1. Overview
This Privacy Policy explains how Mirror Health (“Mirror,” “we,” “us,” or “our”) handles information when you use the Mirror mobile application, tablet or household-display experiences, website, beta program, and related services (collectively, the “Services”).
Mirror is built for individuals, parents, family members, and caregivers who want a calmer, more readable view of connected health information. The features available to you may depend on your device, operating system, region, and the integrations you choose to connect.
We do not sell personal information or health data. We do not use health data for targeted advertising, data-broker activity, or unrelated marketing profiles.
2. Information we handle
Information you provide
- Account and profile information: name, email address, profile image, and information about whether you manage your own health or care for someone else.
- Beta and support information: beta application answers, CGM type, device preferences, feature interests, messages, and other information you choose to send us.
- Settings: display units, alert thresholds and preferences, night mode, selected profile, connected-source settings, and other app choices.
- Connection information: a Nightscout server address and read-only access token, or authorization records needed to connect supported services such as Dexcom.
Health and wellness information
Depending on the connections and permissions you enable, Mirror may access and display glucose readings, trends, timestamps, direction and range information, heart rate, resting heart rate, heart-rate variability, oxygen saturation, sleep information, activity, and related source or device status.
Mirror requests access only when you activate a feature that needs it. Available categories may change as the Services develop, but any new category will require the applicable platform permission or connection authorization.
Technical information
Our website and infrastructure providers may process standard technical information such as IP address, browser or device type, operating system, request time, referring page, and security logs. The current mobile app does not include an advertising SDK or a general-purpose analytics SDK. App errors are currently logged locally to the development console rather than sent with glucose or connected-health values to a third-party crash-reporting service.
3. Connected health sources
Nightscout
When you connect Nightscout, Mirror retrieves recent glucose entries and connection status from the Nightscout server you specify. The current mobile integration is read-only and does not post treatments or change data on your Nightscout server. Mirror asks for a read-only token, not your Nightscout API_SECRET.
Mirror first attempts to send the Nightscout token in an authorization header. If a Nightscout server supports only the legacy token-in-URL method, Mirror may retry using that method. In that case, the token can appear in the request URL handled by your Nightscout server and network infrastructure.
Dexcom and other CGM services
Where supported, you authorize CGM access through the provider’s own connection or authorization process. Mirror uses the resulting authorization to retrieve and display the information needed for the features you request. The provider’s privacy policy also applies to information it processes.
Apple Health and Health Connect
Mirror requests read-only access to selected categories used to provide visible health context. Current planned categories include heart rate, resting heart rate, heart-rate variability, oxygen saturation, and sleep. Mirror does not write health data to Apple Health or Health Connect in the current build. You can approve or deny categories and change permissions in your device settings.
Mirror Insights
Mirror Insights is being developed to summarize connected trends. Current public previews do not represent active medical analysis, and the current app does not transmit your health data to a third-party generative-AI provider for this feature. If that changes, we will provide an additional disclosure, identify the processing involved, and obtain any consent required before the feature is enabled.
4. How we use information
We use information to:
- display the readings, trends, source status, and other information you choose to connect;
- provide Nightstand, Mirror Direct, alert, and accessibility features;
- maintain your account, profile, settings, and authorized integrations;
- respond to beta applications, support requests, feedback, and safety concerns;
- secure, troubleshoot, maintain, and improve the Services;
- comply with law and enforce our agreements; and
- provide notices or request consent when a new use requires it.
We do not use health information from Apple Health, Health Connect, Nightscout, Dexcom, or another connected source for advertising, marketing-based data mining, insurance underwriting, credit decisions, or sale to data brokers.
6. Storage and security
Mirror is designed to minimize persistent health-data storage. In the current mobile architecture, Nightscout server information and the read-only token are stored using secure device storage backed by the iOS Keychain or Android Keystore. Recent Nightscout readings and Apple Health results are held in app memory for the active session and re-fetched when needed rather than written to a local historical-health database. Non-sensitive interface preferences may be stored locally on your device.
Hosted account or synchronization features may store the information needed to operate those features using our service providers. We use reasonable administrative, technical, and organizational safeguards intended to protect information, including access controls and encrypted network connections where supported. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
You are responsible for protecting your device, account credentials, Nightscout instance, and connected-service credentials. Use a read-only Nightscout token and never enter a Nightscout API_SECRET into Mirror.
7. Retention and deletion
We retain personal information only for as long as reasonably needed to provide the Services, maintain security, meet legal obligations, resolve disputes, and enforce agreements. Retention depends on the type of information and where it is stored.
- Session-only health readings are cleared when the app session ends.
- On-device credentials and preferences remain until you disconnect the service, clear them, uninstall the app, or erase the device.
- Account, beta, support, and hosted-service records remain while needed for the relevant purpose and may remain temporarily in protected backups.
- Information maintained by Dexcom, Nightscout, Apple, Google, Samsung, or another connected provider is controlled by that provider and your account with it.
You may request account deletion or deletion of information we control by contacting us. We may retain limited records where required by law, necessary for security, or needed to document the request.
8. Your choices and rights
You can:
- choose which integrations to connect and disconnect them at any time;
- manage Apple Health and Health Connect permissions in device settings;
- change app preferences and alert settings;
- request access, correction, export, or deletion of personal information we control; and
- withdraw consent where our processing relies on consent.
Depending on where you live, you may have additional privacy rights, including rights to know, access, correct, delete, restrict, or receive a portable copy of personal information; to appeal a denied request; and to opt out of certain sales, sharing, or profiling. Mirror does not currently sell personal information or use it for targeted advertising.
To make a request, email info@usemirrorhealth.com. We may need to verify your identity and authority over the account. Authorized agents may submit requests where permitted by law.
9. Children and family use
Mirror is designed to support families and caregivers, but it is not directed to children to create or manage accounts on their own. A parent or legal guardian must create and manage any account, connection, or permission involving a child and must have the legal authority to provide the child’s information.
If you believe a child provided personal information to us without appropriate parental authorization, contact us so we can investigate and delete it where required.
10. Health and medical notice
Mirror is an informational health companion and supplemental display. It is not a medical device, emergency service, or substitute for your CGM receiver, manufacturer application, official alerts, approved medical devices, professional medical advice, diagnosis, treatment, or care plan. Always use your approved device and follow your clinician’s guidance when making treatment decisions.
Mirror is generally offered directly to individuals and families, not on behalf of a healthcare provider or health plan. Information in Mirror may therefore not be protected by HIPAA unless a specific relationship and written agreement make HIPAA applicable. Other consumer privacy and health-data laws may still apply.
11. Changes to this policy
We may update this Privacy Policy as Mirror develops. We will post the revised policy here and update the “Last updated” date. If a change materially affects how we use sensitive information, we will provide additional notice and request consent when required.
12. Contact us
For privacy questions, requests, or concerns, contact Mirror Health at info@usemirrorhealth.com.