Harvard
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
They collect health interests and device data, share mailing lists with marketers, and you must contact them to opt out.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Name, address, payment, health-topic interests, device data, and extra data from partners.
Read the exact line
Privacy policy
“Such information may include your name, mailing address, email address, user name, password, and payment information (card information and billing address).”
Training
They use it to run the site, send marketing, and target offers, including health topics.
Read the exact line
Privacy policy
“to send you marketing communications that we believe may be of interest to you, including via email in compliance with applicable laws and in accordance with your preferences;”
Sharing
Service providers, payment vendors, and third-party mailers and marketing partners can get your data.
Read the exact line
Privacy policy
“Your name and mailing address may be released for one-time use to carefully screened third-party mailers who offer products or services that may be of interest to our readers.”
Kept
The health policy does not say how long they keep your data.
Read the exact line
Privacy policy
“To remove or change your contact information in our database, or to not receive future mailings or other communications, as well as for all other inquiries, please use one of the following methods:”
Controls
You can unsubscribe in emails or email/call them to change or remove your info.
Read the exact line
Privacy policy
“All of our email newsletters contain an UNSUBSCRIBE link at the bottom of the email.”
Fine print
Using the site means you accept the policy; library terms add no and you pay their legal costs.
Read the exact line
Privacy policy
“By accessing or using the Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Unsubscribe from emails
UNSUBSCRIBE link at the bottom of newsletters, or Customer Service link on some sites
Opt out of postal marketing and partner sharing
Email hhp_info@hms.harvard.edu or call 1-203-857-3100 with the exact name and address on the mailing label
Ask them to remove your info from their database
Contact Us form on the site, or hhp_info@hms.harvard.edu / 1-203-857-3100
Limit some ad cookies
Browser cookie settings or Network Advertising Initiative opt-out page (library terms)
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can give your personal information to outside marketers unless you opt out.
Read the exact line
Privacy policy
“We may also share personal information with third-party marketing partners for commercial purposes. Please see below for how to opt out of our sharing of your information for these purposes.”
For example, a company selling supplements could get your name and address from them.
They can put you on other companies’ mailing lists.
Read the exact line
Privacy policy
“Your name and mailing address may be released for one-time use to carefully screened third-party mailers who offer products or services that may be of interest to our readers.”
For example, you might get paper catalogs from a company you never signed up with.
They collect health-related interests to target content and offers.
Read the exact line
Privacy policy
“To provide you with content and offers targeted to your needs, we may ask you for your interests including health topics.”
For example, saying you care about diabetes could be used to send you related product pitches.
They add extra contact data about you from outside companies, not just what you type.
Read the exact line
Privacy policy
“we may obtain information about you such as postal and email addresses from other sources including public databases, joint marketing partners, data providers, as well as from other third parties.”
For example, they might match your email to a purchased mailing list.
If someone sues over how you used library content, you may have to pay Harvard’s legal bills.
Read the exact line
Terms of service
“You agree to and us (and our governing board members, officers, employees, agents and affiliates) from and against all claims, actions, suits, damages, liabilities and costs”
For example, if you reuse an image and get sued, they can ask you to cover their lawyers too.
They can change the library rules without warning; keeping using means you agree.
Read the exact line
Terms of service
“We may change these Terms of Use from time to time without advance notice. Your use of the Viewer after any changes have been made will constitute your agreement to the modified Terms of Use”
For example, new limits could appear and still bind you the next time you open the viewer.
Third-party cookies on library pages can track you across other sites for ads.
Read the exact line
Terms of service
“Some third parties may also embed Cookies in the HOLLIS application to collect information about user online activities over time and across different websites that users may visit.”
For example, a search in the catalog could later show related ads on another website.
Comments you post can show your name and other details you gave them.
Read the exact line
Privacy policy
“If you choose to submit content (e.g., online comments or communications to our editorial staff or members), we may publish your name, screen name, and other information you have provided to us on the Service.”
For example, a comment on an article could appear with your real name.
Kids under 13 are not supposed to use the health site, but they only rely on not knowing.
Read the exact line
Privacy policy
“Our website and services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.”
For example, a 12-year-old could still sign up unless someone reports it.
They say they take basic security steps but do not promise your data cannot leak.
Read the exact line
Privacy policy
“We use reasonable safeguards to protect your personal information from loss, misuse, or unauthorized access. However, no method of transmission over the internet or electronic storage is 100% secure.”
For example, they do not describe encryption or audits in this policy.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
How we got here · grade F · score 34/100 · 15 of 15 policy answers backed by a verified quote · 7 not stated
What does the app collect beyond what it needs to work?
They collect account and payment data, health-topic interests, device and usage data, and extra addresses from partners and public databases.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use cookies, social-network tracking, Google Analytics, and third-party cookies that can tailor ads on other sites.
Do they sell or share your data, and can you opt out?
They share names and addresses with mailers and marketing partners for commercial purposes, and they describe how to opt out.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
The health policy does not give an in-app delete timer; you must contact them to remove your name from their database.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they use reasonable safeguards but admit no method is 100% secure.
Is there a real age gate, and are teens protected?
The site is not intended for children under 13 and they say they do not knowingly collect from them.
Will they tell you when the rules change, and is the policy specific?
The health policy is dated and they post changes on the page; using the site means you accept. Retention details stay vague.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Library viewer terms disclaim all warranties, cap their liability at none, and make you indemnify them.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 1,465 words at a college graduate level (Flesch reading ease 37.8); the terms are 2,846 words at a college graduate level.
