![](media/image1.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**Privacy Policy**

**Effective Date:** \[01/30/2026\]\
**Last Updated:** \[01/30/2026\]

**1. Introduction**

This Privacy Policy describes how Phase Mirror LLC (\"Phase Mirror,\"
\"we,\" \"us,\" or \"our\") collects, uses, discloses, and protects your
personal information when you use our website, SaaS platform (the
\"Phase Mirror Oracle\"), consulting services, training programs, and
certification
programs.[^[\[1\]]{.underline}^](#ek4orlfawnru)[^[\[2\]]{.underline}^](#jsbnwsnusvkh)

**2. Information We Collect**

**Information You Provide Directly:**

-   Account registration data (name, email, company, job title)

-   Payment and billing information

-   Communications you send us (support requests, feedback)

-   Certification and training enrollment
    > information[^[\[2\]]{.underline}^](#jsbnwsnusvkh)

**Information Collected Automatically:**

-   Usage data (features accessed, timestamps, rule executions)

-   Device and browser information

-   IP addresses and general location data

-   Cookies and similar tracking technologies

**Platform-Specific Data:**

-   Dissonance reports and governance artifacts generated through the
    > Oracle

-   Configuration files and rule customizations

-   Calibration data (aggregated false-positive rates used to improve
    > rule accuracy---collected only with
    > consent)[^[\[3\]]{.underline}^](#z5349apj0d4d)

**3. How We Use Your Information**

We use collected information to:

-   Provide and maintain the Phase Mirror platform and services

-   Process transactions and manage subscriptions across Community,
    > Team, Business, and Enterprise
    > tiers[^[\[2\]]{.underline}^](#jsbnwsnusvkh)

-   Deliver consulting, implementation, and training
    > services[^[\[1\]]{.underline}^](#ek4orlfawnru)

-   Improve platform accuracy through aggregated calibration data
    > (opt-in only)[^[\[3\]]{.underline}^](#z5349apj0d4d)

-   Administer certification programs and verify credentials

-   Send service-related communications and, with consent, marketing
    > materials

-   Comply with legal obligations and enforce our terms

**4. Calibration Data and Network Effects**

The Phase Mirror platform may collect aggregated, anonymized calibration
data to improve rule accuracy across the ecosystem. This
data:[^[\[3\]]{.underline}^](#z5349apj0d4d)

-   Is anonymized before aggregation

-   Cannot be used to identify individual users or organizations

-   May be disabled by Enterprise customers upon request

-   Creates value for all platform users through improved false-positive
    > calibration

**5. Information Sharing and Disclosure**

We do not sell your personal information. We may share information with:

-   **Service Providers:** Third parties who assist with hosting,
    > payment processing, and support

-   **Certified Partners:** Only with your explicit consent when
    > engaging certified consulting
    > partners[^[\[2\]]{.underline}^](#jsbnwsnusvkh)

-   **Legal Requirements:** When required by law, court order, or to
    > protect our rights

-   **Business Transfers:** In connection with a merger, acquisition, or
    > sale of assets

-   **Citizen Gardens Foundation:** Governance oversight as part of our
    > Mozilla-model structure[^[\[3\]]{.underline}^](#z5349apj0d4d)

**6. Data Retention**

We retain personal information:

-   **Account Data:** For the duration of your account plus \[X\] years

-   **Transaction Records:** As required by applicable tax and financial
    > regulations

-   **Certification Records:** Indefinitely to verify credential
    > authenticity

-   **Usage/Calibration Data:** Aggregated data retained indefinitely;
    > identifiable data deleted within \[X\] months of account closure

**7. Your Rights and Choices**

Depending on your jurisdiction, you may have the right to:

-   Access the personal information we hold about you

-   Correct inaccurate information

-   Request deletion of your data

-   Opt out of calibration data collection

-   Export your data in a portable format

-   Withdraw consent for marketing communications

To exercise these rights, contact us at \[privacy\@phasemirror.io\].

**8. Security**

We implement industry-standard security measures including:

-   Encryption in transit and at rest

-   Access controls and authentication

-   Regular security audits (especially for Enterprise tier with 99.9%
    > SLA commitments)[^[\[2\]]{.underline}^](#jsbnwsnusvkh)

-   Incident response procedures

**9. International Data Transfers**

If you are located outside the United States, your information may be
transferred to and processed in the U.S. We use appropriate safeguards
for international transfers, including Standard Contractual Clauses
where applicable.

**10. Children\'s Privacy**

Phase Mirror services are not directed to individuals under 16. We do
not knowingly collect personal information from children.

**11. Changes to This Policy**

We may update this Privacy Policy periodically. We will notify you of
material changes via email or prominent notice on our website.

**12. Contact Us**

For questions about this Privacy Policy or our data practices:

**Phase Mirror LLC**\
\[Address\]\
Email: \[privacy\@phasemirror.com

**Notes for Finalization**

**Items requiring your input:**

-   Specific data retention periods (marked with \[X\])

-   Exact contact information and address

-   Whether you want to include specific compliance frameworks (GDPR,
    > CCPA, etc.)

-   Cookie policy details (may warrant a separate document)

-   DPA (Data Processing Agreement) language for Enterprise customers

**Addendum A: EU AI Act Compliance Provisions**

*Applicable to customers using the EU AI Act Readiness Compliance
Pack*[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

**A.1 Purpose and Scope**

These provisions apply when you use Phase Mirror services to process
data related to AI systems deployed in or affecting individuals in the
European Union. The EU AI Act Readiness Compliance Pack includes risk
classification engines, conformity assessment templates, and high-risk
AI documentation tools.[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

**A.2 AI System Transparency**

When Phase Mirror processes data about your AI systems for EU AI Act
compliance purposes, we commit to:

-   **Documentation:** Maintaining records of processing activities
    > related to your AI system assessments

-   **Transparency:** Providing clear information about how the Platform
    > analyzes and classifies your AI systems

-   **Human Oversight:** Ensuring Dissonance Reports and risk
    > classifications support---rather than replace---human
    > decision-making in conformity assessments

**A.3 High-Risk AI System Data**

If you use Phase Mirror to document or assess high-risk AI systems (as
defined under EU AI Act Article 6), we will:

-   Process technical documentation data only as necessary to provide
    > compliance assessment services

-   Maintain data quality standards appropriate for regulatory
    > documentation

-   Support your obligations to maintain logs and records for the
    > duration required by the EU AI Act (minimum 10 years for high-risk
    > systems)

-   Enable data export in formats suitable for regulatory submission

**A.4 Prohibited AI Practices**

Phase Mirror will not knowingly process data to support AI systems that
fall under prohibited practices (EU AI Act Article 5), including:

-   Social scoring systems

-   Real-time remote biometric identification in public spaces (except
    > as permitted)

-   Exploitation of vulnerabilities of specific groups

-   Subliminal manipulation techniques

**A.5 Data Localization**

For customers requiring EU data residency:

-   Enterprise tier customers may request a dedicated EU-hosted
    > instance[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

-   Calibration data from EU customers will not be transferred outside
    > the EU without appropriate safeguards

-   Upon request, we will provide documentation of data flows for your
    > conformity assessments

**A.6 Conformity Assessment Support**

Phase Mirror maintains records sufficient to support your obligations
under:

-   Article 9 (Risk Management System documentation)

-   Article 11 (Technical Documentation)

-   Article 12 (Record-Keeping)

-   Article 13 (Transparency requirements)

**A.7 Incident Notification**

If we become aware of any security incident affecting data used for your
EU AI Act compliance:

-   We will notify you within 48 hours

-   We will provide information necessary for your regulatory
    > notifications

-   We will cooperate with any supervisory authority inquiries

**Addendum B: HIPAA Business Associate Provisions**

*Applicable to Healthcare & Life Sciences Compliance Pack customers who
are Covered Entities or Business Associates under
HIPAA*[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

**B.1 Business Associate Relationship**

When Phase Mirror receives, creates, maintains, or transmits Protected
Health Information (PHI) on behalf of a Covered Entity or Business
Associate customer, Phase Mirror acts as a Business Associate under 45
CFR § 160.103.

**B.2 Permitted Uses and Disclosures**

Phase Mirror will only use or disclose PHI:

-   As necessary to perform services under our agreement

-   As required by law

-   For the proper management and administration of Phase Mirror,
    > provided disclosures are required by law or we obtain reasonable
    > assurances of confidentiality

-   To report violations of law to appropriate authorities

-   For data aggregation services relating to your healthcare operations
    > (if specified in your agreement)

**B.3 Prohibited Uses**

Phase Mirror will not:

-   Use or disclose PHI for marketing purposes

-   Sell PHI

-   Use or disclose PHI in a manner that would violate HIPAA if done by
    > the Covered Entity

-   Use genetic information for underwriting purposes

**B.4 Safeguards**

Phase Mirror will implement and maintain:

  Safeguard Type   Measures
  ---------------- ------------------------------------------------------------------------------------------------
  Administrative   Workforce training, access management policies, security officer designation, risk assessments
  Physical         Facility access controls, workstation security, device and media controls
  Technical        Access controls, audit controls, integrity controls, transmission security (encryption)

**B.5 Minimum Necessary Standard**

Phase Mirror will limit PHI use, disclosure, and requests to the minimum
necessary to accomplish the intended purpose, except for:

-   Disclosures to or requests by healthcare providers for treatment

-   Disclosures to the individual who is the subject of the PHI

-   Uses or disclosures made pursuant to a valid authorization

-   Disclosures to HHS for compliance investigations

-   Uses or disclosures required by law

**B.6 Individual Rights Support**

Phase Mirror will, within 10 business days of request:

-   Provide access to PHI in a Designated Record Set to enable your
    > response to individual access requests

-   Make PHI available for amendment and incorporate amendments as
    > directed

-   Provide information needed for accountings of disclosures

-   Support restrictions on use/disclosure if agreed to by you

**B.7 Subcontractors**

Phase Mirror will ensure any subcontractors who create, receive,
maintain, or transmit PHI agree in writing to the same restrictions and
conditions that apply to Phase Mirror.

**B.8 Breach Notification**

In the event of a breach of unsecured PHI:

  Requirement             Commitment
  ----------------------- -------------------------------------------------------------------------------------------------------
  Discovery               Phase Mirror will be deemed to have discovered a breach when known to any employee, officer, or agent
  Notification Timeline   Within 30 days of discovery
  Notification Content    Identification of affected individuals, description of PHI involved, recommended mitigation steps
  Investigation Support   Full cooperation with your breach investigation and risk assessment
  Documentation           Maintenance of breach documentation for 6 years

**B.9 Termination**

Upon termination of the agreement:

-   Phase Mirror will return or destroy all PHI, if feasible

-   If return or destruction is not feasible, protections will extend to
    > retained PHI indefinitely

-   Phase Mirror will certify destruction or explain why destruction is
    > not feasible

**B.10 Regulatory Access**

Phase Mirror will make internal practices, books, and records relating
to PHI use and disclosure available to the Secretary of HHS for
compliance determination purposes.

**B.11 HIPAA-Specific Platform Features**

For Healthcare & Life Sciences Compliance Pack customers, the Platform
includes:[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

-   HIPAA AI provisions rule sets

-   FDA Software as a Medical Device (SaMD) guidance alignment

-   Clinical decision support documentation templates

-   Audit logging compliant with 45 CFR § 164.312(b)

**Addendum C: Financial Services Data Handling Provisions**

*Applicable to Financial Services Compliance Pack
customers*[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

**C.1 Scope and Applicability**

These provisions apply to customers in the financial services industry
using Phase Mirror for AI governance, including banks, broker-dealers,
investment advisers, insurance companies, and other regulated financial
institutions.

**C.2 SEC AI Disclosure Support**

Phase Mirror processes data to support your compliance with SEC
requirements for material AI risk disclosure. We
will:[^[\[2\]]{.underline}^](#kix.8s0thehtdjd6)

-   Maintain records of AI system assessments for the duration required
    > by securities regulations

-   Provide audit trails suitable for regulatory examination

-   Support your ability to demonstrate defensible governance
    > architecture

**C.3 Model Risk Management (SR 11-7 Alignment)**

For customers subject to Federal Reserve SR 11-7 guidance on model risk
management, Phase Mirror supports:

  SR 11-7 Element     Phase Mirror Support
  ------------------- ----------------------------------------------------------------------------------
  Model Development   Documentation of AI system design decisions and governance choices
  Model Validation    Dissonance Reports identifying gaps between stated governance and implementation
  Model Use           Tracking of production deployment and monitoring commitments
  Governance          Audit trails of policy decisions and approval workflows

**C.4 Fair Lending Compliance**

The Financial Services Compliance Pack includes fair lending rules. When
processing data related to lending AI
systems:[^[\[1\]]{.underline}^](#kix.v30rv19j4dan)

-   Phase Mirror will not use Customer Data to make or influence credit
    > decisions

-   Dissonance Reports may identify potential fair lending risks but do
    > not constitute legal advice

-   Data processed for fair lending analysis will be handled with
    > heightened access controls

**C.5 Gramm-Leach-Bliley Act (GLBA) Alignment**

Phase Mirror maintains safeguards consistent with GLBA requirements:

**Safeguards Rule Compliance:**

-   Designation of personnel responsible for information security

-   Risk assessment procedures for Customer Data

-   Design and implementation of safeguards

-   Regular testing and monitoring

-   Oversight of service providers

-   Evaluation and adjustment of security programs

**C.6 Non-Public Personal Information (NPI)**

If Customer Data includes NPI as defined under GLBA:

-   Phase Mirror will not disclose NPI to non-affiliated third parties
    > except as permitted by GLBA

-   NPI will not be used for calibration data aggregation unless fully
    > de-identified per GLBA standards

-   Access to NPI is limited to personnel with legitimate business need

**C.7 Data Retention for Financial Services**

  Data Category              Retention Period                     Basis
  -------------------------- ------------------------------------ ------------------------------------
  AI System Assessments      7 years minimum                      SEC Books and Records requirements
  Model Validation Records   7 years or model lifetime +2 years   SR 11-7 guidance
  Fair Lending Analysis      5 years minimum                      ECOA/Regulation B
  Audit Logs                 7 years                              General securities compliance

**C.8 Examination and Audit Rights**

Phase Mirror will:

-   Cooperate with regulatory examinations (SEC, OCC, Federal Reserve,
    > state regulators) as required

-   Provide access to relevant records upon reasonable notice

-   Support your internal audit functions with necessary documentation

-   Maintain SOC 2 Type II certification (Enterprise tier)

**C.9 Third-Party Risk Management**

We understand financial institutions must manage third-party risk. Phase
Mirror provides:

-   Annual SOC 2 Type II reports (available to Business and Enterprise
    > customers)

-   Responses to standardized third-party risk questionnaires (SIG,
    > CAIQ)

-   Documentation of our information security program upon request

-   30-day notice of material changes to our security practices

**C.10 Business Continuity**

Phase Mirror maintains business continuity and disaster recovery
capabilities:

  Tier         Recovery Time Objective   Recovery Point Objective
  ------------ ------------------------- --------------------------
  Team         24 hours                  24 hours
  Business     8 hours                   4 hours
  Enterprise   4 hours                   1 hour

**C.11 Data Residency for Financial Services**

Enterprise tier financial services customers may request:

-   U.S.-only data processing and storage

-   Dedicated infrastructure isolated from other customers

-   Enhanced logging and access monitoring

-   Custom data handling procedures per regulatory requirements

**C.12 Incident Response for Financial Services**

In the event of a security incident affecting financial services
Customer Data:

  Step                 Timeline          Action
  -------------------- ----------------- -----------------------------------------------------------------
  Detection            Immediate         Automated monitoring and alerting
  Assessment           Within 4 hours    Severity classification and scope determination
  Notification         Within 24 hours   Customer notification for material incidents
  Regulatory Support   As needed         Support for your regulatory notifications (varies by regulator)
  Remediation          Ongoing           Root cause analysis and corrective action
  Documentation        Within 30 days    Incident report and lessons learned

**Integration Notes**

These addenda should be incorporated into the main Privacy Policy as
follows:

**Add to Section 2 (Information We Collect):**

> \"For customers using industry-specific Compliance Packs, additional
> data categories may apply as described in the applicable Addendum.\"

**Add to Section 3 (How We Use Your Information):**

> \"Industry-specific uses are detailed in Addenda A (EU AI Act), B
> (HIPAA), and C (Financial Services), as applicable to your
> subscription.\"

**Add to Section 6 (Data Retention):**

> \"Customers subject to industry-specific regulations should refer to
> the applicable Addendum for extended retention requirements.\"

**Items Requiring Your Input**

-   **HIPAA Breach Notification Timeline:** I used 30 days (HIPAA
    > requires reporting to Covered Entity within 60 days, but faster is
    > better practice---adjust as needed)

-   **SOC 2 Certification Status:** Confirm if you have or plan to
    > obtain SOC 2 Type II

-   **Specific Financial Regulators:** Add any additional regulators
    > relevant to your customer base

-   **RTO/RPO Numbers:** Verify the business continuity metrics align
    > with your infrastructure

-   **EU Instance Availability:** Confirm if EU-hosted dedicated
    > instances are currently available
