Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes Noom to use all collected data categories, including sensitive information such as health data, sensitive demographic data, account credentials, and in-app communications content, for the development of AI and machine learning products and services.
This analysis describes what Noom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes use of the full scope of collected sensitive data, including health data and demographic data, for AI and machine learning development purposes, which extends beyond the direct service delivery context and may require distinct legal basis evaluation under GDPR Article 9 and emerging AI governance frameworks.
Under this provision, all data categories Noom collects, including health data, sensitive demographic data, and in-app communications, may be used to develop new AI and machine learning products and services, not only to deliver the existing Noom service. This use is listed as a stated purpose applicable to sensitive information categories.
Cross-platform context
See how other platforms handle AI and Machine Learning Development Use of All Data Categories and similar clauses.
Compare across platforms →Monitoring
Noom has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Product improvement, development, and research. To improve our products and services and develop new products and services (including AI/ML) and conduct user research (surveys, interviews). Contact information, demographic data, payment information, content and files, identifiers and device information, geolocation data, log data, usage data, sensor data, inferences. Sensitive Information: Account access information, sensitive demographic data, contents of communications, health data.Excerpt from Noom's Privacy Policy
(1) REGULATORY LANDSCAPE: Use of sensitive personal data for AI and machine learning development engages GDPR Articles 5, 6, and 9 (lawfulness, purpose limitation, and special categories); the EU AI Act to the extent AI systems developed using this data are deployed in the EEA; CPRA provisions on use of sensitive personal information; and potentially the FTC Act's prohibition on deceptive practices if AI development use is not clearly communicated to users. The purpose limitation principle under GDPR requires that data be used only for purposes compatible with the original collection purpose, which may require evaluation where health data collected for wellness coaching is repurposed for AI product development. (2) GOVERNANCE EXPOSURE: High. The use of health and sensitive demographic data for AI/ML development is a materially distinct purpose from service delivery. GDPR's purpose limitation and data minimization principles, and CPRA's restrictions on use of sensitive personal information, may constrain the breadth of this authorization as asserted in the policy. (3) JURISDICTION FLAGS: EEA and UK (GDPR purpose limitation and Article 9 for special categories); California (CPRA right to limit use of sensitive personal information); Washington (My Health My Data Act). The EU AI Act may also create obligations depending on the risk classification of AI systems developed using this data. (4) CONTRACT AND VENDOR IMPLICATIONS: If third-party vendors or research partners participate in AI/ML development using Noom user data, data processing agreements must address the sensitive data categories involved and confirm purpose limitation compliance. (5) COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether the legal basis supporting health data collection for service delivery is sufficient to extend to AI/ML development purposes; whether separate consent is required for this use in GDPR-covered jurisdictions; and whether data minimization and pseudonymization controls are applied when using sensitive data for AI development.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes use of the full scope of collected sensitive data, including health data and demographic data, for AI and machine learning development purposes, which extends beyond the direct service delivery context and may require distinct legal basis evaluation under GDPR Article 9 and emerging AI governance frameworks.
Under this provision, all data categories Noom collects, including health data, sensitive demographic data, and in-app communications, may be used to develop new AI and machine learning products and services, not only to deliver the existing Noom service. This use is listed as a stated purpose applicable to sensitive information categories.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Noom.