Privacy Policy

Mirror Group LLC

Effective Date: January 2026

At Mirror Group, we believe that trust is the foundation of every meaningful relationship. Whether you are visiting our website, participating in a learning experience, contributing to research, or partnering with us on a project, we are committed to protecting your personal information.

We recognize that the people and communities we serve are more than data points. Their experiences, perspectives, and information deserve to be treated with care, dignity, and respect.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have regarding your personal information.

1. Information We Collect

We collect only the information reasonably necessary to provide our services, support our partnerships, and operate our organization.

Depending on how you interact with Mirror Group, we may collect:

Contact and Professional Information

Your name, email address, organization, professional role, and information you share when contacting us or requesting services.

Website Information

Basic technical information, such as your browser type, device information, IP address, approximate location, and website activity. This helps us understand how visitors use our website and improve their experience.

Learning and Program Information

If you participate in a Mirror Institute course, workshop, or professional development program, we may collect registration details, course progress, assessment results, certificates, and feedback.

Research and Evaluation Information

When you participate in research, surveys, interviews, or focus groups, we may collect responses, demographic information, or recordings when authorized. We explain what information is being collected and how it will be used before participation.

Business and Employment Information

For clients, consultants, contractors, applicants, and business partners, we may collect professional qualifications, contracts, payment details, tax documentation, and other information needed to manage our working relationships.

Security Information

We may collect account activity and technical logs to protect our systems and investigate potential security concerns.

We collect sensitive personal information only when necessary for an authorized purpose and with appropriate safeguards. Please do not submit sensitive information through general website contact forms unless specifically requested through an approved channel.

2. How We Use Your Information

We use personal information to support our work and provide meaningful, high-quality services.

This includes:

• Responding to questions and communicating with you.

• Managing consulting, research, evaluation, and learning projects.

• Registering participants for courses and professional development programs.

• Tracking learning progress and issuing certificates.

• Conducting research and preparing findings or reports.

• Managing contracts, payments, and business relationships.

• Improving our services and protecting our technology systems.

• Meeting applicable legal and contractual requirements.

We do not use participant or community information for unrelated purposes without appropriate authorization.

3. Protecting Research Participants and Community Information

Research and evaluation are central to Mirror Group's work. We recognize the importance of protecting the experiences, perspectives, and information shared by individuals and communities.

When conducting research or evaluation activities, we:

• Explain how information will be collected and used.

• Follow applicable participant consent requirements.

• Protect confidential and sensitive information.

• Generally present findings in summary or de-identified form.

• Follow applicable research ethics requirements, agreements, and approved protocols.

• Obtain required authorization before recording or transcribing sessions.

Some research activities may have additional privacy requirements. These will be explained in the relevant project materials.

We also recognize that confidentiality has limits, including legal disclosure requirements and situations where individuals may be identifiable in small groups.

Our commitment to responsible information stewardship does not replace applicable laws, contractual agreements, or intellectual property rights.

4. When We Share Information

Mirror Group does not sell, rent, or trade personal information.

We share information only when necessary to deliver our services, meet authorized obligations, or comply with the law.

Information may be shared with:

• Authorized employees, consultants, and project partners who need it to perform their work.

• Trusted service providers supporting learning platforms, communications, payments, research, and business operations.

• Clients, funders, or program sponsors when permitted by applicable agreements and notices.

• Government agencies, courts, or other authorities when legally required.

• Authorized parties involved in a business transaction, subject to applicable protections.

Our service providers and partners are expected to follow appropriate confidentiality and security requirements.

Some third-party technology providers may store or process information in other locations.

5. Our Approach to Artificial Intelligence

Mirror Group recognizes that artificial intelligence can support creativity, learning, research, and organizational effectiveness. We also recognize the responsibility that comes with using these technologies.

We permit limited use of approved AI tools for appropriate, non-sensitive activities, such as developing general training materials, preparing templates, and reviewing publicly available information.

To protect privacy and confidentiality:

• We prohibit entering confidential client information or research participant data into generative AI tools.

• We do not enter personal identifiers, protected health information, confidential financial records, or unpublished research into generative AI systems.

• AI tools must be reviewed and approved before organizational use.

• AI-assisted materials intended for external use are reviewed by qualified personnel.

• AI transcription of client, research, or community sessions requires explicit written consent and approval from our Information Security Officer.

These protections also apply to AI features built into other software platforms.

Our use of AI is guided by human judgment, responsible practices, and respect for the people and organizations we serve.

6. How We Protect Your Information

Protecting information is an important part of our organizational responsibility.

Mirror Group maintains an Information Security Management System informed by recognized security frameworks, including ISO/IEC 27001 and the NIST Cybersecurity Framework.

Our safeguards include:

• Secure storage and encryption of sensitive information.

• Restricted access based on professional responsibilities.

• Multi-factor authentication and account security measures.

• Security training for employees and consultants.

• Review of technology providers and third-party services.

• Monitoring and procedures for responding to security incidents.

• Secure handling and disposal of confidential records.

Although no technology system can guarantee complete security, we continually review and strengthen our practices as technology and security risks evolve.

Our use of recognized frameworks does not represent a claim of independent security certification.

7. How Long We Keep Information

We retain personal information only as long as reasonably necessary for its intended purpose or as required by law, contract, or research agreement.

Our general retention practices include:

Information TypeGeneral Retention PeriodProject recordsProject duration plus 24 months, unless otherwise requiredFinancial and contractual recordsGenerally at least 7 yearsEmployee and contractor recordsGenerally at least 3 years after separation, with longer periods for certain recordsResearch participant informationBased on consent, research protocols, agreements, and legal requirementsWebsite, learning, and security recordsBased on operational needs, applicable requirements, and retention policies

When information is no longer required, we securely delete, anonymize, or dispose of it according to our procedures.

Certain records may be retained longer when required by law, contractual obligations, investigations, or approved research protocols. Backup copies may also remain temporarily under appropriate security controls.

8. Cookies and Website Analytics

Our website may use cookies and similar technologies to support website functionality and understand how visitors interact with our content.

Cookies may help us:

• Maintain essential website functions.

• Understand website traffic and usage.

• Identify opportunities to improve the visitor experience.

You can manage or restrict cookies through your browser settings. Disabling certain cookies may affect website functionality.

Where required by law, we provide additional choices regarding nonessential cookies and applicable advertising technologies.

9. Your Privacy Rights and Choices

We respect your right to understand and make choices about your personal information.

Depending on applicable laws and circumstances, you may have the right to:

• Request access to personal information we maintain about you.

• Ask us to correct inaccurate information.

• Request deletion of eligible personal information.

• Withdraw consent when consent is the basis for processing.

• Opt out of optional marketing communications.

• Request a copy of your information or exercise other rights provided by applicable law.

Some requests may be limited by legal obligations, contractual requirements, research protocols, or other applicable exceptions.

To submit a privacy request:

Email solutions@mirrorgroupllc.com with the subject line Privacy Request.

We may need to verify your identity before fulfilling a request. We respond within applicable legal deadlines and explain any limitations.

If information is managed on behalf of a client or another organization, we may coordinate your request with that organization.

10. Security Incidents and Notifications

We take potential information security incidents seriously.

If we become aware of suspected unauthorized access, disclosure, or loss of information, we investigate and respond according to our established security procedures.

When an incident affects a client or funder, our internal objective is to notify the affected organization as soon as reasonably possible and within 72 hours, or sooner when required by contract.

We also follow applicable legal requirements for notifying affected individuals, regulators, and other parties.

Notification timing and requirements may vary depending on the circumstances.

11. Children's Privacy

Our general website is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13 through our general website services.

Some Mirror Group research, evaluation, or educational programs may involve children or young people.

When these activities are authorized, we follow applicable requirements for parental or guardian consent, youth participation, privacy, and information protection.

12. Updates to This Policy

We review our Privacy Policy at least annually and whenever significant changes occur in our practices or legal obligations.

When updates are made, we will revise the effective date and communicate important changes through our website or other appropriate channels.

Additional notice or consent will be provided when required.

13. Contact Us

We welcome questions about our privacy practices and how we protect information.

Mirror Group LLC
Attention: Mirror Group Operations / Privacy Requests
Email: solutions@mirrorgroupllc.com

At Mirror Group, protecting information is more than a technical responsibility. It is part of how we build trust, honor relationships, and demonstrate care for the individuals and communities who make our work possible.