AI Training Use of Personal Information

What it is

The policy states that Oscar may de-identify or anonymize personal information to train, optimize, and enhance AI technology, and may disclose this de-identified information to third-party AI development partners. No specific retention limits, re-identification safeguards, or consent mechanisms are described for this use.

Why it matters (compliance & governance perspective)

This provision authorizes a use of personal information, including de-identification and third-party disclosure for AI development, that is operationally distinct from standard service delivery purposes; the absence of described safeguards against re-identification or limits on third-party AI partner use creates a compliance consideration under FTC guidance on deidentification and emerging state AI governance frameworks.

Consumer impact (what this means for users)

Under this provision, Oscar may process personal information to train internal AI systems and may disclose de-identified versions of that information to third-party AI development vendors. The policy does not describe an opt-out mechanism specific to AI training use, and the general terms do not specify what re-identification protections apply once data is disclosed to third-party AI partners.

Institutional analysis (regulatory & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates FTC guidance on deidentification standards and the FTC Act's prohibition on unfair or deceptive practices, particularly where de-identification claims may not meet the standard required to remove regulatory obligations. State AI governance requirements are emerging in Colorado and other jurisdictions and may require evaluation as they develop. HIPAA de-identification standards under the Safe Harbor or Expert Determination methods are relevant if any de-identified data originates from PHI, though the policy states HIPAA data is governed separately. 2) GOVERNANCE EXPOSURE: Medium. The provision's authorization of third-party disclosure for AI development without specifying re-identification safeguards or data retention limits for AI vendors creates a compliance gap that may need to be addressed through vendor contracts and data processing agreements. The FTC has issued guidance indicating that deidentification must be robust and that downstream use restrictions must be contractually enforced. 3) JURISDICTION FLAGS: California's CPRA and Colorado's Privacy Act both address automated processing and profiling; while the policy states Oscar does not engage in impactful profiling of online users, the AI training disclosure may require evaluation under those frameworks depending on the nature of the AI systems being trained. EU/EEA users, if any, would trigger GDPR considerations regarding automated processing and consent for secondary uses. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that third-party AI development partners operate under data processing agreements that include use limitations, re-identification prohibitions, and data deletion obligations upon project completion. The policy's general statement that service providers are required by contract to protect personal information should be confirmed as applicable to AI development vendors specifically. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the de-identification methodology used prior to AI training meets applicable standards, including FTC guidance and HIPAA Safe Harbor requirements where health-adjacent data is involved. Data mapping should document the specific categories of personal information used for AI training and the identity of third-party AI partners. A review of consent mechanisms should confirm whether the current privacy notice constitutes adequate disclosure of AI training use under applicable state frameworks.

Applicable agencies

Provision details

Other risks in this policy

• Use of PI for marketing and advertising medium
• Account permanently terminated upon deletion request high
• Acknowledgment of notice terms by use high
• California PI sold or shared with third parties high
• Collection of direct personal identifiers high
• Disclosure to third party ad networks high