The policy discloses that user data, including data from EEA, UK, and Swiss residents, may be transferred to and processed in the United States and other countries, some of which do not have European Commission adequacy determinations, with Noom relying on contractual mechanisms such as standard contractual clauses to support such transfers.
This analysis describes what Noom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that sensitive health data, demographic data, and communications content collected from EEA, UK, and Swiss residents may be transferred to the United States under contractual transfer mechanisms, creating compliance obligations under GDPR Chapter V and requiring verification that transfer impact assessments and standard contractual clauses are current and adequate.
Interpretive note: The specific transfer mechanism relied upon (such as standard contractual clauses or EU-US Data Privacy Framework certification) is not named in the policy, creating ambiguity about the applicable safeguard and its adequacy under current GDPR guidance.
Under this provision, personal and sensitive data collected from users globally, including EEA, UK, and Swiss residents, may be stored and processed in the United States, which does not have a blanket European Commission adequacy determination for all data transfers. Noom states it uses contractual mechanisms to support these transfers, but the specific mechanism (such as standard contractual clauses) is not named in the policy text provided.
Cross-platform context
See how other platforms handle Cross-Border Data Transfer to United States and similar clauses.
Compare across platforms →"The information we collect may be stored and processed in your country or region, or in any other country where we or our affiliates, subsidiaries, or service providers process data. Currently, we primarily use data centers in the United States. These locations were chosen to operate efficiently and improve our performance. We take steps to protect your information as described in this policy wherever the data are located, some of which have not been determined by the European Commission to have an adequate level of data protection. When we do so, we use legal mechanisms, including contracts, to help ensure your rights and protections.Excerpt from Noom's Privacy Policy
(1) REGULATORY LANDSCAPE: Cross-border data transfers from the EEA engage GDPR Chapter V, which requires either an adequacy decision, appropriate safeguards such as standard contractual clauses, or derogations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that sensitive health data, demographic data, and communications content collected from EEA, UK, and Swiss residents may be transferred to the United States under contractual transfer mechanisms, creating compliance obligations under GDPR Chapter V and requiring verification that transfer impact assessments and standard contractual clauses are current and adequate.
Under this provision, personal and sensitive data collected from users globally, including EEA, UK, and Swiss residents, may be stored and processed in the United States, which does not have a blanket European Commission adequacy determination for all data transfers. Noom states it uses contractual mechanisms to support these transfers, but the specific mechanism (such as standard contractual clauses) is …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Noom.