Legal / Washington Consumer Health Data Privacy Policy
Last updated: October 10, 2026
Effective date: October 6, 2026
AI Chat Media LLC, a New Jersey limited liability company (“we,” “us,” or “our”), operates MirrorChats at https://www.mirrorchats.com. This policy provides the disclosures required by Washington’s My Health My Data Act for Washington residents and people whose consumer health data is collected in Washington.
“Consumer health data” means personal information linked or reasonably linkable to a person that identifies past, present, or future physical or mental health status under Washington law. It includes covered health inferences and identifying biometric data, even without a diagnosis. An account name is not necessary; a conversation reference, device identifier, or other context can make information linkable.
MirrorChats offers private fictional adult AI chats and generated media, including AI-generated video calls where available. It does not provide healthcare or therapy. Video calls never access your camera or microphone. Real health information remains protected when included in a fictional conversation. Fictional roleplay, sexual preferences, sexual orientation, and adult-service activity are not automatically consumer health data. Context and the statutory definition determine coverage.
The table describes our collection and use to the extent each category contains covered information about a real person. Collection includes receiving, retaining, analyzing, summarizing, and inferring information.
| Covered category | Sources | Purposes and uses |
|---|---|---|
| Real health content | Information you provide in ordinary chats, video-call messages, typed character fields, support correspondence, reports, or privacy requests; retained historical transcripts and other legacy content. | Physical or mental health conditions, symptoms, medication, treatment, self-harm concerns, and reproductive, sexual, or gender-affirming health information, where present. Used as necessary for requested replies, relevant safety checks, support, and reports. Health details are filtered from long-term memory. The following section describes disclosures. |
| Health summaries and inferences | Conversation content, automated crisis checks, human review, and any health details missed by the long-term-memory filters. | Linked flags or inferences concerning health status or needs, used for crisis-resource notices, safety review, and correction of inaccurate records. We exclude health details from long-term conversation memory through instructions and filtering. A fictional story or filter hit does not establish a real condition. |
| Covered facial and verification data | Didit’s capture of documents and facial material, liveness checks, face matching, and age estimation; results and records of the check. | Facial images, identifying measurements or templates, and associated verification information where covered by health-data law. Used to assess age, apply access restrictions, prevent manipulation, and document the check and deletion. Didit handles captures; our hosting providers handle retained result and audit records. |
| Health information in reports and evidence | You, affected people, complainants, authorized reviewers, advisers, authorities, and relevant retained content. | Used to investigate and answer a report or request, correct records, handle lawful claims, and meet applicable reporting or preservation duties. Relevant information can be disclosed to necessary providers, advisers, authorities, or affected people only on a permitted legal basis. |
| Linking identifiers and context | You, your device, providers, and associated service records. | Email, account or conversation references, IP and device information, timestamps, and related context, when linked to covered health information or used to derive a covered health inference. Used to operate the relevant feature, locate records, authenticate requests, and secure the service. Advertising disclosures are described in section 3. |
Memory summarizes conversation context for later replies and may include personal details you provide. We instruct the summarizer not to record health details and apply a filter to each memory update; existing memories have also been filtered. These measures do not remove health information from the underlying messages or necessary safety records, and automated filtering can miss information. Crisis checks can produce a linked self-harm flag and insert resources. Flags are checked daily, not continuously; detection can miss distress or mistake fictional wording for a concern. These uses do not provide diagnosis or emergency monitoring.
The purposes described here are current uses, not a claim that every required consent has been obtained. We shall obtain required consent before collection and separate consent before sharing, unless the particular processing is necessary for a product or service you requested or another specific statutory exception applies. Requesting a reply does not automatically make optional memory, extensive history, advertising, provider training, or independent reuse necessary. General terms, adult-content confirmation, and Didit verification consent do not authorize unrelated health-data processing.
Before collecting, using, or sharing additional health-data categories or using health data for additional purposes, we shall disclose the change and obtain the required affirmative consent. Posting a revision or continued use does not supply that consent.
We share the categories in section 2 with the relevant recipient categories below for the stated purposes. A recipient receives health data only when the material sent through that route contains covered information. We do not currently share consumer health data with an affiliate of AI Chat Media LLC; Didit’s group entities are provider affiliates.
| Recipient category | Covered information and purpose |
|---|---|
| AI generation, memory, and media search | Chat-model providers receive prompts, recent messages and character images, permitted memory, and typed character fields for replies, summaries, planning, and checks. Rendering providers receive filtered prompts and fictional character image links without internal user identifiers. Embedding services process scene text and character-image links for media search. Covered information can occur in these inputs; filtering does not establish anonymity in every case. |
| AI moderation | Moderation providers receive flagged material and relevant surrounding messages, memory, or typed character fields. Chat-model providers also check typed fields and memory summaries. Covered health content or inferences can occur in that material. |
| Age verification | Didit Identity, Inc., Didit Identity Spain, S.L., and supporting providers handle documents, facial captures, liveness and matching or estimation information, and related context. Our ID route returns document type, issuing state, birth date, and age; the face route returns an estimate. We reduce age information to pass/fail without storing the returned payload. Current routes do not return names, document numbers, ID images, selfies, or templates to us. An unrestricted earlier fallback was disabled October 4, 2026. Didit acts as our verification processor and may independently use certain derived security, fraud, and legal information. |
| Hosting, storage, and communications | Neon stores content, memory, flags, and associated records. Vercel hosts requests and technical logs; Cloudflare stores and delivers media and restricted evidence. Upstash handles short-lived references and counters, not chat text. Resend receives addresses and outgoing email content, which can include health information. Prighter receives relevant privacy correspondence. These recipients support the relevant feature, communications, security, or request. |
| Advertising and measurement | Meta and Taboola receive linked registration, purchase, page-view, and engagement events, identifiers, URLs, and technical context. Taboola tools can contact partners including LiveIntent for matching. Configured fields exclude raw chats, memory, crisis flags, and health inferences. URLs can contain conversation or character references, Meta automatic events are enabled, and hashed identifiers remain linkable. If linked activity reveals or is used to infer covered health status, it is a covered disclosure; an ordinary adult-service event is not automatically health data. |
| Advisers, authorities, and affected people | Relevant health content, inferences, identifiers, and evidence can reach professional advisers, competent authorities, NCMEC, or affected people for a particular legally required or permitted disclosure. A crisis flag or complaint does not automatically require a police or CyberTipline report. A permitted business transaction can involve a prospective or acquiring business subject to continuing privacy obligations; it does not authorize an incompatible new use. |
Chat-model providers process requests in locations that can vary among the United States, European Union, and United Kingdom, under a data-processing agreement and covered transfer provisions. Zero-data-retention settings cover supported chat-completion inputs and outputs, including image inputs. Embedding services use the no-training and immediate content-deletion settings enabled on October 4, 2026; the separate moderation endpoint has its own no-training and retention controls. Rendering prompts pass through two privacy checks, but those checks do not guarantee anonymity and all rendering-provider terms and locations have not been confirmed. We do not train our own AI models on user data. Didit’s primary hosting is in Ireland and its model-training opt-out is enabled. The Privacy Policy explains current safeguards and the historical provider change.
Generated photos and clips from chats and video calls remain in character media libraries after account deletion. Shared platform-character media may be supplied to other users; retention does not authorize sharing private or identifying content. We enforce access restrictions on direct media links. Use section 4 to request deletion of a covered item.
Email support@mirrorchats.com or use https://www.mirrorchats.com/legal/takedown at any time, including without an account or while locked out. Identify the requested action and enough information to locate the records, such as your account email, a conversation reference, approximate date, or case reference. No particular subject line or wording is required. An authorized representative can use the same channels with appropriate proof of authority.
We shall promptly authenticate a request through your existing email or another proportionate method. If commercially reasonable efforts do not establish identity or authority, we may request only additional information reasonably necessary to do so. Do not email a full ID, selfie, password, unnecessary health details, or unlawful media; we shall explain any necessary secure verification. Authentication does not extend the response deadline.
Ordinary account deletion removes core account, ordinary chat, separate video-call transcript, memory, and legacy transcript records but leaves some generated media, moderation or search records, and audit records. Replacing a user reference with “deleted” does not establish anonymity. It does not automatically send deletion directions to every current or former AI, rendering, embedding, moderation, email, or advertising provider. Use the channels above for broader health-data deletion; those technical limits do not excuse required deletion or recipient directions.
Limited evidence may remain only under an actual applicable exemption or other lawful retention requirement. We shall restrict it to the necessary data, purpose, and period and explain a lawful limitation unless disclosure is prohibited. A general claims or moderation purpose does not itself establish a Washington exemption. A hold does not require continued payment or defeat rights concerning unrelated records.
We shall comply without undue delay and within 45 calendar days after receiving your request. One additional 45-day period is available only when reasonably necessary because of the complexity or number of requests; we shall notify you of the extension and reasons within the initial period. A shorter applicable deadline governs.
Requested information is free at least twice annually. We may charge a reasonable administrative fee or decline a manifestly unfounded, excessive, or repetitive request only where permitted by law. We shall explain the reason and bear the required burden of justification. If we refuse or limit a request, we shall give reasons and appeal instructions unless disclosure is prohibited. A technical inability to delete is not itself a legal exception.
Appeal through the same email or public form. Identify the request and explain why you disagree. No content-appeal window or content-complaint deadline applies to this privacy process. We shall provide a written outcome and reasons within 45 calendar days after receiving the appeal. If we deny it, we shall provide a method to submit a complaint to the Washington Attorney General. You can also complain directly without completing our appeal process or use another available lawful remedy.
More favorable existing privacy commitments remain in effect. We shall not penalize you for exercising a privacy right. A feature may still need information objectively necessary to provide it, including a legally required age check; we shall explain that dependency. Withdrawal does not waive billing, refund, or cancellation rights.
AI Chat Media LLC
971 US Highway 202N Ste N
Branchburg, NJ 08876, USA
Privacy requests and appeals: support@mirrorchats.com
Public request form: https://www.mirrorchats.com/legal/takedown
Other MirrorChats legal documents