The policy discloses that health information is shared with healthcare providers for treatment and care operations, and that a broad range of personal information is disclosed to service providers supporting billing, marketing, advertising, analytics, research, shipping, data hosting, and other operational functions.
This analysis describes what Ro's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies the categories of third parties receiving user data, including a broad service provider category that encompasses advertising and marketing vendors. The inclusion of marketing and advertising functions within the service provider category is relevant to assessing whether these disclosures constitute sales or shares under applicable state privacy law.
Interpretive note: Whether advertising and marketing service providers receiving health-adjacent data are subject to HIPAA business associate requirements depends on the specific data categories shared and the nature of the affiliated medical entities involved, which cannot be fully determined from the policy text alone.
The updated policy establishes that Ro has enabled contractual settings with certain advertising partners that restrict those partners' use of data to service provision only, meaning those partners may not use the information for their own advertising or profiling purposes. The policy also expands the list of states where Ro does not sell sensitive personal information for tailored advertising, adding New Jersey, New Hampshire, Nebraska, Iowa, and Delaware. For residents of the newly added states and others covered by partner settings, default restrictions on data use may apply even without an explicit opt-out. You can manage advertising preferences through the policy's stated opt-out mechanisms, including the 'Your Privacy Choices' page and Global Privacy Control signals.
View change record →Under these terms, your health information may be shared with healthcare providers, pharmacies, and a range of service providers supporting advertising, marketing, analytics, research, and other operational purposes. The policy states that service provider disclosures are for services performed on Ro's behalf, though the breadth of permitted purposes encompasses advertising and marketing functions.
Cross-platform context
See how other platforms handle Health Information Disclosure to Third-Party Providers and Service Providers and similar clauses.
Compare across platforms →"We disclose your information to health care providers: (i) to schedule and fulfill appointments and provide health care services as part of the Services, (ii) to whom you send messages through our Services, and (iii) for other treatment, payment or health care operations purposes, including pharmacy services, upon your request. We provide access to or disclose your information to select third parties who use the information to perform services on our behalf. They provide a variety of services to us, including billing, content/service enhancements, partner labs, sales, marketing, advertising, analytics, research, customer service, shipping and fulfillment, data hosting and storage, IT and security, fraud prevention, payment processing, and auditing, consulting, and legal services.Excerpt from Ro's Privacy Policy
REGULATORY LANDSCAPE: This provision implicates HIPAA's permitted disclosures for treatment, payment, and healthcare operations, as well as state privacy law frameworks governing service provider data sharing.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision identifies the categories of third parties receiving user data, including a broad service provider category that encompasses advertising and marketing vendors. The inclusion of marketing and advertising functions within the service provider category is relevant to assessing whether these disclosures constitute sales or shares under applicable state privacy law.
Under these terms, your health information may be shared with healthcare providers, pharmacies, and a range of service providers supporting advertising, marketing, analytics, research, and other operational purposes. The policy states that service provider disclosures are for services performed on Ro's behalf, though the breadth of permitted purposes encompasses advertising and marketing functions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ro.