Privacy & Compliance

Mirobody’s platform is designed around HIPAA and US health-data protection principles — access control, encryption, isolation, retention limits, and erasure controls. It runs in separate regional environments: the global and China clusters are live, and Japan and EU clusters are in preparation. See Regions before choosing a base URL.

This page describes the product controls the API exposes and the regulatory frameworks that may apply. It is not a certification claim: your obligations depend on your use case, contract, data flows, and region.

Product controls

Subject isolation

Every authenticated /v1 request is scoped to the API-key owner. Within that account, the user field resolves to an isolated Subject. A developer cannot use an API key to read another account’s Subjects.

Use a stable, non-sensitive identifier for user; do not put an email address, medical record number, or other direct identifier in the field unless your data policy requires it.

API credentials

API keys use the mb_live_* format. The full secret is returned only when the key is created; the service stores a hash, and the developer console then shows only the key prefix. Revoke a key immediately if it may have been exposed.

Retention and deletion

The API exposes explicit controls for each storage surface:

Scope	Control
Structured records	DELETE /v1/data; timed retention (1h, 2h, 6h, 1d)
Files	DELETE /v1/files/{file_key}; timed or session retention
Stored responses	DELETE /v1/responses/{id}
Session-scoped data and files	DELETE /v1/sessions/{id}
Entire Subject	DELETE /v1/subjects/{user}

DELETE /v1/sessions/{id} does not delete stored response objects. For the exact behavior of every deletion path, see Data Lifecycle and State & Memory.

Traceable outputs

Agent responses can include tool_steps, health_records, and citations so applications can inspect the tool calls and evidence returned for an answer. These fields are an execution trace, not a guarantee that private model reasoning or every internal operation is exposed.

On the Agent API, store:false prevents the response object and conversation thread from being retained after the request. It also keeps that turn from contributing to the Subject’s stored memory.

Regional processing

The regional environments use separate hosts and storage. Data sent to api.mirobody.ai/v1 is processed in the global environment; data sent to api.mirobody.cn/v1 is processed in the China-region environment. Do not switch regions for the same Subject unless your own compliance review permits the resulting data transfer.

Regulatory review

For a US healthcare workload, review your obligations under the HIPAA Privacy and Security Rules and confirm whether a Business Associate Agreement (BAA) is required for your deployment. Product capability alone does not make a workload HIPAA-eligible — the applicable agreements and your own safeguards must also be in place.

If you use the China-region deployment (api.mirobody.cn), your workload may additionally be subject to Chinese data-protection law:

Law	Official text
Personal Information Protection Law (PIPL)	National People’s Congress
Data Security Law	State Council
Cybersecurity Law	State Council

Security and compliance package

For a security questionnaire, architecture review, data-processing terms, or the current availability of a DPA, BAA, or independent assessment, contact Mirobody Support. Obtain the applicable documents before sending regulated production data.