This analysis describes what Calm's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The obligation to provide adequate safeguards is conditional on legal requirement, meaning protections for international transfers apply only where law mandates them rather than universally.
Interpretive note: The protections are explicitly conditioned on being 'where required by law', which means they are not a blanket commitment. The listed mechanisms are illustrative ('such as'), not exhaustive.
The updated policy now permits Calm to infer health-related characteristics from information users voluntarily provide about their feelings, though such inferred data will only be processed for the stated purpose. For minors, the policy explicitly prohibits targeted advertising and data sales, and applies age-appropriate data minimization practices. For residents of 20+ U.S. states with privacy laws, the policy adds detailed disclosures of privacy rights, including the ability to opt out of targeted advertising and data sales (scope varies by state), designate agents to exercise rights on their behalf (Colorado, Connecticut, Minnesota), and request lists of third parties receiving personal data (Minnesota). You can exercise these rights by contacting Calm through the methods specified in the policy or following state-specific instructions provided.
View change record →Your personal data may be transferred internationally, and legal transfer safeguards will be in place only where applicable law requires them.
How other platforms handle this
Whenever we transfer your personal data to third parties located in other countries, we will ensure that these companies comply with applicable data protection laws and we will take all measures that are reasonably necessary to ensure the existence of adequate safeguards...
All transfers of information to service providers are covered by appropriate data agreements and, in the case of cross-border data transfers, legal mechanisms for doing so.
Any information you provide through use of the Sites may be stored and processed, transferred between, and accessed from the United States and other countries which may not guarantee the same level of protection of Personal Information as the one in which you reside.
"Where required by law, we provide adequate protection for the transfer of personal data in accordance with applicable law, such as by obtaining your consent, relying on the European Commission's adequacy decisions, or executing Standard Contractual Clauses.Excerpt from Calm's Privacy Policy
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
The obligation to provide adequate safeguards is conditional on legal requirement, meaning protections for international transfers apply only where law mandates them rather than universally.
Your personal data may be transferred internationally, and legal transfer safeguards will be in place only where applicable law requires them.
ConductAtlas has identified this type of provision across 280 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Calm.