Is Truveta safe with your data?
Truveta
Partial disclosure · high confidence
Truveta earns a C (59/100) because it discloses its data practices only in part.
#59
of 211 apps ranked
59
score · Healthcare avg 38
+21
vs category average
Truveta discloses an explicit no-training commitment for AI assistant content and a concrete 18-plus age gate, but its retention period, security controls, breach handling, and legal-bases mapping for the US default version remain vague or absent.
What Truveta's privacy policy and terms of service say about your data
Unconditional refusal to train on personal data
The policy states plainly that "We do not use your personal data for the purpose of training our AI models." Training is refused outright, so no opt-out is offered or needed.
Portability and legal bases are region-gated
Portability plus the legal basis table appear only in Section 7, which applies "If UK, European, Swiss, Indian, or other international data protection law applies". The global Section 6 offers portability just "Depending on applicable law", and Section 3 lists processing purposes with no legal basis attached.
Sensitive-data limit is narrow
The clause is a CCPA-shaped statement about not triggering a "right to limit", carved back by "except as permitted by law". It is not a general limit on processing special-category data.
Security and retention gaps
Security rests on "reasonable and appropriate" safeguards with no TLS, AES-256 or access controls named. Retention gives no number, deletion timelines and AI-log retention go unmentioned, and neither ISO 42001, SOC 2 nor ISO 27001 appears anywhere. A named privacy contact is the one concrete point.
What the policy is silent or vague on
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: a deletion timeline after closure or request
- Not stated: shorter retention for AI conversation logs
Truveta privacy rating
Details
- Category
- Healthcare
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-06-30
- Region scored
- Global / US-default
- Last assessed
- 2026-08-13
Documents examined
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.