WebMD

Summary of Important Changes

1. No Express AI-Training Authorization

• The diff does not expressly add or remove language authorizing WebMD to use customer data to train, fine-tune, evaluate, or improve artificial-intelligence or machine-learning models.
• The revised policy does add broad purposes such as:
• “provide, improve and create new Services”;
• statistical analysis of trends, user behavior, and activity;
• identifying issues with the Services;
• market research and measurement; and
• personalization and analytics.
• These provisions could potentially be argued to permit certain AI-related development or analytics activities, depending on how WebMD interprets “improve,” “create new Services,” or “statistically analyze.” However, they are not a clear AI-training grant and do not specify:
• whether identifiable or health-related data may be used;
• whether data is used to train general-purpose or third-party models;
• whether prompts, outputs, or uploaded content are retained;
• whether data is de-identified before training;
• whether customers can opt out; or
• whether WebMD shares training data with model providers.

Risk: The revised language increases ambiguity around future product-development uses. If AI training is a concern, the policy should address it expressly and separately.

2. Broader Data-Use Purposes

The revised language expands and details WebMD’s permitted uses to include:

• Sending personalized emails and content based on interests inferred from use of the Services.
• Tracking visits, usage patterns, email receipt and opening rates.
• Providing more relevant content and advertising to users and people with similar demographic characteristics or interests.
• Offering lead-generation services.
• Detecting fraud and other threats.
• Conducting market research, measurement, analytics, and effectiveness studies.
• Administering accounts and identifying service issues.

Risk: These additions support more extensive behavioral profiling, personalization, advertising, and commercial analytics, including uses based on inferred interests.

3. Expanded Data Combination and Third-Party Sourcing

• WebMD may combine personal information with information collected through WebMD sites, apps, third-party websites, and other information available through third parties.
• The policy expressly contemplates data such as age, gender, demographics, geolocation, interests, and purchase activity.
• The prior reference to reporting aggregate, non-identifiable information is replaced or displaced by more detailed individual-level use and combination language.

Risk: Greater potential for re-identification, profiling, and use of health-adjacent or sensitive data in advertising and analytics.

4. Expanded Sharing With Affiliates and PulsePoint

• Sharing is expanded to subsidiaries, affiliates, acquired or merged companies, and their affiliates.
• PulsePoint may use cookies and tracking technologies for behavioral or targeted advertising and provide analytics, insights, and related information to WebMD and its clients.

Risk: More recipients and broader downstream use, with less control over how information is used by affiliated entities and advertising partners.

5. Other Changes

• The policy adds a Data Protection Officer email address and UK privacy-contact information.
• The effective date is June 19, 2026.
• Numerous apparent website-navigation, punctuation, apostrophe, and formatting changes do not materially alter substantive rights.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 208 words to the document”

Without the text of the additions, deletions, or replacements, it is not possible to determine:

• What contractual rights or obligations changed;
• Whether liability, indemnification, confidentiality, termination, or payment terms were modified;
• Whether the customer’s data may be used for artificial intelligence or machine-learning purposes;
• Whether data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether the provider may retain, de-identify, aggregate, or share customer data;
• Whether the customer has an opt-out right or requires consent;
• Whether the provider claims ownership of model outputs, derivatives, or data-derived insights; or
• Whether new security, privacy, or regulatory obligations were added.

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training from the information provided. The statement that approximately 208 words were added does not identify whether those words:

• Authorize training on customer content, prompts, inputs, or outputs;
• Permit use of data to improve the provider’s products or models;
• Limit training to de-identified or aggregated data;
• Permit use by affiliates, subprocessors, or third-party AI providers;
• Provide an opt-out or require express written consent; or
• Impose deletion, retention, confidentiality, or security restrictions.

Required Information

Please provide the actual redlined language, including:

• Additions shown in {};
• Deletions shown in []; and
• Replacements shown as []{}.

Once provided, the changes can be analyzed for legal effect and specific risks, particularly any provisions allowing customer data to be used for AI training or model improvement.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 208 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions changed;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether any new data-licensing or ownership rights were granted;
• Whether customer data may be shared with affiliates, vendors, or model providers;
• Whether data may be retained after termination;
• Whether the customer has an opt-out or deletion right;
• Whether confidentiality, security, or privacy protections were changed; or
• Whether the provider’s liability for AI-related data use was expanded or limited.

AI Training and Data-Use Review

No specific language concerning AI model training or related data use appears in the supplied material. Therefore, no conclusion can be reached about whether the new text:

• Authorizes use of customer content to train general-purpose or customer-specific models;
• Allows use of prompts, outputs, usage data, telemetry, or derived data for model improvement;
• Grants the provider a perpetual, irrevocable, worldwide, royalty-free license;
• Permits de-identification, aggregation, or re-identification;
• Allows human review or disclosure to third-party AI service providers; or
• Applies the data-use permission automatically or only where the customer affirmatively opts in.

Risk Assessment

The principal risk is informational: the stated word-count increase indicates that substantive terms may have been added, but the actual changes cannot be assessed. Any assumption that customer data is protected—or permitted for AI training—would be unreliable without the added language and the surrounding original provisions.

Information Needed

Please provide the full redlined text, including:

1. The deleted language in square brackets;

2. The added language in braces;

3. Any replacement language shown as []{}

4. The relevant surrounding provisions, particularly those addressing:

• Data ownership and licenses;
• Confidentiality and privacy;
• Service improvement or analytics;
• Artificial intelligence or machine learning;
• Subprocessors and third-party providers; and
• Data deletion and termination.

Once the actual redline is provided, the changes can be evaluated for legal effect and specific AI-training risks.

Summary of Important Changes

1. Expanded permitted uses of personal information

The revised policy substantially expands and specifies WebMD’s business purposes for using personal information, including to:

• Provide, improve, and create new services.
• Send administrative communications, secure electronic messages, personalized emails, reminders, announcements, and opportunities.
• Infer user interests from service usage and personalize content.
• Analyze usage patterns, including visits, feature usage, and email receipt/open rates.
• Provide more relevant content and advertising to users and people with similar demographics or interests.
• Conduct market research, measurement, fraud prevention, security, issue identification, and account administration.
• Provide lead-generation services.
• Combine information collected on WebMD sites and apps with information from third-party websites and other external sources.

Risk: The purposes are materially broader and may permit profiling, personalization, targeted advertising, and data enrichment without a separate consent each time, subject to applicable law.

2. Greater use of external and inferred data

The policy now expressly permits combining personal information with:

• Information from third parties.
• Information collected on third-party websites.
• Demographic, geolocation, interest, purchase, and similar information.
• Information about service usage and engagement.

It also permits reporting information to advertisers and business partners, although the policy describes certain reports as aggregated or not identifiable.

Risk: Combining datasets can make individuals more identifiable and may enable detailed behavioral or health-related profiles, even where individual data is described as aggregated.

3. Expanded disclosures and corporate sharing

The prior references to subsidiaries, affiliates, acquired or merged companies, advertisers, business partners, and PulsePoint have been reorganized and broadened. WebMD may disclose information to:

• Subsidiaries, affiliates, and companies acquired by or merged with WebMD.
• Advertisers and other business partners.
• PulsePoint, which may use cookies and tracking technologies for behavioral or targeted advertising.
• PulsePoint’s clients, for similar services.

PulsePoint may provide WebMD with analytics, insights, actions, and other information concerning users’ activity on WebMD or third-party services.

Risk: Data may circulate among a broader corporate and advertising ecosystem, including entities not specifically identified by name.

4. AI model training

No express provision concerning artificial intelligence or training AI, machine-learning, or generative-AI models appears in the supplied diff.

The expanded language authorizes analytics, profiling, personalization, market research, and creation or improvement of services. Depending on how WebMD implements those activities, such data could potentially be used in automated systems, but the revised text does not expressly grant or restrict a right to train AI models. This omission creates uncertainty and should be clarified if AI training is relevant.

5. Administrative and contact updates

The revision adds or updates:

• A Data Protection Officer email address.
• A UK privacy-contact email and ICO telephone number.
• A certification/privacy-seal reference and “Contact Us” language.
• The effective date: June 19, 2026.

Minor grammatical, punctuation, apostrophe, and navigation/header changes also appear.

Summary of Important Changes

Overall Effect

The revised policy substantially expands WebMD’s stated rights to collect, combine, analyze, share, and use personal information. The changes appear to broaden commercial, advertising, analytics, and affiliate-related uses rather than merely clarify existing language.

Expanded Uses of Personal Information

The revised language expressly permits WebMD to use information to:

• Provide, improve, and create new services.
• Send administrative communications, secure electronic messages, personalized emails, news, reminders, announcements, and opportunities.
• Infer user interests from activity on WebMD services.
• Analyze site visits, service usage, email receipt and opening rates, and user behavior.
• Provide more relevant content and advertising to users and people with similar demographic characteristics or interests.
• Conduct lead-generation services, fraud prevention, market research, measurement, and service development.
• Administer user accounts and investigate issues with the services.

Risk: The purposes are more detailed but also broader, particularly for profiling, personalization, advertising, and market research. “Interests inferred” from usage may include sensitive health-related inferences.

Broader Data Combining and Third-Party Sources

The policy now more clearly allows WebMD to combine personal information with:

• Information collected through WebMD sites and apps.
• Information gathered on third-party websites.
• Information obtained from third parties, including demographic, age, gender, geolocation, interests, and purchase activity.
• Information used for market research, advertising effectiveness, and measurement.

The prior reference to reporting aggregate information is replaced or supplemented by language authorizing the combination of identifiable personal information with usage data.

Risk: Combining health-related activity with demographic, purchase, geolocation, or third-party data may increase the ability to profile or identify users and may create heightened privacy, discrimination, or regulatory risks.

Affiliates, Acquisitions, and Advertising Partners

Disclosure language is broadened to include:

• Subsidiaries, affiliates, and companies acquired by or merged with WebMD.
• Current or prospective advertisers and other business partners.
• PulsePoint, which may use cookies and tracking technologies for behavioral or targeted advertising.
• PulsePoint’s clients, including for similar advertising and analytics services.

WebMD may receive analytics, insights, actions, and other information relating to users’ activity on WebMD or third-party services.

Risk: Data may be shared across a larger corporate and advertising ecosystem, including after acquisitions or mergers. Users may have limited visibility into each recipient’s subsequent practices.

AI Model Training

No express change authorizes WebMD to use customer data to train, fine-tune, evaluate, or develop artificial-intelligence or machine-learning models. The revised policy does add broad rights to “improve and create new Services,” conduct analytics, and analyze user behavior. Those terms could potentially be argued to encompass AI development, but they do not expressly mention AI training, model training, prompts, or outputs.

Recommendation: If AI training is intended, the policy should state clearly what data may be used, whether identifiable or health information is included, whether data is shared with AI vendors, retention controls, opt-out rights, and whether models are trained on customer content.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 208 words to the document”

Without the text of the additions, deletions, or replacements, it is not possible to identify:

• Changes to the parties’ rights or obligations
• New liability, indemnity, confidentiality, or termination risks
• Changes to data ownership or permitted data uses
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is shared with affiliates, vendors, or third-party AI providers
• Any opt-out, consent, deletion, retention, security, or anonymization provisions

Information Needed

Please provide the complete redlined language using the stated notation:

• Additions: {new text}
• Deletions: [deleted text]
• Replacements: [old text]{new text}

The actual 208 added words—or the full relevant section—are necessary for a meaningful legal-risk analysis, particularly regarding AI model training and customer-data use.

Summary

The provided diff does not include the actual added or deleted legal language. It only states:

> “Added approximately 208 words to the document”

Accordingly, it is not possible to determine what contractual terms changed or whether the customer’s data may be used to train AI models.

AI Training and Data Use

No substantive language addressing the following issues was provided for review:

• Whether customer data may be used to train, fine-tune, or improve artificial intelligence or machine-learning models.
• Whether such use applies to customer content, prompts, inputs, outputs, metadata, usage data, or de-identified information.
• Whether the customer must opt in, may opt out, or has no ability to restrict AI-training use.
• Whether data is shared with third-party model providers or subprocessors.
• Whether data is retained after termination or used to create aggregated or derived datasets.
• Whether the provider promises not to use customer data for model training.
• Whether confidentiality, security, deletion, ownership, or intellectual-property protections apply to AI-training activities.

Risk Assessment

No reliable assessment of new legal risks can be made without the actual redline text. In particular, the statement that approximately 208 words were added does not reveal whether those additions:

• Expand the provider’s rights to use customer data;
• Create a broad license to customer content;
• Permit training or improvement of AI models;
• Limit the provider’s liability for AI-related data use;
• Weaken deletion or confidentiality obligations; or
• Shift compliance responsibilities to the customer.

Information Needed

Please provide the actual text of the additions, deletions, and replacements using the stated notation. The AI-data provisions should be reviewed for scope, consent or opt-out rights, permitted purposes, third-party disclosures, retention, security, ownership, confidentiality, and post-termination use.

Summary of Important Changes

1. Expanded purposes for using personal information

The revised policy substantially expands and clarifies the purposes for which WebMD may use personal information. New or more specific purposes include:

• Providing, improving, and creating new services.
• Sending administrative communications, secure electronic messages, personalized emails, news, reminders, and opportunities.
• Inferring user interests from use of WebMD services.
• Analyzing website visits, service usage, email receipt and open rates, and user behavior.
• Providing more relevant content and advertising to users and people with similar demographics or interests.
• Lead-generation services.
• Fraud and threat detection, service security, issue identification, market research, and measurement.
• Administering user accounts.

Risk: The purposes are materially broader and more detailed, particularly for behavioral analysis, personalization, advertising, lead generation, and measurement. Some uses may involve sensitive health-related inferences depending on the data collected and how it is combined.

2. Broader data combination and enrichment

The revised language permits WebMD to combine information collected through its Sites, Apps, and third-party websites with information obtained through third parties. Examples include age, gender, demographics, geolocation, interests, purchasing activity, and other information.

The prior language emphasized aggregate or non-identifiable reporting to advertisers and business partners. The revised language instead focuses on combining and supplementing information for market research, measurement, personalization, advertising, and related business purposes.

Risk: The change may allow more extensive profiling and linkage of information across services and external sources. The policy does not clearly limit how long such combined profiles may be retained or how reliably they will be de-identified.

3. Expanded disclosures to affiliates and corporate successors

The policy now expressly covers disclosure to:

• Subsidiaries and affiliates;
• Companies acquired by or merged with WebMD;
• Affiliates’ use of information for the policy’s stated purposes; and
• Market research and measurement using information available through third parties.

This replaces narrower language focused on existing affiliates and specifically identified business partners.

Risk: The category of potential recipients is broader and less specific, making it harder for users to know which entities may receive or use their data.

4. Revised PulsePoint disclosures and targeted advertising

The policy continues to identify PulsePoint but changes the description of the relationship. PulsePoint may use cookies and other tracking technologies for behavioral or targeted advertising and may provide WebMD with analytics, insights, actions, and other information concerning users’ use of WebMD or third-party services. PulsePoint may also provide similar services to its clients.

Risk: This reinforces cross-site tracking, behavioral advertising, and data sharing involving third parties and their clients.

5. AI-model training

No express provision authorizing or prohibiting the use of customer data to train artificial-intelligence or machine-learning models appears in the supplied diff.

The expanded rights to analyze behavior, create new services, conduct market research, generate insights, and combine data could potentially support AI-related activities, but the revised text does not expressly state that personal information, user content, or health information may be used to train AI models. This ambiguity should be clarified, especially regarding model training, retention of training data, de-identification, and whether users can opt out.

6. Administrative and contact updates

The policy adds or updates:

• A Data Protection Officer email address;
• UK privacy-contact information and telephone details;
• A certification-status link;
• A June 19, 2026 effective date; and
• A general “Contact Us” invitation.

These changes appear primarily administrative.

Summary

The provided diff does not include the actual added, deleted, or replaced contractual language. It only states:

> “Added approximately 208 words to the document”

Accordingly, it is not possible to identify the legal changes, new risks, or any provisions concerning the use of customer data to train AI models.

AI Training and Customer Data

No substantive language was provided addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models
• Whether prompts, inputs, outputs, or personal information are retained
• Whether data is used for provider-wide model training or only for the customer’s account
• Whether the customer can opt out of AI training or withdraw consent
• Whether data is anonymized, aggregated, or de-identified
• Whether subcontractors or third-party AI providers may access the data
• Ownership or licensing rights in customer data, outputs, or derived models
• Security, confidentiality, deletion, or retention obligations relating to AI training

Assessment

A meaningful legal analysis requires the actual text of the additions and any surrounding provisions that those additions modify or qualify. Please provide the full diff, including the 208 added words and any marked deletions or replacements.

Summary of Important Changes

1. Expanded purposes for using personal information

The revised policy substantially broadens and clarifies the purposes for which WebMD may use personal information. New or more explicit purposes include:

• Providing, improving, and creating new services.
• Responding to inquiries and sending administrative communications.
• Sending secure electronic messages and personalized emails based on interests inferred from service usage.
• Sending news, announcements, reminders, and opportunities.
• Analyzing trends, user behavior, service usage, email receipt/open rates, and site visits.
• Providing more relevant content and advertising, including to people with similar demographic characteristics or interests.
• Lead-generation services.
• Fraud and threat detection.
• Identifying service issues.
• Market research, measurement, and effectiveness analysis.
• Administering user accounts.

Risk: The permitted uses are materially more detailed and expansive, particularly for profiling, advertising, analytics, lead generation, and combining data from multiple sources. The language may allow broader use without obtaining separate consent where legally permitted.

2. Greater data combination and profiling

The revised language expressly permits WebMD to combine personal information with:

• Information collected through WebMD sites, apps, and services.
• Information from third-party websites.
• Information obtained through third parties.
• Usage, demographic, interest, geolocation, purchase, and similar information.

The policy also permits use of this combined information for personalization, targeted advertising, market research, measurement, and related activities.

Risk: Combining health-related or usage information with external demographic and behavioral data may increase profiling, re-identification, and sensitive-inference risks. The revised language also appears less focused on reporting only aggregate, non-identifiable information.

3. Expanded disclosures to affiliates and business partners

The policy now more broadly authorizes disclosure to:

• Subsidiaries, affiliates, and companies acquired by or merged with WebMD.
• Affiliates and third parties for market research and measurement.
• Advertisers and other business partners.
• PulsePoint, Inc., for measurement, analytics, identification, personalization, targeted advertising, and sponsored programs.

PulsePoint may use cookies and other tracking technologies for behavioral or targeted advertising and provide WebMD with analytics, insights, and other information regarding users’ activities on WebMD or third-party services.

Risk: The disclosure framework is broader and may facilitate sharing with a wider corporate group and advertising ecosystem. Users may have limited control over downstream uses by affiliates, advertisers, or partners.

4. AI-model training

No express change concerning AI or training AI models appears in the supplied diff. The revised text does not expressly authorize using customer data, user content, health information, or personal information to train, fine-tune, validate, or improve artificial-intelligence or machine-learning models.

However, the broad permissions to “improve and create new Services,” analyze behavior, personalize content, and conduct research could potentially support machine-learning activities unless other policy language limits those uses.

Risk: The absence of an explicit AI-training provision creates ambiguity. A customer seeking assurance that data will not be used for AI training should request a specific contractual restriction or clarification.

5. Other notable changes

• New or corrected privacy-contact email addresses, including the Data Protection Officer and UK privacy team.
• Updated UK complaint contact information.
• Effective date changed to June 19, 2026.
• Formatting, navigation, and minor grammatical changes appear throughout.