Privacy policy | Mirovita

Last updated July 27, 2026.

Mirovita, Inc. operates Mirovita. This policy describes what we collect when you use this site, why we collect it, and who we give it to. It is written to match what the software actually does.

The short version

We collect what you type into the scan request form or the contact form, plus a small amount of technical data about the visit.
We forward what you submit on the scan request form to our imaging partners, the imaging provider who performs the scan. That is the point of the form. A contact form message stays with us.
We do not sell your personal information, and we do not share it with advertisers.
We store your IP address and browser user agent. The address tells us roughly where in the country you are, so we can point you at nearby imaging centers.
You can ask us to delete your record at any time and we will.

Are we covered by HIPAA?

No, and this matters, so we would rather say it plainly than bury it. Mirovita is not a health care provider, health plan, or clearinghouse, so we are generally not a HIPAA covered entity. The health information you give us on this site is therefore not protected by HIPAA while it is with us. We protect it under this policy and under the security controls described below instead.

Once your information reaches our imaging partners and you become their patient, their handling of your medical records is subject to HIPAA and to their own notice of privacy practices. The imaging report and images produced by your scan are their records, not ours. We never receive them.

What we collect

Information you give us

Contact details: email address, and optionally your first name, last name, and phone number.
Screening answers: year of birth, sex at birth, ZIP code, why you are interested in a scan, and your answers to the history and MRI-safety questions. Some of these are health information.
Your preferred imaging center, if you choose one.
Your consent choices: whether you agreed to be contacted about the request, and separately whether you opted in to marketing email.

If you write to us through the contact form, we store your email address, the name you give, the subject you pick, and the message itself. That box is free text, so whatever you choose to put in it is what we hold. Please do not describe symptoms or send medical records there: it is not a clinical channel, nobody reading it is your physician, and anything you send becomes a record we then have to keep and secure. If something is wrong, see a doctor.

Information collected automatically

Attribution: the page you landed on, the referring URL, and any utm_* campaign parameters in the link you followed. This tells us which channels work.
IP address: the address your request came from, stored as we received it. We use it mainly for approximate location, which is how we know which imaging centers are near you, and secondarily to recognise abusive or automated submissions.
Browser user agent: the string your browser sends describing itself. It tells us which devices the site has to work on, and it helps separate a real visitor from a script.

That is the whole list. We store the address rather than a scrambled version of it, because a scrambled address cannot tell us where you are, which is the only reason we wanted it. Both values are part of your record, so a deletion request removes them along with everything else.

An IP address is an approximate signal, not a precise one. It usually places you in the right metropolitan area and it is often wrong about more than that, particularly on a mobile network or a VPN. We do not treat it as your address, and the ZIP code you type on the form is what we actually match centers against.

We do not use third-party analytics, advertising pixels, or session-recording tools on this site. If that changes, this section changes with it.

Cookies

This site sets one cookie: a signed session cookie. It carries a CSRF token that stops other sites from submitting the form on your behalf, and after you submit, the identifier of your own request so the confirmation page can show it back to you, or a flag noting that you sent us a message so the confirmation page will load. There is no advertising or tracking cookie, and there is no cross-site tracking to opt out of.

Why we use it, and on what basis

To pass your request to an imaging center. This is the service you asked for.
To contact you about that request (by email, phone, or text), which you consent to on the form. The center will usually be the one to call you.
To answer you when you write to us through the contact form. We reply to the address you gave, and we do not add it to a marketing list.
To send marketing email, only if you separately ticked that box. Every such email carries an unsubscribe link.
To keep the service working and honest: preventing spam and abuse, and understanding which campaigns bring people here.

The screening answers exist so a radiologist or scheduler knows what to look for and, in the case of the MRI-safety questions, whether the scan is safe for you at all. They are not used to price the scan, and they are not used to target advertising.

Who we share it with

Our imaging partners. The imaging center you select, or the one nearest you if you express no preference, receives your contact details and the relevant parts of your screening answers so they can schedule and safely perform the scan. Your IP address and user agent are not part of that handoff; they are ours, and they stay here.
Service providers who host the application, the database, and our email, acting on our instructions and nothing else.
Where the law requires it, or to protect someone's safety.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

Contact form messages are not part of the handoff to our imaging partners. They go to our own team and stay there, unless what you are asking about can only be answered by the center that scanned you, in which case we will tell you to contact them rather than forward your message for you.

How long we keep it

We keep your record while we are still using it for the reason you gave it to us: arranging your scan, or answering what you wrote to us about. We do not publish a fixed deletion date, because we would rather tell you what we actually do than name a schedule and leave it unrun. What we do commit to is this: ask us to delete your record and we will, whether or not anything is still in progress, and we will tell you when it is done. Deleting your record with us has no effect on records our imaging partners holds about you as a patient. Those are subject to medical record retention law and to their policies. Ask them directly.

Security

Traffic to this site is encrypted in transit. Lead records and contact messages live in an access-controlled database. Administrative access to either requires a server-side API token; the public forms can create a record but cannot read one back, so nobody can guess an email address and retrieve that person's request or the message they sent us.

No system is perfectly secure, and we will not claim otherwise. If you believe you have found a vulnerability, email [email protected] and we will respond.

Your choices and rights

Access: ask for a copy of the record we hold about you.
Correction: tell us what is wrong and we will fix it.
Deletion: ask us to erase your record.
Marketing: unsubscribe from any marketing email, at any time, without affecting a scan request already in progress.
Withdraw consent to contact: tell us to stop and we will stop, though that generally means we cannot continue arranging the scan.

Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws have these rights by statute, including the right not to be discriminated against for exercising them. We extend the same rights to everyone regardless of where they live, because maintaining two standards would be worse than maintaining one. Email [email protected] to exercise any of them; we verify identity by replying to the email address on the record.

Children

This service is for adults 18 and over. We do not knowingly collect information from children. If you believe a child has submitted the form, tell us and we will delete the record.

Changes to this policy

We will update the date at the top when this policy changes. If a change materially affects how we use information you already gave us, we will email the address on your record rather than rely on you noticing a new date.

Questions

Email [email protected]. A person reads that inbox.

Also read: Privacy policy · Terms of service · Medical disclaimer