MirrorMii

1. Purpose and Scope

This document covers how the data you give us through this website — your email and your wellness check-in answers — is collected, used, stored, and protected, and sets out your rights, our obligations, and the limits of our liability. Everything about the 30-day research study — the tasks and the research oversight — is set out in the informed-consent form given to people who join it, not here. MirrorMii is operated by Genomii Lab Ltd., incorporated in British Columbia, Canada.

2. Eligibility & Participation Requirements

This beta is open only to residents of Canada or the United States, and you must be at least the age of majority in your province or state (18 or 19).

Excluded jurisdictions. Residents of Quebec, Illinois, and Washington State are not eligible and may not take part.

Eligibility is self-certified. We do not ask for your date of birth, your province, or your state, and we do not verify them. Instead, the check-in shows a single confirmation box — unticked by default — stating that you are at least the age of majority where you live and that MirrorMii is available in your region, alongside the list of regions where it is. You must tick it to submit, and we record that you did along with the edition of these Terms it applied to. If you do not meet these conditions, do not submit the check-in and do not use MirrorMii.

There is no screening step and no waiting list. Anyone who meets the conditions above and submits the check-in can download and use MirrorMii; nothing you answer causes you to be turned away. We may still end your access where these Terms are not met.

Employees and contractors of Genomii Lab Ltd., and immediate family of the research team, are not eligible for the separate 30-day research study.

3. Wellness Disclaimer (Not Medical Advice)

MirrorMii is a lifestyle and wellness product, not a medical device. The check-in is a general wellness questionnaire, not a clinical, diagnostic, or screening assessment: its questions about mood, stress, sleep, and support are there to set your starting point in the product, and your answers are not reviewed for signs of a health condition. Nothing on this website, and no insight the product produces, substitutes for professional medical advice, diagnosis, or treatment. Always consult a qualified clinician before changing your diet, supplements, exercise, or medication. We do not guarantee any specific health, cosmetic, or physical outcome. MirrorMii is not a crisis service; if you are in crisis, contact your local emergency number or a crisis helpline.

4. Assumption of Risk & Release of Liability

To the fullest extent permitted by law, Genomii Lab Ltd. is not liable for indirect, incidental, or consequential loss arising from your use of this website or of MirrorMii. Nothing in these Terms limits our liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited, and nothing affects your statutory rights as a consumer. Risks specific to the 30-day research study are described in the informed-consent form.

5. Participation Benefits

There is no cost to complete the check-in or to use MirrorMii during the open beta, and we never ask for payment details at any stage. Access does not depend on how much you use the app or on giving positive feedback, and completing the check-in in full gets you nothing that the short signup does not. If you stop using MirrorMii, you owe us nothing and beta access simply ends.

Benefits attached to the separate 30-day research study, if you join it, are set out in the informed-consent form. Participation in that study is otherwise unpaid.

6. User Conduct & Content Ownership

Use this website only to learn about MirrorMii, complete the wellness check-in, and get the app. Do not submit unlawful, fraudulent, or infringing content, or interfere with the site's operation or security. The content, design, and branding of this website belong to Genomii Lab Ltd. You keep ownership of everything you submit and grant us a limited, non-exclusive licence to process it for the purposes described here — building your starting-point profile, personalising your experience, improving the product, and contacting you about it. We will not use your name, likeness, photographs, or words in marketing or public material without asking you separately and obtaining your agreement first.

7. Data We Collect

Through this website we collect only what is needed to set up your MirrorMii experience and contact you:

Check-in Data: your email address, and your answers to the wellness check-in — questions about food and nutrition, movement, sleep, social connection and stability, mood and emotions, and how weather affects you, plus the area you want to focus on. Most questions are fixed-choice; a few let you type your own answer when none of the options fit, and two at the end are free text and optional. We do not ask for your name, date of birth, address, province, or state. Some visitors are shown a short signup instead of the full check-in; from those we collect the email address only.

Wellbeing answers. Some check-in questions touch on how you feel: your emotional wellbeing, how often stress felt hard to handle, how supported you feel by the people around you, and how secure you feel about covering your basic needs. We use them to set your starting point in the product, not to assess or screen you, and they are not reviewed clinically. The work-or-study and basic-needs questions offer a "Prefer not to answer" option.

Consent Record: whether you ticked the confirmation box, and which edition of these Terms it applied to. We keep this as our own record that the terms, the age requirement, and the region requirement were put to you before you submitted. It is never used to personalise anything and is never shared.

Technical Data: the time of submission, your IP address, and your browser user-agent.

Analytics on the app-download page. When you open the download guide we load Google Analytics, which sets its own cookies to measure page use. If you arrive through the personal download link we give you after the check-in, that link carries a tracking code; we attach the code to those analytics events and also record it in our own systems, together with the event, your IP address, and your user-agent, so we can see how many people who complete the check-in go on to install the app. The code identifies your submission rather than you by name. We use no advertising cookies, run no ad or cross-site tracking pixels, and do not share any of this with advertisers.

We do not collect genetic or clinical data through this website. Data collected inside the app, and during the 30-day research study if you join it — app activity, chat, images, survey responses, wearable data — is described in the informed-consent form.

7A. Biometric Data

No facial images are collected through this website or as part of the wellness check-in. This section describes how such data is handled inside the app if you use its face-based features and separately opt in.

"Biometric Data" means facial images you provide and the features derived from them for use in the programme.

Separate consent. We collect and process Biometric Data only with your separate, express, opt-in consent, unticked by default and never bundled with other agreements — the confirmation box on the check-in does not cover it. Declining does not exclude you from MirrorMii, though some features will be unavailable.

How your images are processed (data minimisation by design). Raw facial images are processed inside MirrorMii's own controlled environment ("Prime"). Before anything is transmitted to any third-party AI service or to our cloud storage, each image is converted into a desensitised vector representation from which you cannot be identified. Raw facial images are not transmitted to third-party AI providers and are not stored on our third-party cloud infrastructure. Only the non-identifying vector representation and the resulting structured analysis leave Prime.

Purpose limitation. Biometric Data is used solely to provide your personalised MirrorMii experience and for related product research and model development. It is not used for identity verification, facial-recognition matching against other individuals, biometric template generation for identification, or surveillance.

No sale or disclosure. We do not sell Biometric Data and do not share it except with service providers bound to equivalent protections, or where legally compelled. We do not provide it to law enforcement except as legally required.

Security and retention. Biometric Data is encrypted in transit and at rest, is access-controlled, and is held on infrastructure in North America. It is retained only for the programme and the period in Section 12, then deleted or irreversibly anonymised. You may withdraw biometric consent or request deletion at any time via privacy@genomii.ai; we action such requests within 30 days. Withdrawing may limit certain features, and we will explain the effect and offer alternatives where possible.

Facial images are treated as sensitive personal information under applicable Canadian and US state privacy law and handled with the additional safeguards above.

8. AI Data Processing & Security

Profile building. Your email address and your wellness check-in answers are sent to our own profile service, inside our own systems, to build the starting-point profile that personalises what MirrorMii shows you. Your consent record is excluded — it is our evidence, not part of your profile. Which answers are sent is governed by a fixed list held on our servers: a question added to the website is not sent until it is added to that list. If you arrive through the short signup, no profile is built, because an email address on its own has nothing to build one from.

Third-party AI processing inside the app. Skin-state analysis (such as hydration, texture, and redness) is performed on the desensitised vector representation described in Section 7A, processed by Google's Gemini service — not on raw facial images. Photographs of food and supplements are processed by OpenAI to extract nutritional and ingredient information; raw food/supplement images are deleted from the provider's systems immediately after analysis, and only the structured output is retained.

Encryption. Data is encrypted at rest with AES-256 and in transit with TLS 1.3.

Access control. Access to check-in submissions is restricted to the MirrorMii team members who need it. Within the 30-day research study, the file linking your email to your responses is available only to the Principal Investigator and the Study Coordinator.

De-identification. Before data is shared with statistical analysts or qualitative coders, direct identifiers (email) are removed.

No commercial AI training. Your data is not used to train the AI providers' publicly available models, and this is required of them by contract.

9. Automated Decisions and Human Review

We make no automated decisions about you. Nothing you submit is scored, ranked, or screened, and nothing is accepted or refused — there is no acceptance step and no decision to appeal.

What automated processing does happen. Your answers are processed automatically for one purpose only: to build the starting-point profile described in Section 8. That profile changes what MirrorMii shows you and nothing else. It does not affect your access, what you are charged, or anything outside the product.

Eligibility is not assessed by us. Age and region are self-certified through the confirmation box (Section 2). We do not verify either, so no submission is declined automatically or otherwise.

You may still ask how your answers were used, ask for your data, or ask us to delete it, via privacy@genomii.ai.

10. Information Sharing & Disclosure

We do not sell, rent, or trade your personal data, and do not share it with advertisers. We may share data with: service providers acting on our instructions and bound to equivalent protections (currently Amazon Web Services for hosting, Google Analytics for the download-page measurement in Section 7, and, inside the app, Google and OpenAI for the analysis in Section 8); legal authorities where required by law; and a business successor in a merger or acquisition, subject to equivalent safeguards. Research findings are published only in aggregated or de-identified form, and any quotations are de-identified.

11. Your Rights

Depending on where you live, you have the right to: access the personal data we hold and receive a portable copy; correct or delete it; withdraw consent (including biometric consent specifically) or restrict processing; stop using MirrorMii and have your check-in deleted at any time, without reason or penalty; ask how your answers were used to build the profile in Section 9; and complain to your privacy regulator — the Office of the Privacy Commissioner of Canada, your provincial commissioner (such as the OIPC for British Columbia), or, for US residents, your state Attorney General or applicable authority. Requests can be made via privacy@genomii.ai and are actioned within 30 days.

12. Data Retention

We keep your check-in and the profile built from it for as long as you use MirrorMii, and you may ask us to delete them at any time; we action such requests within 30 days. We keep the consent record for as long as we could need to show what you agreed to. If you join the 30-day research study, identifiable data is retained for 3 years and then destroyed, as set out in the informed-consent form. Data retained for future research and publication is anonymised so that it no longer identifies you, directly or indirectly; data from which only direct identifiers have been removed (but re-identification remains reasonably possible) is treated as personal information and destroyed once its purpose is fulfilled.

13. Indemnification

You agree to indemnify Genomii Lab Ltd. against claims, damages, and reasonable expenses arising from your breach of these Terms, your misuse of this website, or your infringement of a third party's rights. This does not apply to claims arising from our own negligence or breach, and does not extend beyond what applicable law permits.

14. Governing Law & Dispute Resolution

These Terms are governed by the laws of British Columbia and the federal laws of Canada applicable there. We will try to resolve any dispute directly first — please contact privacy@genomii.ai. Where you have a statutory right to bring proceedings in the courts of your own province, state, or country of residence, or to refer a dispute to a consumer body, these Terms do not remove that right.

15. Policy Updates

We may update these Terms periodically. Where a change is material, we will notify you by email. The current version is always published on this page, and each edition carries the version marker shown at the top; the edition you agreed to is recorded with your submission, so it stays clear which wording you saw. Changes to the research study itself require a revised consent form, which its participants review and sign.

16. Contact Information

For questions, requests, or complaints regarding these Terms or your data rights: privacy@genomii.ai — Genomii Lab Ltd., Vancouver, British Columbia, Canada. People who join the 30-day research study receive direct contact details for the research team, the Principal Investigator, and the Institutional Review Board in their consent form.

17. Legal Compliance Statement

Genomii Lab Ltd. is incorporated in British Columbia, Canada, and processes personal data under:

The Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy law, including British Columbia's Personal Information Protection Act (PIPA) and Alberta's PIPA, for Canadian participants.

Applicable United States state privacy laws, including the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), for US participants in covered jurisdictions.

Residents of Quebec, Illinois, and Washington State are not eligible for this beta, and their personal information is not knowingly collected or processed; eligibility is self-certified as described in Section 2. Facial images are treated as sensitive personal information and handled with the additional safeguards in Sections 7A and 8.