Skip to content

HHS Privacy Policy

Original document

LAST VERIFIED 2026-10-01

Attention points

18 TO CHECK

Pointers to disclosures this policy may not clearly make, checked against major privacy laws. This is a heuristic — not legal advice, and not a finding that anything is missing or unlawful.

GDPR / UK-GDPR

2/13 ADDRESSED
  • Who controls your data (identity & contact of the data controller)GDPR Art. 13(1)(a)
  • Data Protection Officer contactGDPR Art. 13(1)(b)
  • The legal basis for using your dataGDPR Art. 13(1)(c)
  • Legitimate interests relied on (where that is the basis)GDPR Art. 13(1)(d)
  • International transfers and their safeguardsGDPR Art. 13(1)(f) / 46
  • How long your data is kept (retention)GDPR Art. 13(2)(a)
  • Your data-subject rights (access, erasure, portability, object, …)GDPR Arts. 13(2)(b), 15–21
  • The right to withdraw consent (where consent is the basis)GDPR Art. 13(2)(c)
  • The right to complain to a supervisory authority (e.g. the ICO)GDPR Art. 13(2)(d)
  • Automated decision-making or profilingGDPR Arts. 13(2)(f), 22
  • Where your data was obtained, if not collected from you (source)GDPR Art. 14(2)(f)

CCPA / CPRA

3/10 ADDRESSED
  • The business or commercial purposes for collecting/selling/sharingCCPA §1798.110(c)
  • Categories of third parties data is shared/sold toCCPA §1798.115
  • A 'Do Not Sell or Share My Personal Information' option (if it sells/shares)CCPA §1798.135(a)
  • A 'Limit the Use of My Sensitive Personal Information' option (CPRA)CPRA §1798.135(a)
  • Your CCPA rights (know, delete, correct, opt-out, limit, non-discrimination)CCPA §§1798.100–125
  • A non-discrimination promise for exercising your rightsCCPA §1798.125
  • At least two ways to submit a request, plus a contactCCPA §1798.130

Current text

PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. PII can include: - Sensitive data, such as medical, financial, or legal information; - "Neutral" information, such as name, facial photos, or work address; and - Contextual information, such as a file for a specific health condition that contains a list of treated patients. -…

Show full text