Privacy

Where we are

muir is a health-investigation tool in private alpha, used by a small number of invited adults. It is run by its founder, not by a company, and it is offered directly to you, not through a doctor, hospital, or insurer. That means U.S. health-privacy law for health-care providers (HIPAA) does not cover it; the Federal Trade Commission's rules and state consumer-health privacy laws do. This page says what muir collects, where it goes, what you choose, and what deletion reaches.

What we collect

• Your account: email address, name, and how you sign in (a Google account or an emailed sign-in link).
• What you tell muir: symptoms, check-ins, intake answers, messages to muir, and profile facts such as year of birth, sex at birth, ancestry, and reproductive context.
• What you upload: documents, lab reports, photos of clinical paperwork, and Apple Health exports. muir keeps the text and values it reads from them; it does not keep the original files.
• What you connect: Oura ring data (sleep, heart rate, heart-rate variability, temperature, blood oxygen), Apple Health data from the iOS app, and Google Drive files you pick.
• Location, only if you allow it: an approximate home location, used to compare your symptoms with local weather.
• Feedback you send: your note and, if you attach one, a screenshot, which can show whatever was on screen.
• Records of use: which parts of muir were used and when, whether a request succeeded, a record of each AI request (which model, when, a fingerprint of the prompt, and references to the records it used, never their content), and a record each time muir's crisis check matched, without the text that triggered it.

We use this only to run muir for you. We do not sell it, we do not share it with advertisers, we run no analytics or advertising trackers, and we do not use it for research without separate, study-specific consent.

Where it is kept

Your record lives in one managed Postgres database (Neon), encrypted at rest by the provider. The access tokens that let muir read your Oura or Google Drive data are stored in that same database; they are not separately encrypted with a key held apart from it.

Uploads pass through temporary storage at our hosting provider and are deleted as soon as muir has read them. The hosting provider (currently Vercel) keeps server logs for up to 30 days. muir is built to keep file names and the text you type out of those logs: request records are reduced to a fixed set of technical fields before they are written there.

An error-reporting service (Sentry) is built into muir but is switched off. If we turn it on, it receives only scrubbed error reports that carry an opaque account number and no record content, and we will update this page first.

What leaves muir, and where it goes

muir shares nothing below until you agree to it in the sharing step that appears before you start. You can review your choices at any time in Sharing choices.

• Anthropic (required). muir uses Anthropic's Claude models to read your uploads, answer your messages, check its own answers against your record, and propose patterns. Each request sends the part of your record it needs. Anthropic does not train its models on this data. By default it deletes requests and responses within 30 days, keeps them for up to 2 years if its safety systems flag them, and may keep them longer where the law requires. muir has no zero-retention agreement and no business-associate agreement with Anthropic, so those defaults apply.
• U.S. drug databases (required for medication features). muir looks up medication names at the National Library of Medicine (RxNorm, DailyMed) and the FDA (openFDA) to find standard codes, labels, and reported reactions. Only the medication name is sent, from muir's server, with nothing that identifies you.
• Apple WeatherKit (optional). If you allow weather comparison, muir sends your approximate home location to Apple each day to fetch local weather.
• Oura and Google Drive (asked when you connect). muir asks before it sends you to connect either one. It then receives the data you approve there. For Google Drive, muir can read only the files you pick. Disconnecting, or deleting your account, withdraws muir's access at Oura and Google.
• Email and notifications. Resend sends muir's emails (sign-in links, invitations, notices), so it receives your email address and name. Apple delivers push notifications to the iOS app; they carry general wording, not your health details.
• People you invite. A caregiver you invite sees your record at the access level you choose, and you can change or remove it in Settings.
• The founder. The person who runs muir can reach its database to operate and fix it, and does so only for that purpose, for safety, or when you ask.

AI disclosure

AI helps produce what muir shows you. It is preliminary: no clinician reviews it before you see it, and muir does not describe anything as clinician-reviewed unless a clinician has reviewed it. muir surfaces hypotheses with their evidence and what would confirm or rule them out, for you and your own clinician to weigh.

Download and deletion

You can download your record, and delete it permanently, from Settings → Data & privacy. Deletion removes your account and everything stored with it from muir's database at once, including the records of use described above, and withdraws muir's access at Oura and Google Drive.

Deletion cannot reach these, and we want you to know it:

• Database backups. The database keeps 24 hours of history, and a backup copy is made before each database change and kept for at most 14 days. Your data stays in those copies until they expire; muir tells you the date when you delete.
• Anthropic. Copies of requests expire on Anthropic's schedule above. You can ask us to request earlier deletion from Anthropic; without a zero-retention agreement, Anthropic decides.
• Other services. Resend's record of emails sent to you, the hosting provider's server logs (up to 30 days), and anything you gave Oura, Google, or Apple directly follow those services' own schedules.

Your rights

You can ask what muir holds about you and get a copy (Settings → Data & privacy → Download), see who receives it (this page), withdraw any consent (Sharing choices), and delete your record. Write to privacy@muir.tools for anything the app does not do for you. We answer within 30 days. If we decline a request, reply to say you disagree and we will review it again; if we still decline, we will tell you how to reach your state attorney general.

If something goes wrong

If your health information is disclosed or accessed without your permission, we will tell you without unreasonable delay, and no later than 60 days after we find out, as the Federal Trade Commission's Health Breach Notification Rule requires.

Contact

For privacy questions, data requests, or to report a concern, email privacy@muir.tools.

Changes

When this page changes in a way that matters, muir asks you to review your sharing choices again before you continue, and we email active users before the change takes effect. See also the terms.