Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes disclosure of personal information to third parties in connection with proposed or actual mergers, acquisitions, consolidations, asset sales, bankruptcies, and other corporate transactions. This authorization applies to proposed as well as completed transactions.
This analysis describes what Oscar Health's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes pre-transaction disclosure of personal information to potential acquirers or transaction counterparties before any transaction is completed, which means personal data may be disclosed to third parties who ultimately do not complete a transaction with Oscar.
Under this provision, personal information including identifiers, health-adjacent data, and financial information may be disclosed to counterparties in connection with a proposed corporate transaction, including transactions that are not ultimately completed. No user notification or opt-out mechanism is described for this disclosure category.
Cross-platform context
See how other platforms handle Corporate Transaction Disclosure and similar clauses.
Compare across platforms →Monitoring
Oscar Health has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Corporate Transactions: We may disclose your Personal Information in connection with a proposed or actual corporate merger, acquisition, consolidation, sale of assets, bankruptcy, insolvency, or other corporate change... Support Business Transfers. To implement mergers, acquisitions, reorganizations, and other business transactions, and where necessary to the administration of our general business, accounting, recordkeeping, and legal functions.Excerpt from Oscar Health's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates FTC guidance on data transfer in corporate transactions, particularly in contexts where the acquiring entity may operate under materially different privacy practices. State consumer privacy statutes in California and other named states may impose notification or consent requirements where a corporate transaction results in a material change to privacy practices. HIPAA requires Business Associate Agreements and restricts PHI disclosure in transaction contexts. 2) GOVERNANCE EXPOSURE: Medium. The inclusion of proposed as well as actual transactions as triggers for disclosure is notable; pre-transaction data sharing without a completed agreement raises the question of what confidentiality and use restrictions apply to prospective acquirers who do not complete a transaction. The policy does not specify what contractual protections are required before pre-transaction disclosure. 3) JURISDICTION FLAGS: California's CPRA includes provisions addressing material changes to privacy practices following corporate transactions. EU/EEA users, if any, would face GDPR Article 6 lawful basis considerations for this transfer category. HIPAA imposes separate requirements on disclosure of PHI in corporate transaction contexts. 4) CONTRACT AND VENDOR IMPLICATIONS: Due diligence and M&A teams should confirm that non-disclosure agreements with prospective transaction counterparties include data protection obligations consistent with Oscar's privacy policy commitments. Post-transaction integration plans should address notification obligations to users if the acquiring entity's privacy practices differ materially from those stated in this policy. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should review whether pre-transaction data sharing is limited to de-identified or aggregated data where possible, and should confirm that data rooms and due diligence processes include appropriate access controls and use restrictions. State law notification requirements triggered by a change of control should be mapped against the user populations covered by this policy.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes pre-transaction disclosure of personal information to potential acquirers or transaction counterparties before any transaction is completed, which means personal data may be disclosed to third parties who ultimately do not complete a transaction with Oscar.
Under this provision, personal information including identifiers, health-adjacent data, and financial information may be disclosed to counterparties in connection with a proposed corporate transaction, including transactions that are not ultimately completed. No user notification or opt-out mechanism is described for this disclosure category.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oscar Health.