When users enable services that provide Stripe access to third-party data including personal data, users authorize that access and are solely responsible for obtaining all necessary consents; users are expressly prohibited from providing Protected Health Information to Stripe and bear liability for any PHI disclosure.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision places the consent and legal authorization burden entirely on the user for third-party personal data provided to Stripe, and establishes user liability for any Protected Health Information transmitted to Stripe regardless of whether the transmission was intentional.
The agreement establishes that users are responsible for obtaining all necessary rights and consents from individuals whose third-party data is provided to Stripe through enabled services; users bear full liability for any Protected Health Information disclosed to Stripe through third-party data access, as stated in Section 4.5.
Cross-platform context
See how other platforms handle Third Party Data Authorization and PHI Prohibition and similar clauses.
Compare across platforms →"If User enables Services or functionality that provide Stripe access to data, including Personal Data and Content, from User's third party service providers ('Third Party Data'), then User authorizes Stripe to access and use the Third Party Data, and User must obtain all necessary rights and consents from the applicable individuals and third parties sufficient to enable Stripe to lawfully collect, use, retain, and disclose the Third Party Data. Stripe will use Third Party Data as this Agreement describes and to (a) secure, provide, and update the Stripe services, (b) comply with Law and Financial Provider requirements, and (c) prevent and mitigate fraud, financial loss, and other harm. User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data.Excerpt from Stripe's Terms of Service
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision places the consent and legal authorization burden entirely on the user for third-party personal data provided to Stripe, and establishes user liability for any Protected Health Information transmitted to Stripe regardless of whether the transmission was intentional.
The agreement establishes that users are responsible for obtaining all necessary rights and consents from individuals whose third-party data is provided to Stripe through enabled services; users bear full liability for any Protected Health Information disclosed to Stripe through third-party data access, as stated in Section 4.5.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.