and texts themselves go directly to those services and never pass through Miirror.

2.5 Care Team and Organization Information

• Care relationships: the clinicians you invite or who invite you, the status of each relationship (pending, active, declined, or ended), the optional note attached to a request, and the timestamps of consent and revocation.

• Care notes: notes that members of your care team write about you and share with one another on the Miirror dashboard.

• Feature settings: whether a member of your care team has turned a particular tool on or off for you, and the reason they recorded.

• Organization membership: whether you are connected to an organization, and when you connected or disconnected.

2.6 Feedback

Anything you type into the "Submit Feedback" form is stored in your account and read by Miirror staff. Because this box is open-ended, we treat its contents as health information. Nobody replies to feedback in the App.

2.7 Information Collected Automatically

• Device name: when you sign in, the App sends your device's model name (for example, "iPhone 15 Pro") so you can recognize each sign-in on the Signed-In Devices screen, together with the time you signed in and were last active.

• IP address and device/app identifier (user agent): recorded when you accept an agreement, when you sign in or fail to sign in, when a member of your care team or Miirror staff opens your record, and to enforce the rate limits that protect against automated abuse.

• Usage analytics and crash reports (PostHog — see Section 5): PostHog receives your opaque Miirror account ID; the screens you visit in the App (which reveals which tools you use, but not what you enter into them); sign-in, registration, verification, and password-reset events and whether they succeeded; your device manufacturer and model, operating system and version, app version, language, and time zone; your IP address, from which PostHog may derive an approximate location; and crash and error reports. Session recording is turned off. The contents of your entries, recordings, moods, and answers are never sent to PostHog.

• Server logs: our servers keep short-lived operational logs identified only by opaque account IDs, never by name or email.

2.8 Information Stored on Your Device

The App stores the following on your device only, in the operating system's secure storage: your sign-in tokens; if you enable Face ID / Touch ID sign-in, your email address and password so the App can sign you in after a successful biometric check (biometric data itself never leaves your device and is never available to Miirror); a cached copy of which features are available to you; and which daily challenges you completed today. A voice recording is held in the App's cache while you review it and is discarded if you leave without saving. All of this is cleared when you log out.

2.9 What Miirror Does Not Collect

Miirror does not access Apple HealthKit, Google Fit, or any other health platform; does not collect your location, contacts, photos, or camera; does not use advertising identifiers or track you across other apps or websites; and does not send push notifications. The only device permissions the App requests are the microphone (for Voice Journal) and Face ID / Touch ID (for biometric sign-in, if you turn it on).

3. How We Use Your Information

• To provide the App: to store your entries and play them back to you, to show your mood calendar, and to let your care team support you.

• To show you your Patterns: summaries of your moods, practices, and urge intensity over 7, 30, or 90 days. Patterns are computed from what you have already recorded; nothing new is collected.

• To shape which tools you see: some onboarding answers turn certain tools off by default, a member of your care team can turn tools on or off for you, and the plan attached to your account or your organization determines which features are available. If a tool is turned off, you cannot use it — or, for Voice Journal, listen to existing recordings — until it is turned back on; nothing is deleted.

• To help your care team prioritize: the Miirror dashboard flags a patient as high-risk based on their most recent mood check-in (Sad or Stressed) and flags patients who have not checked in during the past week.

• To keep your account secure: to verify your email address, detect stolen sign-in tokens, lock accounts after repeated failed sign-ins, and show you where you are signed in.

• To communicate with you by email about your account: verification codes, password-reset codes, account-locked notices, and confirmation when you request account deletion. We do not send marketing email, and we do not currently send SMS messages.

• To improve the App through analytics and crash reports (Section 5).

• To maintain the security and audit records that health-privacy law requires (Section 6).

• To comply with legal obligations.

We do not use your information for advertising, and we do not sell, rent, or trade it to anyone.

4. Who Can See Your Information

4.1 You

Your entries, recordings, moods, and Patterns are available to you in the App.

4.2 Your Care Team

A clinician can see your information only after both of you have confirmed a care relationship — you can invite a clinician by email from Profile › Manage Care Team, or accept or decline a request a clinician sends you. Either of you can end the relationship at any time, which removes the clinician's access going forward.

A member of your care team can see: your name, email address, date of birth, pronouns, medical record number, emergency contact, and postal code; each daily mood and the risk indicator derived from it; your Patterns summaries (counts, averages, and one value per day — including how many voice journal entries you have made and their total length); care notes written by your care team; which tools are on or off for you; and your use of crisis resources (Section 2.4), which we record so it can be shown to the people supporting you.

A member of your care team cannot play your voice recordings or see their titles, and cannot see the free text you enter in Urge Surfing, the Kindness Script, the Toolkit, or your check-ins.

Care notes are currently visible to your care team on the dashboard; the App does not yet show them to you. You may request a copy by contacting us (Section 11).

4.3 A Connected Organization

If your email address belongs to an organization that has registered its domain with Miirror (for example, a treatment program or employer), the App will ask whether you want to connect with it. "Yes" is pre-selected; connecting is your choice, and you can disconnect at any time from Profile › Organization. Miirror never lets you or anyone else enroll you in an organization your email address does not belong to.

If you connect, that organization's plan may determine which Miirror features are available to you, and the organization may be alerted when something you enter suggests you may be in crisis or at high risk — such as opening crisis resources or reporting that you may act on an urge — so that someone there can reach out to you. An organization does not otherwise receive your entries, recordings, moods, or Patterns. Disconnecting stops any alerting immediately; it does not delete anything you have saved and does not change your care team.

4.4 Miirror Staff

A limited number of authorized Miirror staff can access patient records to provide support, respond to safety concerns, operate the service, and read feedback. For troubleshooting, a staff member may temporarily act as your account. Every staff access is logged with the staff member's identity and IP address, staff must use multi-factor authentication, and dashboard sessions expire after 30 minutes of inactivity.

4.5 Service Providers

The companies listed in Section 5 process information on our behalf and only as needed to provide their service.

4.6 Legal Requirements

We may disclose information if required to do so by law or legal process, or to protect the safety of you or others.

5. Third-Party Services

Miirror uses the following third-party services to operate the App:

Miirror does not use any artificial-intelligence, language-model, or speech-to-text service, and no recording, transcript, or entry is ever sent to one. Miirror is operated from the United States, and your information is processed there.

6. Data Storage, Security, and Retention

6.1 Security

All traffic between the App and our servers is encrypted in transit using HTTPS/TLS, with HTTP Strict Transport Security enforced. Passwords are stored as salted hashes; sign-in tokens are stored as SHA-256 hashes; refresh tokens are single-use and rotated on every use, and a reused token signs out every session in that family. Voice recordings are stored in a private bucket and reachable only through short-lived signed links. Staff and clinician accounts require multi-factor authentication. Our hosting and storage providers protect stored data with infrastructure-level controls; Miirror does not currently apply additional field-level encryption inside its database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6.2 Audit Records

Every change to a record containing your health information, every time a clinician or staff member opens your record, and every sign-in event is written to an audit log that records what happened, who did it, when, and from which IP address. Audit entries cannot be edited or deleted. When you accept an agreement (such as this policy), we record the version accepted, the time, your IP address, and your device's user agent.

6.3 Retention

• Your entries, recordings, moods, practice records, and crisis-resource records are kept until you delete them (where the App allows) or delete your account. Voice recordings are kept as audio for as long as the entry exists.

• Expired sign-in tokens and one-time codes are purged about 30 days after they expire.

• Copies of the emails we send you are kept in our records and scrubbed when your account is deleted.

• Audit log entries are retained for six years, as health-privacy law requires. After your account is deleted, the health information inside those entries is redacted; only the fact that an action occurred, who took it, and when remains.

• Agreement-acceptance records, care-relationship consent and revocation records, and the record that a deletion was requested and completed are retained as non-identifying audit evidence.

7. Your Rights and Choices

• Review and correct: You can view and change your name, phone number, and pronouns in Profile › Edit Profile, change your password, review your moods in the Mood Calendar, listen to your recordings in Voice Journal, and see your Patterns, Signed-In Devices, and Your Agreements. To review anything else we hold about you — including onboarding answers, practice records, or care notes — contact us (Section 11).

• Delete individual items: You can delete voice journal entries (long-press a recording) and affirmations you have written.

• Delete your account: Go to Profile › Data & Privacy › Delete Account. A 30-day grace period begins immediately: you are signed out everywhere, we email you a confirmation, and you can cancel by signing back in during those 30 days. When the grace period ends, we delete your recordings and audio files, moods, practice records, onboarding answers, affirmations, feedback, care notes about you, sign-in tokens, and profile details; replace your name, email, phone number, and date of birth with blank or opaque values; delete your analytics data from PostHog and any billing customer record from Stripe; and redact your health information from the audit log as described in Section 6.3. Deletion cannot be undone once it has run.

• Export: The App does not yet offer an in-app export. You may request a copy of your information by contacting us (Section 11).

• Care team: Accept, decline, or end a care relationship at any time from Profile › Manage Care Team.

• Organization: Connect or disconnect at any time from Profile › Organization.

• Devices: See every active sign-in and end them all with "Sign out everywhere" from Profile › Signed-In Devices.

• Biometric sign-in: Turn Face ID / Touch ID sign-in on or off from your Profile. Turning it off removes your stored credentials from your device.

• Microphone: You can revoke the App's microphone permission at any time in your device's Settings; Voice Journal will not be able to record until you restore it.

• Analytics: The App does not currently offer an in-app analytics opt-out. You may ask us to delete your analytics data at any time by contacting us, and it is deleted automatically when you delete your account.

• Health-record access: If HIPAA applies to your use of Miirror (Section 9), you have the right to access and obtain a copy of your records and to request corrections. Contact us to exercise these rights.

8. Children's Privacy

Miirror is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. We ask for your date of birth during onboarding. If we become aware that a child under 13 has provided us with personal information, we will delete that information. If you are between 13 and 17, please ensure a parent or guardian has reviewed this policy.

9. HIPAA and Your Care Team

Miirror can connect you with licensed healthcare providers and treatment organizations, and information you and your care team put into Miirror may become part of your health record. Miirror is designed to meet the technical safeguards of the HIPAA Security Rule — access controls based on your explicit consent, immutable audit logs, encryption in transit, multi-factor authentication for clinicians and staff, and written agreements with the service providers that handle your information. When you use Miirror in connection with a healthcare provider or organization that is a HIPAA covered entity, Miirror may act as that provider's business associate, and your provider's own Notice of Privacy Practices also governs how they use your information.

Miirror is not a substitute for clinical care. Using Miirror does not create a provider–patient relationship with Miirror itself, and information you share with a clinician through Miirror is shared at your discretion and under the consent controls described in Section 4.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will publish the new version in the App and ask you to review and accept it before continuing to use Miirror; the crisis resources page remains available while you decide. We record each acceptance as described in Section 6.2, and you can re-read every version you have accepted under Profile › Your Agreements. We may also notify you by email. The "Last Updated" date above reflects the most recent version.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise any of the rights in Section 7, please contact us at: haley.greene@miirrorhealth.com

Miirror Inc.