Ada Health
This document covers privacy alone, so this is its privacy score rather than a nine-category verdict. Lower is worse.
Executive summary
Indefinite data retention and unrestricted third-party sales of sensitive health information expose users to severe privacy risks. While the policy nominally acknowledges GDPR and CCPA deletion rights, it imposes a 90-day response window and allows refusal of requests deemed excessive. Users should avoid submitting sensitive medical information and immediately exercise deletion rights upon account closure.
Worst parts of this document
Health & Behavioral Data
10Explicitly monetizes symptom reports and health assessments through ad profiling.
Data Retention & Governance
15Indefinite retention tied to commercial utility with persistent backup copies.
Third-Party Sharing
20Broadly shares and sells data to affiliates, ad networks, and commercial partners for their own purposes.
AI/ML Training on User Data
20Trains proprietary models using personal and broker-sourced data without explicit consent.
User Opt-Out Rights
20No mechanism to reject changes other than discontinuing service entirely.
Collects symptom reports and health assessments alongside precise location and browsing behavior
22We use your personal data to provide the service, to build advertising profiles, and to train our machine learning models.
The policy authorizes indefinite retention, shares and sells sensitive health and behavioral data to third parties for their own purposes, trains AI models on user data, and offers weak consent controls with lengthy response times.
Category breakdown
7 of the nine categories are not addressed by this document, so they are left out rather than scored.
Data Privacy
Data collection, usage, and protection
The policy authorizes indefinite retention, shares and sells sensitive health and behavioral data to third parties for their own purposes, trains AI models on user data, and offers weak consent controls with lengthy response times.
Key findings
- Collects symptom reports and health assessments alongside precise location and browsing behavior
- Share personal information, including health-related data, with commercial partners for their own purposes
- Retain personal data indefinitely... Backup copies may persist after you delete your account
- Train our machine learning models
- Opting out of tracking may not be possible on all devices
Evidence from the document
We use your personal data to provide the service, to build advertising profiles, and to train our machine learning models.
We may share your personal information, including health-related data, with our affiliates, advertising networks, analytics providers and commercial partners for their own purposes.
We retain your personal data indefinitely, or for as long as it remains commercially useful.
Opting out of tracking may not be possible on all devices.
Recommendations
- Avoid submitting sensitive health data given the broad sharing and AI training clauses
- Submit formal GDPR/CCPA deletion requests immediately upon leaving the service
- Use network-level ad blockers to mitigate cross-site tracking
Modification of Terms
How agreements can be changed
The company reserves the right to modify the policy unilaterally at any time, binding users through mere continued use without providing advance notice or an explicit opt-out mechanism.
Key findings
- May update this privacy policy at any time
- Continued use of the service constitutes acceptance of the updated policy
- No requirement for advance notice or material change definitions
Evidence from the document
We may update this privacy policy at any time. Continued use of the service constitutes acceptance of the updated policy.
Recommendations
- Regularly check the privacy policy page for updates
- Disable automatic app updates to control when new terms are encountered
Read the source document:
See the full interactive reportEx-TerCo provides automated analysis of legal documents for informational purposes. This is not legal advice. Terms can change at any time.