Mimira AImimira ai

Mimira AI Privacy Policy

Version 1.1 · Effective 07-31-2026

This Privacy Policy explains how Mimira AI LLC ("Mimira", "we", "us") collects, uses, discloses, and safeguards personal data in connection with the Mimira AI platform (the "Services"), as described in the Software Subscription Agreement between Mimira and the clinic customer ("Customer", "Clinic") (the "Agreement").

This Policy forms part of, and should be read together with, the Agreement. Capitalized terms not defined here have the meaning given in the Agreement.

1. Roles: Who Controls What

Mimira's clinic customers collect and use the Services to communicate with their own patients and clients. Two distinct roles apply:

  • Customer as data controller. For personal data about the Clinic's patients, clients, prospects, and the people who message the Clinic through Connected Channels, the Clinic is the data controller and Mimira acts as a data processor - we process that data only to provide the Services, on the Clinic's instructions (including instructions inherent in how the Clinic configures and uses the Services).
  • Mimira as data controller. Mimira acts as an independent controller only for data needed to administer accounts and service access, secure the platform, prevent fraud, bill the Clinic, and comply with our own legal obligations (e.g., admin user accounts, login activity, invoicing records).

As set out in the Agreement, the Clinic is responsible for obtaining all patient, client, employee, and end-user notices and consents required to lawfully provide data to Mimira, and for telling patients about AI-generated responses before those responses are relied on for clinical, medical, legal, financial, or other regulated decisions. Mimira does not provide medical advice, and is not the system of record for patient consent, medical records, or regulatory compliance records - the Clinic remains responsible for its own required records.

2. Data We Collect

Mimira is a business-to-business platform used by Clinics to message their own patients and customers. Mimira does not have a public consumer app; the data described below is collected because a Clinic has enabled a feature or connected a messaging channel, not through general web tracking.

2.1 Clinic Account and Operational Data

Depending on which features the Clinic enables, the Services process:

  • Clinic staff accounts. Name, email address, role, and login/activity records, managed through authentication provider (Clerk).
  • Booking data. Appointment details, assigned treatment/doctor, and status, as entered or confirmed by Clinic staff or captured through conversations.
  • Knowledge base and clinic content. Documents, promotions, procedure information, and promotional images the Clinic uploads for the AI assistant to reference.
  • Conversation history. Chat transcripts retained according to the retention periods described in Section 7.
  • Billing and account data. Subscription plan, branch/user counts, and invoicing details for the Clinic's own subscription with Mimira.
  • Technical data. IP address, browser/device information, and access logs, collected for security and debugging.

Mimira does not collect government ID numbers, payment card numbers, or other sensitive financial data through the Services; the Services do not currently include an integrated payment-processing feature.

2.2 Data Collected Through Connected Channels

"Connected Channels" means the third-party messaging accounts a Clinic authorizes and links to Mimira: LINE Official Account, Facebook Messenger, Instagram Messaging, and WhatsApp Business (Cloud API). To connect a channel, an authorized Clinic administrator completes that platform's own login/authorization flow and selects a specific Page, Instagram professional account, WhatsApp Business number, or LINE Official Account to link. Mimira never accesses a channel or asset the Clinic has not explicitly connected.

Once a channel is connected, Mimira processes the following for each conversation:

  • Sender identifiers. A platform-scoped identifier for the person messaging the Clinic - the Page-scoped user ID (PSID) for Messenger, the Instagram-scoped user ID (IGSID) for Instagram, the WhatsApp-linked identifier for WhatsApp, and the LINE user ID for LINE - together with the display name the platform makes available (for LINE, retrieved via the LINE Profile API).
  • Message content. The text of inbound and outbound messages. For supported image and video messages on LINE and Meta channels (Messenger, Instagram, WhatsApp), Mimira downloads and stores the media file itself so authorized staff can view it in the inbox. Unsupported or non-downloadable media may be represented by a short text placeholder (e.g., "[sticker unavailable]" or "[document] filename") when the platform does not provide retrievable media bytes.
  • Message metadata. Platform-assigned message IDs (used to prevent duplicate processing), timestamps, and message direction (inbound, outbound, or AI-generated).
  • Connection credentials. The access token or channel credentials issued by the platform when the Clinic connects the channel, stored server-side (never exposed in the browser beyond a connection-status indicator) so Mimira can send messages on the Clinic's behalf without repeated re-authentication. See Section 8 for how these credentials are protected.
  • Marketing/broadcast messages. Where a Clinic uses Mimira's broadcast feature to message customers who have opted in on a Connected Channel (currently supported for LINE via LINE's Push Message API, and for WhatsApp subject to Meta's business-initiated messaging and template rules), Mimira records the recipients and content of that campaign.

Data collected through a Clinic's Connected Channels is associated with that Clinic and is not combined with any other Clinic's data. Mimira does not use Connected Channel data for advertising and does not sell it. See Section 6.

3. Legal Basis for Processing

Where applicable data protection law requires a legal basis, Mimira and the Clinic rely on:

  • Contractual necessity - processing needed to deliver the Services under the Agreement.
  • Consent - for optional features (e.g., marketing/broadcast messages), where the Clinic has obtained the patient's or customer's consent as required by applicable law.
  • Legal obligation - recordkeeping, tax, and other compliance requirements.

Where the Clinic processes sensitive personal data (e.g., health-related information disclosed in a patient conversation), the Clinic is responsible for ensuring it has a valid lawful basis, including explicit consent where required.

4. How We Use Data

  • Operating the chat inbox, AI-assisted replies, booking capture, and broadcast/marketing features the Clinic enables.
  • Maintaining the knowledge base used to ground AI responses for the Clinic's own patients.
  • Administering Clinic accounts, staff access, and Mimira billing.
  • Monitoring and securing the platform, including detecting misuse.

5. AI-Assisted Features and AI Data Flows

The Services use AI to help draft or send replies to patient/customer messages and to answer questions from the Clinic's knowledge base. Consistent with Section 9 of the Agreement, this may involve sending message content and relevant knowledge-base context to Mimira's AI sub-processors so they can generate a response; the current AI-related sub-processors are:

  • OpenRouter - used to generate AI chat responses, depending on the model provider selected or configured for the Clinic.
  • Cohere - used to generate embeddings that power knowledge-base search.

Only the data needed for the enabled feature is sent to these providers. Mimira does not permit these sub-processors to use Customer Data to train shared or public models.

Whether the AI assistant identifies itself as an AI to a given patient/customer is a setting the Clinic controls. Per Section 5(f) of the Agreement, the Clinic - not Mimira - is responsible for telling patients about AI-generated responses before those responses are relied on for clinical, medical, legal, financial, or other regulated decisions, and for ensuring that use of AI features complies with applicable law and platform rules.

6. Data Sharing and Disclosure

Mimira does not sell personal data. We share it only as follows:

  • Messaging and social platforms. Message content, sender identifiers, and delivery status are exchanged with LY Corporation (LINE) and Meta Platforms, Inc. (Facebook, Instagram, WhatsApp) via each platform's official messaging APIs and webhooks, under their own terms, and only for the specific Connected Channels a Clinic has enabled.
  • Infrastructure sub-processors. Clerk (authentication), Supabase (database and file storage), and Vercel (application hosting and media storage) process data on Mimira's behalf to run the Services.
  • AI sub-processors. OpenRouter and Cohere, as described in Section 5.
  • Other integrations named in the Agreement. The Agreement contemplates that the Services may also integrate with additional AI, calendar, payment, or workflow providers if and when those integrations become available to the Clinic; Mimira will update this Policy as those integrations are enabled.
  • Legal requirements. We may disclose data where required by law, court order, or valid regulatory request, disclosing only what is legally required.
  • Business transfers. In connection with a merger, acquisition, or sale of substantially all assets, consistent with the assignment terms of the Agreement.

Each Clinic's data is logically isolated from other clinics on the platform.

Meta Platform compliance. Mimira's collection, use, and transfer of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including applicable Limited Use requirements. Mimira does not use data obtained through the Messenger Platform, Instagram Messaging, or WhatsApp Cloud API for advertising, and does not transfer it to any ad network, data broker, or other third party except the sub-processors listed above, which act solely to help Mimira provide the Services.

LINE Platform compliance. Mimira's use of the LINE Messaging API adheres to LY Corporation's LINE API Terms of Use and LINE Official Account Guidelines.

7. Data Retention

  • Conversation and audit history. Each Clinic configures its own conversation and audit-log retention periods in Settings (default: 24 months for conversation history, 36 months for the admin audit log). These settings are used when loading conversation history and AI context, and apply across Connected Channels, including supported LINE and Meta media files.
  • After termination. As set out in Section 7 of the Agreement, upon termination Mimira will make Customer Data available for export for 30 days upon written request. After that period, Mimira will delete Customer Data in accordance with its retention practices, except where retention is required by law.

8. Security

Mimira uses commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Data against unauthorized access, loss, misuse, or disclosure, consistent with Section 8 of the Agreement, including:

  • Role-based access controls on staff accounts (via Clerk), with the option for a Clinic Owner to further restrict individual staff members to specific Connected Channels;
  • Encryption of data in transit (HTTPS) for all webhook and API traffic with messaging platforms;
  • Server-side storage of integration credentials (e.g., channel access tokens and channel secrets), which are not exposed in the browser beyond connection-status indicators;
  • LINE webhook signature verification and Meta webhook subscription verification controls, with platform webhook traffic handled only through Mimira's configured endpoints; and
  • Logical isolation of each Clinic's data from other Clinics on the platform.

If Mimira confirms a security incident involving unauthorized access to Customer Data, we will notify the affected Clinic without undue delay, subject to law enforcement, forensic, and security needs.

9. Your Rights

If you are a patient or customer of a Mimira clinic customer and want to access, correct, or delete your personal data, please contact that clinic directly - they control your data and can act on your request using the Services' built-in export tools.

If your request relates to data Mimira controls directly (e.g., a Clinic staff account), contact us using the details in Section 14.

10. International Data Transfers

Mimira is based in the United States, and our sub-processors may process data in the United States and other jurisdictions. Where a Clinic operates in a jurisdiction with its own data protection law - including Thailand's Personal Data Protection Act B.E. 2562 (PDPA) - Mimira will comply with applicable requirements for that processing, and the parties will enter into a separate data processing agreement if legally required, as contemplated by Section 8 of the Agreement.

11. Cookies and Local Storage

The Mimira admin panel uses cookies set by our authentication provider (Clerk) to keep you signed in, and browser storage for interface preferences such as language. We do not use third-party advertising cookies.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected in the "Version" date above, and where appropriate we will notify Clinic administrators by email. Continued use of the Services after an update constitutes acceptance of the revised Policy.

13. Governing Law

This Policy is governed by the laws of the State of New York, USA, consistent with the Agreement.

14. Contact

Mimira AI LLC

108 W 39th Street, Ste 1006 PMB2285

New York, NY 10018, United States

Email: hello@mimira.tech

Phone: +1 (315) 846-6032