muir
Last updated 2026-05-20
muir is in private beta. The platform is currently used by one person — the founder's wife — and is in active development toward a small alpha cohort. This page describes how we handle data today and what changes will need to happen before any wider use.
When you use muir, we collect what you give us directly (symptom logs, intake-instrument responses, uploaded documents, messages) and what you authorize through connected integrations (Oura ring biometrics — HRV, sleep, body temperature, heart rate; Apple Health Export data when you upload it; any future wearable or EHR connection you explicitly approve).
We collect this data to operate the diagnostic engine you signed up to use. We do not sell it. We do not share it with advertisers. We do not aggregate it into research datasets without explicit per-study consent.
Your health data and the OAuth access tokens for third-party integrations (Oura, Apple Health, etc.) are stored in a managed Postgres database that is encrypted at rest at the disk level by the database provider. They live in the database — not on your local device and not in any team member's cloud storage.
To be precise about what that does and doesn't mean today: the integration tokens are stored as plaintext values inside that disk-encrypted database — they are not separately encrypted at the application layer with a key we hold apart from the database. Application-layer (column-level) encryption of those tokens is on our roadmap and will be in place before muir opens to anyone beyond the current single user.
We keep a request-level log (which endpoint was called, when, by whom, and whether it succeeded) for debugging and security. We do not currently keep a field-level audit log of every individual read and write to your record; building that per-record audit trail is part of the work planned before wider use.
muir uses AI (specifically, large language models from Anthropic) to help produce diagnostic assessments, hypothesis-generation, and summarization of your record. AI use is disclosed in the app. muir is a debugging-and-preparation partner, not a diagnosis: it surfaces hypotheses with their evidence and what would confirm or rule them out, so you can have a better-structured conversation with your own clinician.
To be accurate about what exists today: muir does not yet have a partnered-clinician review pipeline. Clinician review before external rollout is a commitment we've made for the path to wider use — it is not a step that runs on your assessments today. We will not describe assessments as clinician-reviewed until that pipeline actually exists.
To produce assessments, muir sends your relevant clinical context — your record summary, the hypotheses being investigated, and your messages — to Anthropic's API on each conversation turn. A second automated check (which verifies the AI's reply against your record to guard against fabrication) sends that same context a second time on turns that warrant it. We are reviewing whether that second pass is worth the additional data egress and may reduce it. We do not currently have a documented zero-retention or business-associate agreement with Anthropic; under the standard API, inputs may be retained for a limited period for abuse monitoring. Confirming and documenting a zero-retention posture is on our list before muir opens beyond its current single user.
muir also resolves the medication names in your record against public U.S. drug databases run by the National Library of Medicine and the FDA (RxNorm, DailyMed, openFDA) to look up standardized drug codes, labels, and known interactions. This means your medication names are sent as queries to those public government services. We do not send your other health data to them, and we are evaluating resolving against a local copy of those databases to avoid the network call entirely.
When you connect a third-party service (e.g., Oura, Apple Health, a future lab provider), that service's privacy policy governs how they handle your data on their side. muir only receives the specific data you authorize and only uses it to produce diagnostic assessments and summaries within the app.
You can delete your record at any time from Settings, or request deletion in writing. Deletion hard-removes your user row, and all of your data — including the request-level logs that carry metadata like (redacted) document references — cascades and is removed with it. Note that managed-database backups and any data already sent to Anthropic or the public drug databases described above are outside muir's direct deletion path and clear on their own provider schedules; documenting those backup-retention windows is part of the pre-rollout work.
For privacy questions, data requests, or to report a concern, email privacy@muir.tools.
We'll update this page as the product matures. Material changes will be communicated to active users by email before they take effect.