Mira Health

Privacy Policy

Last updated: July 27, 2026. Version v1.

This policy explains what Mira Health, Inc. ("Mira Health," "we," "us") collects when you use the Mira Health applications and website, why we collect it, who else can see it, and the choices and rights you have.

Mira Health handles information about your medications and your health. We treat it as sensitive, and this policy is written to be specific rather than vague.

Mira Health is a direct-to-consumer service and is generally not a HIPAA covered entity. That means the information you give us is usually not "protected health information" under HIPAA and is not protected by it. It is protected by this policy and by consumer-privacy and health-privacy laws. If you joined through a healthcare provider that has a separate agreement with us, different rules may apply to information we handle for them.

1. Information we collect

Account details. Your name, and the email address or mobile number you sign up with. If you sign up by text message only, we generate an internal placeholder email address for your account. We store a hashed version of your password if you set one, and short-lived login codes used to verify you.

Health profile. Sex, date of birth, height, weight, and smoking history, where you choose to provide them. These are used to tailor recommendations and calculate figures such as BMI.

Medications. Names, strengths, dosage forms, directions, quantities and supply counts, schedules, and photographs of prescription labels you choose to scan. Label photographs may contain your name, your prescriber's name, and your pharmacy's details.

Adherence. Whether and when you marked a dose taken, missed, or skipped, any reason you selected, and refill and supply activity.

Assistant conversations. What you send to the in-app assistant, its replies, and short summaries it keeps so it can remember useful context between conversations.

Check-ins and recommendations. Your answers to in-app questions and the recommendations generated from them.

Sharing and relationships. Your family group and friend connections, the profiles you create for family members or pets, your sharing and visibility settings, and any organization you belong to.

Notification settings and delivery. Your preferred channel, your device push subscription, and records of notifications we generated and attempted to send.

Technical information. Basic logs needed to operate and secure the Service, such as timestamps, request and error records, and rate-limiting and abuse-prevention signals.

Information about other people. If you create a profile for a family member, add a friend by email or phone number, or invite someone, you are giving us information about them. Please only do this where you are entitled to.

We do not collect payment information. The Service is currently free.

2. Why we use it

We use your information to:

  • create and secure your account, and verify it is you
  • generate your reminders and deliver them on the channel you chose
  • project when a medication will run out and raise refill and low-supply alerts
  • answer your questions through the assistant, and retrieve relevant reference material to inform its answers
  • read prescription details from label photographs you scan
  • produce check-in questions and personalized recommendations
  • show the people you have chosen exactly what your settings allow
  • operate, debug, monitor, and secure the Service, and prevent abuse
  • comply with law and enforce our Terms of Use

We do not use your information for advertising, and we do not build advertising profiles.

3. We do not sell your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws. We have not done so in the past twelve months.

4. How your information is processed by AI

Two parts of the Service use artificial intelligence provided by Amazon Web Services:

  • the assistant, which answers your questions
  • label extraction, which reads medication details from a photograph you scan

To do this, the relevant content — your message and related context, or the label image — is sent to Amazon Bedrock for processing. Our provider does not use this content to train or improve its foundation models, and it is not retained by the model provider after processing.

We also convert reference material and some of your content into numerical representations ("embeddings") stored in our own database, so the assistant can find relevant context. Those stay with us.

The assistant's output is generated automatically and may be wrong. It is not medical advice, and we do not make decisions about you that produce legal or similarly significant effects using automated processing alone.

5. Who can see your information

You, always.

People you share with. Family members and friends see only what your sharing and visibility settings allow, and only while those settings allow it. You can change or withdraw this at any time, though you cannot undo what someone has already seen.

Organizations you join. What an organization can see depends on what kind it is:

  • Employers and wellness programs see only aggregate, de-identified activity across their members — for example, how many people are enrolled or active. They do not see your medications, your health profile, your assistant conversations, or your individual adherence.
  • Clinics and care organizations, where you have joined for care, may see individual information about you as part of providing that care, including medications and adherence. If you belong to one, ask them for their own privacy notice, which governs what they then do with it.

If you are unsure which kind of organization you belong to, or what it can see, contact us and we will tell you.

Service providers who operate parts of the Service for us, under contracts that limit them to that purpose:

  • Railway — application hosting and database infrastructure (United States)
  • Amazon Web Services — AI processing via Amazon Bedrock, and storage of label photographs (United States)
  • OneSignal — push notification delivery
  • Twilio — text message delivery and phone number verification
  • Meta Platforms — if you choose to receive messages on WhatsApp, the content of those messages is delivered through WhatsApp and is subject to Meta's own privacy practices. You can switch back to standard SMS at any time in your settings.
  • Twilio SendGrid — email delivery

Legal and safety. We may disclose information if required by law, subpoena, or court order, or where we believe in good faith it is necessary to investigate fraud or a violation of our Terms, or to prevent serious harm to someone. Where we are permitted to tell you first, we will try to.

Business transfers. If Mira Health is involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of it. We will give you notice, and the recipient will remain bound by this policy or give you notice of a new one before anything changes.

6. Where your information is processed

Mira Health is operated from the United States and your information is stored and processed there. If you use the Service from outside the United States, understand that U.S. law will apply to it.

7. How long we keep it

  • Account and health information — for as long as your account is active.
  • After you ask us to delete your account — removed from our live systems within 30 days, and from routine backups within 90 days.
  • Assistant conversations — while your account is active. You can delete individual conversations at any time.
  • Label photographs — while the medication record exists. Deleting the medication deletes the photograph.
  • Login codes and sessions — short-lived; codes expire quickly by design.
  • Technical and security logs — generally up to 90 days.

We may keep information longer where we are legally required to, or where we need it to resolve a dispute or enforce our agreements. Anything we keep for those reasons stays subject to this policy.

8. How we protect it

We encrypt information in transit, store it on infrastructure with encryption at rest, hash passwords rather than storing them, expire login codes quickly, and limit internal access to those who need it to run the Service.

No service can promise perfect security, and we do not. If a breach affects your information, we will notify you and the appropriate regulators as the law requires, including under the Federal Trade Commission's Health Breach Notification Rule where it applies.

9. Your choices and your rights

You can, at any time:

  • view and edit your health profile, medications, and schedules
  • change what family members and friends can see, or disconnect from them
  • change your notification channel, or turn notifications off
  • reply STOP to any text message to stop text messages
  • delete individual assistant conversations

Depending on where you live, you may also have the right to:

  • know and access what we hold about you
  • correct inaccurate information
  • delete your information
  • obtain a portable copy
  • opt out of sale, sharing, or targeted advertising — we do none of these
  • limit the use of sensitive personal information
  • not be discriminated against for exercising these rights

How to exercise them. Email info@mirahealth.org with what you would like us to do. We will verify your request against the account, usually by confirming control of the email address or phone number on it, and respond within 45 days. If we need more time, we will tell you why. There is no charge for a reasonable request.

Authorized agents. You may use an authorized agent, who must provide proof you permitted them to act for you.

Appeals. If we decline your request, you may appeal by replying to our decision. We will respond within 45 days with our reasoning. If we deny your appeal, you may contact your state attorney general.

10. Consumer health data

This section applies in addition to the rest of this policy, and is provided for residents of Washington, Nevada, and other states with specific consumer health-data laws.

The consumer health data we collect is described in section 1 — principally your health profile, medications and label photographs, adherence records, and what you tell the assistant. We collect it directly from you, use it for the purposes in section 2, and share it only as described in section 5.

We do not sell consumer health data, and we do not collect precise geolocation. You may withdraw your consent to our collection and use of your consumer health data, and request its deletion, by emailing info@mirahealth.org. Withdrawing consent may mean we can no longer provide reminders or other core parts of the Service.

11. Children

The Service is for adults. You must be 18 or older to hold an account, and we do not knowingly collect information from anyone under 18 who has signed up directly.

An adult may create a profile within their family group to manage medications and reminders for a child in their care. That profile is controlled by the adult who created it and visible only to family members they permit. If you believe a child has created their own account, contact us and we will remove it.

12. Changes to this policy

We may update this policy. If a change is material, we will give you notice and ask you to review it before you continue using the Service. The version and date at the top always reflect the current policy.

13. Contact

Questions about privacy, or to make a request about your information:

  • Email: info@mirahealth.org
  • Mira Health, Inc., Delaware, United States