Noom Privacy Policy

This document is Noom's privacy policy governing the collection, use, and sharing of personal data when users interact with Noom's weight management and behavior change services, operating primarily under a notice-and-consent framework with additional state-specific rights sections. The policy states that Noom collects a broad range of personal information including health and fitness data (weight, food logs, exercise habits), precise geolocation, payment information, and behavioral data, and the terms authorize use of this data for product improvement, personalization, advertising, and sharing with third-party partners including advertising networks and analytics providers. Notably, the policy discloses sharing of health-related information with third parties for advertising and business purposes, which represents a sensitive data practice given the nature of the service; the agreement asserts broad consent to this sharing, though applicable law in certain jurisdictions (particularly California under CPRA and sensitive data provisions) may impose additional restrictions or opt-in requirements that the document's framing does not fully foreground. The policy engages CCPA/CPRA for California residents, GDPR and UK GDPR for EU and UK users, and potentially HIPAA where Noom acts in a covered-entity-adjacent capacity, though the document explicitly states Noom is not a HIPAA-covered entity; FTC Act unfair and deceptive practices standards also apply given Noom's prior regulatory history. Compliance teams should note the intersection of sensitive health data processing, broad third-party sharing authorizations, and the patchwork of US state privacy laws that may each impose distinct consent and opt-out obligations.