Disclosure of Data in Business Transactions

What it is

Calm may transfer your personal data to another company if Calm is acquired, merges, or sells its assets, even if that company has different privacy practices.

Why it matters (compliance & governance perspective)

In a corporate transaction, your personal data including sensitive wellness and mood data could be transferred to a new entity whose privacy practices you have not agreed to.

Clause Stability Stable

Consumer impact (what this means for users)

If Calm is sold or merges with another company, your personal data including sleep habits, mood check-ins, and health app data may be transferred to the acquiring entity as part of that transaction.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Asset transfer clauses in privacy policies are reviewed by the FTC under its authority over unfair or deceptive practices, and by GDPR supervisory authorities where EU/UK user data is involved. GDPR generally requires that data transfers to new controllers maintain adequate protections and that users be notified of changes to the data controller. CPRA similarly requires that consumers' rights be honored by successor entities. (2) GOVERNANCE EXPOSURE: Medium. This is a standard clause across consumer technology platforms, but its significance is elevated here given the sensitive nature of the data Calm holds (sleep, mood, health app data). The policy does not commit to notifying users in advance of a transfer or providing an opt-out mechanism in connection with a corporate transaction. (3) JURISDICTION FLAGS: EU/EEA and UK users: a change of data controller requires legal basis re-evaluation and potentially fresh consent depending on the nature of the new controller's intended processing. California users: CPRA rights must be honored by successor entities. The absence of an explicit notice or opt-out commitment in connection with a transaction creates exposure in these jurisdictions. (4) CONTRACT AND VENDOR IMPLICATIONS: Due diligence in M&A contexts should include a data asset inventory confirming the sensitivity and volume of personal data that would transfer, the applicable regulatory obligations, and any consent dependencies that could affect data usability post-transaction. (5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the policy's general notice of potential asset transfer is sufficient under applicable law, particularly GDPR's controller change requirements. A specific notification and re-consent protocol for corporate transactions involving sensitive personal data should be considered.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cross-Platform Ad Targeting Using Email or Phone Identifiers medium
• Health App Data Collection (Apple HealthKit and Google Health Connect) medium
• Inferred Characteristics Including Age and Gender Estimates medium
• Employer-Provided Subscription Disclosure low
• International Data Transfer Mechanisms medium
• Behavioral Advertising and Cookie-Based Tracking medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.