If you use Noom from outside the US — including from Europe — your health data is transferred to and stored in the United States, where privacy protections may be weaker than in your home country.
EU and UK users' health data — including weight, food logs, and medical conditions — is transferred to the US, where it may be subject to US government surveillance laws and less stringent data protection than GDPR provides.
Cross-platform context
See how other platforms handle Cross-Border Data Transfers and similar clauses.
Compare across platforms →EU and UK users' sensitive health data is transferred to the US, which requires specific legal mechanisms under GDPR — without adequate safeguards, this transfer may be unlawful under European data protection law.
1. REGULATORY FRAMEWORK: Cross-border transfers of personal data from the EU/EEA to the US are governed by GDPR Chapter V (Arts. 44-49), requiring either an adequacy decision, Standard Contractual Clauses (SCCs — Commission Decision 2021/914), Binding Corporate Rules, or derogations. The EU-US Data Privacy Framework (DPF, adopted July 2023) provides an adequacy mechanism for certified US companies. UK IDTA (International Data Transfer Agreement) or UK Addendum to EU SCCs is required for UK transfers. FTC enforcement applies if DPF certifications are falsely claimed. 2.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.