Legal / Nevada and Connecticut Consumer Health Data Privacy Notice
Last updated: October 10, 2026
Effective date: October 6, 2026
AI Chat Media LLC, a New Jersey limited liability company (“we,” “us,” or “our”), operates MirrorChats at https://www.mirrorchats.com. This notice explains our consumer-health-data practices and rights under applicable Nevada and Connecticut law. It supplements our Privacy Policy. A more specific health-data protection or shorter legal deadline takes priority over a conflicting general provision.
“Consumer health data” means personal information linked or reasonably linkable to you that is protected as health data by applicable law. It can include real physical or mental health information, related inferences, and qualifying biometric information. An account name is not necessary: a conversation reference, device identifier, or other context can make information linkable.
Nevada protects people who request our products or services and reside there or whose consumer health data is collected there. Connecticut protects its residents. Coverage can apply without a minimum revenue or user count. The applicable law and processing determine your statutory rights; section 8 also accepts requests where a particular statute does not apply.
MirrorChats provides private fictional adult AI chats and generated media, including AI-generated video calls where available. It does not provide healthcare, diagnosis, treatment, or therapy. Video calls never access your camera or microphone. Messages and retained records can contain real health information. Roleplay, sexual preferences, sexual orientation, and adult-service activity are not automatically consumer health data; context and the applicable definition matter.
Nevada covers personally identifiable information used to identify health status, including biometrics related to health information where that definition is met. Connecticut covers personal data used to identify a physical or mental health condition, diagnosis, or status. A facial age estimate is not automatically identifying biometric or health data under every law. Brief processing and later deletion do not themselves exclude covered collection.
We process the following categories to the extent they contain protected information about a real person. Collection includes receiving, storing, analyzing, summarizing, and inferring information. The purposes below describe current processing; section 4 limits the permission needed for that processing.
| Covered category | Sources | Uses and disclosures |
|---|---|---|
| Real health content | Information you provide in ordinary chats, video-call messages, typed character fields, support correspondence, reports, or privacy requests; retained historical transcripts and other legacy content. | Physical or mental health conditions, symptoms, medication, treatment, self-harm concerns, and reproductive, sexual, or gender-affirming health information, where present. Used as necessary for requested replies, relevant safety checks, support, and reports. Health details are filtered from long-term memory. The following section describes disclosures. |
| Health summaries and inferences | Conversation content, automated crisis checks, human review, and any health details missed by the long-term-memory filters. | Linked flags or inferences concerning health status or needs, used for crisis-resource notices, safety review, and correction of inaccurate records. We exclude health details from long-term conversation memory through instructions and filtering. A fictional story or filter hit does not establish a real condition. |
| Covered facial and verification data | Didit’s capture of documents and facial material, liveness checks, face matching, and age estimation; results and records of the check. | Facial images, identifying measurements or templates, and associated verification information where covered by health-data law. Used to assess age, apply access restrictions, prevent manipulation, and document the check and deletion. Didit handles captures; our hosting providers handle retained result and audit records. |
| Health information in reports and evidence | You, affected people, complainants, authorized reviewers, advisers, authorities, and relevant retained content. | Used to investigate and answer a report or request, correct records, handle lawful claims, and meet applicable reporting or preservation duties. Relevant information can be disclosed to necessary providers, advisers, authorities, or affected people only on a permitted legal basis. |
| Linking identifiers and context | You, your device, providers, and associated service records. | Email, account or conversation references, IP and device information, timestamps, and related context, when linked to covered health information or used to derive a covered health inference. Used to operate the relevant feature, locate records, authenticate requests, and secure the service. Advertising disclosures have the separate limits in section 5. |
Memory summarizes conversation context for later replies and may include personal details you provide. We instruct the summarizer not to record health details and apply a filter to each memory update; existing memories have also been filtered. These measures do not remove health information from the underlying messages or necessary safety records, and automated filtering can miss information.
The crisis guard checks first-person suicidal or self-harm wording. When it triggers, it inserts crisis resources and flags the conversation. We check flags daily, not continuously; detection can miss distress or mistake fictional language for a concern. This is not diagnosis, emergency monitoring, or a promise of outreach or dispatch. If you are in immediate danger, contact local emergency services. In the United States, call or text 988 for crisis support.
AI generation and moderation. Chat-model providers receive character prompts, conversation context, permitted memory, recent character images, transcripts used for summaries, and typed character information for replies and checks. Separate video-call transcripts can feed the same memory. Rendering providers receive scene prompts after two privacy checks, fictional character image links under random file names, and technical settings. Embedding services receive scene text and character-image links for media search. Moderation services receive flagged material and relevant context. Each route can disclose health information only where it occurs in the material sent; the privacy checks do not guarantee complete anonymity.
The public chat-model endpoint processes requests in locations that can vary among the United States, European Union, and United Kingdom. Its data-processing agreement includes covered transfer provisions, and zero-data-retention settings cover supported chat-completion inputs and outputs, including image inputs. Embedding services have used no-training and immediate content-deletion settings for covered requests since October 4, 2026. The separate moderation endpoint has its own controls. All rendering-provider retention, training, and location terms have not been confirmed. We do not train our own AI models on user data. The Privacy Policy describes these limits and the historical provider change.
Age verification. Didit Identity, Inc., its affiliate Didit Identity Spain, S.L., and supporting providers process the material needed for the selected check; primary hosting is in Ireland. Didit captures documents and facial material directly. Our current ID route returns document type, issuing state, birth date, and age; the face route returns an estimate. We reduce age information to pass/fail in memory without storing the returned payload. Current routes do not return names, document numbers, ID images, selfies, or biometric templates to us. An earlier unrestricted ID fallback was disabled on October 4, 2026. Didit acts as our processor for verification and may act independently for certain derived security, fraud, and legal information. Its model-training opt-out is enabled. The Age Assurance and Biometric Privacy Notice provides the fuller description.
Hosting, storage, and communications. Neon stores conversations, memory, flags, and associated records. Vercel hosts requests and technical logs; Cloudflare stores and delivers media and restricted evidence. Upstash handles short-lived account or conversation references and counters, not chat text. Email delivery providers, including Resend, receive addresses and outgoing message content, including health information if contained in a service message. Prighter receives relevant privacy correspondence as our EU or UK representative. Current voice calls are offline; earlier transcripts can remain in conversation records.
Other permitted disclosures. Relevant health information can reach professional advisers, competent authorities, NCMEC, or affected people when a particular disclosure is required or specifically permitted by law. A crisis flag or complaint does not automatically require a police or CyberTipline report. A permitted business transaction can involve a prospective or acquiring business subject to continuing privacy obligations. It does not authorize an incompatible new use. We do not currently disclose consumer health data to an affiliate of AI Chat Media LLC; Didit’s group entities are provider affiliates.
Generated photos and clips from chats and video calls remain in character media libraries after account deletion. Shared platform-character media may be supplied to other users, but that does not authorize disclosure of private or identifying content. We enforce access restrictions on direct media links. Use section 8 to request review or deletion.
Where law requires a processor arrangement, we will require written instructions, confidentiality, safeguards, and help with rights and deletion. Independent recipient reuse needs its own lawful basis. Describing a provider category does not establish consent, a contract, or transfer safeguards. The Privacy Policy explains current arrangements, remaining limitations, and the historical provider change.
Where applicable law requires it, we shall obtain your freely given, informed, affirmative consent before collecting consumer health data for a specified purpose. Consent to sharing must be separate from consent to collection where required. The request must explain the categories, purposes and specific uses, recipient categories, and how to withdraw. A requested-service or other statutory exception applies only to processing that actually meets its conditions.
We shall limit covered processing to information needed for the disclosed lawful purpose. Requesting a reply does not automatically make optional memory, extensive history, advertising, provider training, or independent reuse necessary. Connecticut-covered sensitive processing requires the applicable consent and necessity protections unless a specific exception applies. Seeking help or describing distress in good faith is not itself a content violation.
Accepting general terms, acknowledging this notice, enabling adult content, or submitting a message does not substitute for a required health-data consent. The current separate Didit choice concerns verification; it does not authorize health disclosures in chats, unrelated sharing, or provider training. Contact us under section 8 to withdraw consent or ask us to stop covered collection, use, or sharing. We shall stop processing that depends on withdrawn consent within the applicable deadline and address required deletion. Withdrawal does not affect earlier lawful processing.
Meta and Taboola receive linked registration, purchase, page-view, and engagement events for advertising and measurement, including identifiers, page context, and technical information. Taboola’s browser tools can contact advertising partners, including LiveIntent, for identifier matching. These third parties can collect and combine activity over time and across different websites or services. If that information reveals or is used to derive a protected health status, the health-data rules apply; an ordinary adult-service event is not automatically health data.
Our deliberately configured advertising fields exclude raw chat text, memory, crisis flags, and health inferences. However, URLs can contain conversation or character references, Meta automatic event collection is enabled, and hashed emails and IDs remain linkable. Excluding raw content does not establish that every disclosure is outside health-data law.
We receive no cash for personal information, but a health-data sale can include an exchange for other valuable consideration. Advertising benefits and the actual data disclosed must be considered under the applicable definition. We shall not sell or offer to sell covered health data without a separate valid, signed authorization where required, or the specific consent required by another applicable law. Where signed authorization is required, it must identify the data, seller, buyer, purpose, expiry, and revocation method, with the required warnings and copies. We shall not condition service on that authorization. A prohibition, including one protecting covered biometrics, cannot be overridden by consent.
The existing “Do Not Sell or Share” choice stops browser advertising tools in that browser and associated server events for the account when chosen while signed in. Reload after a Settings change and make the browser choice on other devices. GPC currently controls browser tools and is checked for server events only at signup; it does not stop every later server event for an existing account. These limits do not reduce a legal right to have a signal or withdrawal honored. An opt-out does not recall earlier provider copies, and neither an opt-out nor a general tracking choice supplies health-data collection consent, separate sharing consent, or sale authorization. The Cookie and Advertising Notice explains the controls in more detail.
We shall retain covered health data only for a lawful purpose and period, subject to any earlier deletion requirement. Current practices include:
| Records | Current handling |
|---|---|
| Chats, memory, and legacy transcripts | Ordinary chats, separate video-call transcripts, permitted memory, and legacy transcripts are generally held with the account and removed by account deletion, subject to lawful holds and earlier deletion duties. Generated media libraries have no fixed current deletion period. Some moderation and search records remain after the user reference is replaced by “deleted”; this does not establish anonymity. |
| Verification material and records | Our application requests deletion of the completed Didit session before recording a pass. Its console has a one-month fallback and deletes templates with the session; separate lawful security or legal records may remain. We shall arrange deletion of unfinished sessions within 24 hours or sooner where required. Account pass information remains with the account; verification audit records currently have a seven-year schedule, subject to earlier destruction or genuine anonymization where required. |
| Support, technical copies, and evidence | Resend email content and logs have a 30-day period; Vercel runtime logs have a one-day period; Neon’s database recovery window is six hours without snapshots. Restricted CyberTipline report contents and required context generally have a one-year preservation period from submission; longer lawful holds can apply. These periods do not describe every provider or record. |
Ordinary account deletion does not automatically send erasure requests to every current or former AI, rendering, embedding, moderation, email, or advertising provider, or erase every generated item or audit record. For broader consumer-health deletion, use section 8. We will delete covered data from our records and network and notify relevant recipients as required. A provider’s ordinary retention policy or an unimplemented deletion path is not a legal exemption.
For Nevada-covered requests, we shall delete and notify recipients within 30 days after authentication; notified recipients must delete within 30 days after receiving notice, subject to the applicable backup provision. Nevada permits a necessary archive or backup deletion delay of no more than two years. That is an outer legal limit for qualifying recovery copies, not our routine retention period. We shall apply any shorter required period and prevent deleted data restored from recovery copies from returning to ordinary use.
A statutory reporting duty or specifically permitted security or investigation purpose can justify retaining limited evidence. We shall assess the actual exception under the applicable health-data law, restrict the retained data to that purpose, and explain a lawful limitation unless disclosure is prohibited. A general claims or moderation purpose is not automatically an exception under every law. A hold covers only necessary records and time; it does not authorize user access to removed content, require continued payment, or defeat rights concerning unrelated records.
Depending on the applicable law, you can:
We shall not discriminate or penalize you for exercising a privacy right. A feature can still depend on information objectively necessary to provide it, including a legally required age check. We shall explain that dependency; withdrawal does not itself waive cancellation, refund, or other consumer rights.
Email support@mirrorchats.com or use https://www.mirrorchats.com/legal/takedown. You can use either channel without creating an account and while locked out. Identify the action requested and enough information to locate the records, such as the account email, a conversation reference, approximate date, or prior case reference. “Consumer Health Data Request” is a helpful subject, but no particular wording is required. Identify an inaccurate record and the correction sought if you want a change.
We shall authenticate requests promptly through your existing email or another proportionate method. We may ask for additional information reasonably needed if commercially reasonable efforts do not establish your identity or authority. Do not send a full ID, selfie, password, unnecessary health details, or unlawful media; we shall explain any necessary secure verification. An authorized representative can use the same channels with appropriate proof of authority.
| Request | Response or action deadline |
|---|---|
| Nevada health-data request | Without undue delay and within 45 calendar days after receipt under our general response commitment. Nevada’s statutory 45-day period runs from authentication. A permitted 45-day extension requires timely notice and reasons. Deletion and recipient notification have the shorter 30-day deadline in section 6. |
| Connecticut health-data request | Without undue delay and within 45 calendar days after receipt. A necessary 45-day extension requires timely notice and reasons. On consent revocation, dependent processing must stop as soon as practicable and within 15 calendar days after receipt. |
A shorter applicable deadline governs. We provide requested information free of charge at least twice annually. A fee or refusal for a manifestly unfounded, excessive, or repetitive request is permitted only where the applicable law allows it; we shall explain the reason and bear the required burden of justification. If we refuse or limit a request, we shall give reasons and appeal instructions unless disclosure is legally prohibited. Our system’s technical limits do not themselves justify denial.
Use the same email or public form to appeal. Identify the request and explain why you disagree; “Privacy Appeal” is a helpful subject. We shall review the decision and provide a written outcome and reasons within 45 calendar days after receiving the appeal, or sooner where required. The six-month content-appeal window and content-complaint deadlines do not govern these privacy requests.
If we deny the appeal, we shall provide the applicable attorney-general complaint route. You can also complain directly to the Nevada Attorney General or Connecticut Attorney General without completing our appeal process. Our Privacy Policy identifies other privacy-authority and representative contacts. This notice does not restrict any other available lawful remedy.
We shall limit health-data access to authorized people and processors who need it for a permitted purpose, require applicable confidentiality, and use reasonable administrative, technical, and physical safeguards appropriate to its sensitivity and volume. Restricted evidence storage uses encryption and access controls. Private chat is not end-to-end encrypted or inaccessible to staff and providers. Report exposure through the channels below.
We use approximate IP location for access rules, not a healthcare-location feature. We do not use healthcare geofences to identify or track people seeking care or send health-related notifications or advertisements. We shall not implement a geofence prohibited by applicable health-data law.
We shall notify affected users of material changes through the service or email, explain the changes, and state their effective date. Before processing new health-data categories, purposes, or recipients requiring consent, we shall disclose them and obtain required affirmative consent. A revised notice or continued use does not supply consent or retroactively authorize processing. Mandatory rights and more favorable existing commitments remain in effect.
AI Chat Media LLC
971 US Highway 202N Ste N
Branchburg, NJ 08876, USA
Privacy requests, withdrawal, deletion, appeals, and support: support@mirrorchats.com
Public request form: https://www.mirrorchats.com/legal/takedown
Other MirrorChats legal documents