Walgreens can use data that has been stripped of identifying information for any purpose, including research, and states it will not try to re-identify individuals from that data.
This analysis describes what Walgreens's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The assertion of unlimited use rights for de-identified data depends on whether the de-identification meets applicable legal standards, and re-identification risk from health and pharmacy data is a recognized technical and regulatory concern.
Interpretive note: The enforceability of unrestricted use rights for de-identified data depends on whether Walgreens' de-identification methods satisfy applicable legal standards under HIPAA and state consumer privacy laws, which are not specified in the policy.
Your health, pharmacy, and shopping data may be de-identified and used or shared without restriction for any purpose including commercial research and analytics, subject to whether de-identification meets applicable legal standards such as HIPAA's Safe Harbor or Expert Determination methods.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We may use and share de-identified or aggregated information for any purpose, including research and analytics. We maintain and use de-identified data without attempting to re-identify it.Excerpt from Walgreens's Privacy Policy
REGULATORY LANDSCAPE: HIPAA's Privacy Rule establishes specific de-identification standards including the Safe Harbor method and Expert Determination method; data that does not meet these standards retains its status as protected health information.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The assertion of unlimited use rights for de-identified data depends on whether the de-identification meets applicable legal standards, and re-identification risk from health and pharmacy data is a recognized technical and regulatory concern.
Your health, pharmacy, and shopping data may be de-identified and used or shared without restriction for any purpose including commercial research and analytics, subject to whether de-identification meets applicable legal standards such as HIPAA's Safe Harbor or Expert Determination methods.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walgreens.