WebMD

Summary

The provided diff does not include the actual wording of the 208 added words. It only states that approximately 208 words were added. As a result, the legal impact of the changes cannot be reliably analyzed.

AI Training and Data Use

• No language is provided showing whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Used to train models shared with other customers or the public;
• De-identified, anonymized, aggregated, or retained for model development;
• Reviewed by humans for AI safety, quality assurance, or product improvement; or
• Excluded from training unless the customer opts in or opts out.
• It is therefore not possible to determine whether the amendment creates new rights to use customer data for AI training or changes existing restrictions.

Other Potential Legal Risks

Without the added text, the following issues also cannot be assessed:

• Changes to confidentiality obligations;
• Expanded data-retention periods;
• New data-processing purposes or subprocessors;
• Changes to ownership or licensing rights in customer data;
• Reduced security, privacy, or compliance commitments;
• Broader disclaimers, indemnities, or liability limitations; and
• Changes to termination, deletion, or data-return rights.

Required Information

Please provide the actual 208-word addition and any surrounding text that was modified. The full wording is necessary to identify new obligations, permissions, limitations, and risks—particularly any provisions concerning the use of customer data to train or improve AI models.

Summary of Important Changes

1. AI Training and Model-Development Use

• No express authorization to use customer data to train AI or machine-learning models appears in the diff. The revised language does not specifically mention “AI,” “artificial intelligence,” “machine learning,” “training,” “fine-tuning,” or model development.
• However, the policy now expressly permits use of personal information to:
• “provide, improve and create new Services”;
• analyze trends and user behavior and activity;
• conduct market research and measurement;
• identify issues with the Services; and
• provide analytics, insights, and related information.
• These broad purposes could potentially be interpreted to include developing or improving automated systems, depending on how WebMD defines “Services,” but they do not clearly state whether customer data may be used as training data, whether data will be de-identified, or whether users can opt out.
• The revised policy also permits combining personal information with information from third parties and activity on third-party websites. This could increase the amount and sensitivity of data available for analytics or future model development.

2. Expanded Data-Use Purposes

The prior, narrower language generally referred to purposes disclosed at collection or undertaken with consent. The revision adds or emphasizes:

• creating new services;
• personalized emails, reminders, news, and announcements based on inferred interests;
• analysis of site visits, service usage, email receipt and open rates;
• content, advertising, and program effectiveness;
• lead-generation services;
• fraud and threat detection;
• issue identification and market research;
• account administration; and
• targeted advertising and sponsored programs.

Risk: The expanded purposes provide WebMD greater flexibility to use behavioral, demographic, geolocation, purchase, and interest information for profiling, personalization, advertising, and measurement.

3. Broader Data Combination and Sharing

• WebMD may combine information collected through its Sites and Apps with information from third parties and third-party websites.
• Sharing language is expanded from specified affiliates and business partners to include:
• subsidiaries and affiliates;
• companies acquired by or merged with WebMD or its affiliates;
• current or prospective advertisers and other business partners; and
• third parties used for market research and measurement.
• PulsePoint is no longer described only as providing services to WebMD; it may use cookies and tracking technologies for behavioral or targeted advertising and provide analytics and insights to WebMD and its clients.

Risk: The changes broaden onward disclosure, cross-site tracking, behavioral advertising, and corporate-transfer exposure.

4. Other Changes

• A Data Protection Officer email address and UK privacy-contact email/telephone number are added.
• The effective date is stated as June 19, 2026.
• Numerous navigation, punctuation, apostrophe, and formatting corrections appear non-substantive.

Key Follow-Up Questions

WebMD should clarify whether “improve and create new Services” includes AI-model training, what data categories may be used, whether data is de-identified, retention periods, vendor access, and available opt-out or deletion rights.

Summary

The provided diff only states that approximately 208 words were added to the document; it does not include the actual added language or identify where the changes occur.

Key Legal Changes

• Cannot be determined: The substantive legal effect of the additions cannot be assessed without the text of the 208 added words.
• Customer data and AI training: The diff does not reveal whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with affiliates, vendors, or third-party model providers;
• Retained for model-training purposes after termination;
• Anonymized, aggregated, or de-identified before use;
• Excluded from training by default or only upon customer opt-out; or
• Used to generate outputs that may benefit other customers.

Potential Risks to Check

The added language should be reviewed for:

1. Broad usage rights — permissions to use customer content for “improvement,” “research,” analytics, or product development may include AI training.

2. Ambiguous data definitions — “content,” “usage data,” or “de-identified data” may encompass customer prompts, inputs, outputs, or confidential information.

3. No opt-out or consent requirement — training may be permitted automatically rather than requiring express customer authorization.

4. Indefinite retention — data may remain available for training or derived model parameters after the agreement ends.

5. Third-party disclosure — customer data may be transferred to external AI providers without clear confidentiality, security, or deletion commitments.

6. Limited liability — disclaimers or liability caps may apply to unauthorized use, disclosure, or model-related confidentiality breaches.

Information Needed

Please provide the actual 208-word addition, including the surrounding deleted or replaced language. Without that text, it is not possible to identify the specific contractual changes or determine whether customer data may be used to train AI models.

Summary of Important Changes

AI Model Training

• No express provision was added authorizing WebMD to use customer/user data to train, fine-tune, or improve artificial-intelligence or machine-learning models.
• The revised language does, however, broadly permit WebMD to use personal information to “provide, improve and create new Services,” statistically analyze user behavior, conduct market research, and identify issues. Depending on how WebMD interprets “Services” and “improve,” this could potentially support automated analytics or AI-based product development, but the diff does not clearly state that data will be used for AI training.
• The policy should be reviewed for separate AI terms, vendor terms, or definitions of “Services” that may contain such authorization.

Expanded Internal Use of Data

The revised purposes are substantially broader and more specific. WebMD may use personal information to:

• Improve and create new services;
• Respond to inquiries and send administrative communications;
• Send secure electronic messages and personalized emails based on interests inferred from service use;
• Send news, announcements, reminders, and opportunities;
• Analyze visits, usage patterns, email receipt/open rates, and user behavior;
• Administer accounts;
• Detect and defend against fraud and other threats;
• Identify service issues;
• Conduct market research and measurement; and
• Provide more relevant content and advertising to users and people with similar demographics or interests.

Risk: The prior language was more limited and generally referred to purposes disclosed at collection or requiring consent. The new wording creates broader standing permission for profiling, personalization, analytics, advertising, and product development.

Expanded Data Combination and Third-Party Sourcing

• WebMD may combine personal information with information collected through its Sites, Apps, third-party websites, and other third-party sources.
• External information may include age, gender, demographics, geolocation, interests, and product-purchase activity.
• The revised language removes or narrows the prior emphasis on reporting only aggregate, non-identifiable information to advertisers and business partners.

Risk: Combining health-related or usage information with third-party data may increase the sensitivity and identifiability of user profiles.

Broader Disclosure and Affiliate Rights

• Disclosures now expressly cover subsidiaries, affiliates, and companies acquired by or merged with WebMD.
• PulsePoint may use cookies and tracking technologies for behavioral or targeted advertising and may provide WebMD with analytics, insights, and other information concerning use of WebMD or third-party services.
• PulsePoint may provide similar services to its clients.

Risk: Data may circulate among a broader corporate and advertising ecosystem, including successor entities and third-party advertising clients. Users are directed to PulsePoint’s separate privacy policy, creating potentially different practices and rights.

Other Changes

• New Data Protection Officer contact: webmddpo@webmd.net.
• Added UK privacy complaint email and ICO telephone number.
• Effective date changed to June 19, 2026.
• The diff contains substantial apparent formatting/navigation-text corruption, which should be corrected before publication to avoid ambiguity.

Key Changes and Risks

1. AI Training and Model Development

• No express reference to artificial intelligence, machine learning, generative AI, automated decision-making, or training models appears in the diff.
• The revised purposes include using personal information to “provide, improve and create new Services.” This is broader than the prior wording and could potentially support development of new technologies, including AI-enabled services, but it does not clearly authorize training AI models.
• The policy should be reviewed for AI-training language elsewhere. If WebMD intends to use customer data for model training, the policy should state explicitly:
• what data may be used;
• whether data is de-identified or aggregated;
• whether data is shared with vendors or third-party model providers;
• whether prompts, medical information, or account data are retained;
• whether users can opt out; and
• whether trained models may be used commercially.

2. Expanded Use of Personal Information

The revised policy substantially expands and details permitted business uses, including:

• providing, improving, and creating new services;
• sending personalized emails, reminders, announcements, and opportunities based on interests inferred from service use;
• analyzing user behavior, including visits, usage patterns, and email opens;
• combining WebMD data with information from external sources;
• providing more relevant content and advertising to users and people with similar demographic characteristics or interests;
• lead-generation services;
• fraud and security detection;
• identifying service issues;
• market research and measurement;
• administering user accounts; and
• measuring the effectiveness of content, advertising, and programs.

Risk: The revised language permits broader profiling, personalization, advertising, analytics, and data enrichment than the prior language. “Interests inferred from use” and information about people with “similar demographic characteristics” may support audience segmentation and targeted advertising without the user directly providing those characteristics.

3. Broader Data Combining and Disclosure

• The policy now permits combining personal information with information collected through WebMD sites, apps, third-party websites, and other sources.
• The information may include age, gender, demographics, geolocation, interests, purchase activity, and other information.
• Disclosures now expressly include subsidiaries, affiliates, acquired or merged companies, and business partners.

Risk: Corporate transactions could transfer or expand use of personal information among successor entities and affiliates.

4. PulsePoint and Behavioral Advertising

• The revised policy expressly identifies PulsePoint and permits it to use cookies and tracking technologies for behavioral or targeted advertising.
• PulsePoint may provide WebMD with analytics, insights, actions, and other information concerning use of WebMD or third-party services, and may provide similar services to its clients.

Risk: This increases transparency but also confirms potentially extensive third-party tracking and advertising-related data sharing.

5. Administrative and Contact Updates

• The effective date changes to June 19, 2026.
• New or corrected privacy contacts are provided, including WebMD’s Data Protection Officer and UK privacy complaint email/phone details.
• Numerous apparent formatting, navigation, punctuation, and apostrophe changes do not appear substantively important.

Summary

The provided diff does not include the actual added contractual language. It only states:

> “Added approximately 208 words to the document”

Accordingly, it is not possible to identify the legal changes, new obligations, allocation of risk, or effects on customer data.

AI Training and Data Use

No substantive language is provided addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, account data, or usage metadata are retained;
• Whether data may be de-identified, aggregated, or shared with third-party model providers;
• Whether customer data is used for general product improvement or only to provide the contracted services;
• Opt-out rights or controls over AI training;
• Ownership or licensing rights in customer data and AI-generated outputs; or
• Security, confidentiality, deletion, or retention requirements applicable to AI-related processing.

Risk Assessment

Because the underlying 208-word addition is missing, no reliable assessment can be made of:

• New permissions granted to the provider;
• Expanded customer responsibilities;
• Changes to confidentiality or data-protection obligations;
• New indemnities, warranties, liability limitations, or audit rights; or
• Whether the amendment creates a right to use customer data for AI training.

Please provide the actual added text, with the relevant additions and deletions marked, for a meaningful legal analysis.

Key Changes and Risks

1. Broader purposes for using personal information

The revised language replaces a relatively limited statement—using information for purposes disclosed at collection or with consent—with a detailed and broader list of permitted uses, including:

• Providing, improving, and creating new services;
• Responding to inquiries and sending administrative communications;
• Sending personalized emails, news, announcements, reminders, and opportunities based on inferred interests;
• Analyzing trends, behavior, activity, email engagement, and use of WebMD sites;
• Account administration;
• Fraud and threat detection;
• Identifying service issues;
• Market research and measurement;
• Lead-generation services; and
• Advertising and sponsored programs.

Risk: The new wording gives WebMD greater discretion to use data for analytics, personalization, advertising, lead generation, and commercial product development. Some purposes are framed broadly and may not require separate consent except where legally required.

2. More extensive profiling and data combination

The revised policy expressly permits WebMD to combine personal information with information collected from:

• WebMD sites, apps, and services;
• Third-party websites;
• External sources and third parties; and
• Information concerning demographics, age, gender, geolocation, interests, purchasing activity, and other characteristics.

It also permits use of this combined information to provide relevant content and advertising to the user and people with similar demographic characteristics and interests.

Risk: This expands profiling and inference activities and may involve sensitive health-related or behavioral information. Combining first-party health information with third-party data can increase re-identification, targeting, and regulatory risks.

3. Expanded affiliate and third-party sharing

The former reference to sharing with subsidiaries, affiliates, acquired, or merged companies is replaced with broader language allowing information to be combined with information available through third parties for market research, measurement, advertising, and program effectiveness.

The policy continues to identify PulsePoint, but its role is described more broadly. PulsePoint may use cookies and tracking technologies for behavioral or targeted advertising and provide WebMD with analytics, insights, actions, and other information about use of WebMD or third-party services. PulsePoint may also provide similar services to its clients.

Risk: Data may circulate across a wider affiliate, advertising, analytics, and client ecosystem, with less clarity about downstream recipients and uses.

4. AI-model training

No express provision was added authorizing the use of customer or user data to train, fine-tune, evaluate, or improve AI models. The new references to “improve and create new Services,” analytics, market research, and personalization could potentially support AI-related development, but they do not specifically say that personal information, health information, prompts, or user content may be used for model training.

Risk: The absence of a clear AI-training restriction or permission creates ambiguity. If AI development is intended, the policy should expressly address the data categories used, de-identification, retention, third-party model providers, opt-out rights, and whether data is used to train general-purpose models.

5. Other changes

• Adds a Data Protection Officer email address for certain privacy requests.
• Adds a UK privacy complaint email and telephone number.
• Updates the effective date to June 19, 2026.
• Makes formatting and punctuation changes that do not appear substantively significant.

Summary

The provided diff does not include the actual contract language. It only states that approximately 208 words were added. As a result, it is not possible to identify:

• The substantive legal changes;
• New customer obligations or provider rights;
• Changes to liability, confidentiality, security, or termination provisions; or
• Any provisions concerning the use of customer data to train, develop, improve, or evaluate AI models.

AI-Training Review

No specific language regarding AI model training or related data use is included in the diff provided. In particular, the available text does not establish whether the provider may:

• Use customer data or content to train generative AI or machine-learning models;
• Use customer data for model fine-tuning, testing, benchmarking, or product improvement;
• Create or retain de-identified, aggregated, or derived data for AI purposes;
• Permit subcontractors or third-party AI providers to access customer data;
• Opt the customer in or out of AI-training uses; or
• Claim ownership of model outputs, embeddings, metadata, or other derivatives of customer data.

Assessment

A substantive legal analysis requires the exact added, deleted, and replaced wording. The statement that 208 words were added is insufficient to determine whether the changes create new rights, broaden existing permissions, or introduce additional risks.

Please provide the full marked-up diff, including the text within the additions, deletions, and replacements.

Key Changes and Risks

1. Expanded data-use purposes

The revised policy replaces a relatively general statement that personal information may be used for disclosed purposes or with consent with a detailed list of permitted uses, including:

• Providing, improving, and creating new Services.
• Responding to inquiries and sending administrative communications.
• Sending personalized emails, reminders, announcements, and opportunities based on interests inferred from use of the Services.
• Statistical analysis of trends, user behavior, site visits, email receipt/opening, and Service usage.
• Lead-generation services.
• Fraud and threat detection.
• Identifying Service issues.
• Market research and measurement.
• Administering user accounts.
• Targeted advertising and sponsored programs.

Risk: The new language materially broadens and specifies commercial uses, particularly behavioral profiling, personalization, advertising, lead generation, and measurement. “Improve and create new Services” is broad and is not limited to de-identified or aggregated data.

2. More extensive combining and external data enrichment

The revised language expressly permits WebMD to:

• Combine personal information with information collected through WebMD Sites and Apps and third-party websites.
• Supplement information with external sources.
• Use age, gender, demographic, geolocation, interests, purchase activity, and other information.
• Create content or advertising targeted to users and people with similar demographic characteristics and interests.

Risk: Users may be profiled using information obtained outside WebMD, potentially including sensitive health-related inferences. The policy does not clearly explain the sources, matching methods, retention limits, or safeguards for this combined data.

3. Broader disclosures to affiliates and corporate successors

The policy expands disclosure language to include subsidiaries, affiliates, and companies acquired by or merged with WebMD or its affiliates. The former reference to aggregate information and current or prospective advertisers/business partners is replaced or supplemented by broader data-combination and market-research language.

Risk: Information may remain available to a wider corporate group and successor entities, including after acquisitions or mergers.

4. Expanded PulsePoint disclosures

The prior PulsePoint provision is substantially reframed. WebMD may disclose information to PulsePoint for measurement, analytics, identification, personalization, targeted advertising, and sponsored programs. PulsePoint may use cookies and other tracking technologies for behavioral or targeted advertising and provide WebMD and its clients with analytics, insights, actions, and related information.

Risk: This creates a clearer and broader pathway for tracking and advertising-related sharing with an affiliate and its clients. Users are directed to PulsePoint’s separate privacy policy, creating reliance on another policy for important details.

5. AI-model training

No provision in the supplied diff expressly states that customer or user data may be used to train, fine-tune, evaluate, or improve AI or machine-learning models. Likewise, there is no express prohibition on such use.

The phrase “improve and create new Services” is broad enough that WebMD could potentially argue it covers AI-related development, but the diff does not specifically authorize that activity.

Important unresolved risk: The revised policy does not address whether prompts, health information, account data, or usage data may be:

• Sent to AI providers;
• Used to train models;
• Retained in model-development datasets;
• De-identified before training; or
• Excluded through an opt-out mechanism.

6. Administrative updates

• Effective date changed to June 19, 2026.
• New Data Protection Officer email: webmddpo@webmd.net.
• New UK privacy complaint email: MedscapePrivacy@webmd.net.
• UK ICO telephone number added.
• Several edits are stylistic or formatting corrections.

Summary

The diff does not include the actual added contractual language. It only states:

> “Added approximately 208 words to the document”

Accordingly, it is not possible to identify the legal changes, new obligations, allocation of risk, or changes concerning use of customer data to train AI models.

AI Training and Customer Data

No substantive language is provided addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, or metadata are retained;
• Whether data is used for the provider’s general model development or only for the customer’s account;
• Whether the customer must opt in or may opt out of AI training;
• Whether de-identification, aggregation, or anonymization is required;
• Ownership or licensing rights in customer data, inputs, or outputs;
• Confidentiality and security protections applicable to training data; or
• Deletion and retention obligations.

Risk Assessment

Because the 208 added words are not shown, no reliable assessment can be made of whether the amendment:

• Expands the provider’s rights to use customer data;
• Creates a broad or perpetual license;
• Allows disclosure to affiliates, vendors, or third parties;
• Weakens confidentiality or data-protection commitments;
• Shifts responsibility for personal data or regulatory compliance to the customer; or
• Limits the provider’s liability for unauthorized use or AI-related processing.

Information Needed

Please provide the actual 208-word addition, including any surrounding provisions and any deleted or replaced language. The exact wording is necessary to determine whether customer data may be used to train AI models and whether the change creates material legal or commercial risk.

Executive Summary

The revised policy substantially broadens WebMD’s stated rights to use, combine, analyze, and disclose personal information. The changes appear focused on advertising, analytics, personalization, market research, fraud prevention, and corporate-affiliate sharing. No express language authorizing use of customer data to train artificial-intelligence or machine-learning models appears in the supplied diff. However, the expanded “improve and create new Services,” analytics, research, and behavioral-data language could potentially be relied upon for model development unless the full policy contains a separate AI provision.

Major Changes and Risks

1. Expanded purposes for using personal information

The policy now expressly permits use of information to:

• Provide, improve, and create new Services;
• Respond to inquiries and send administrative communications;
• Send secure electronic messages and personalized emails based on interests inferred from use of the Services;
• Analyze trends, user behavior, activity, visits, email opens, and engagement;
• Provide more relevant content and advertising to users and people with similar demographics or interests;
• Conduct market research and measurement;
• Detect fraud and other threats;
• Identify Service issues and administer accounts.

Risk: The purposes are materially broader and less limited to purposes disclosed at collection or based on consent. “Improve and create new Services,” analytics, and inferred interests are flexible categories that may support extensive secondary use.

2. More extensive data combination and profiling

WebMD may combine personal information with information collected through its Sites, Apps, third-party websites, and other third-party sources. The policy specifically contemplates demographic, geolocation, interest, purchase, behavioral, and usage information.

Risk: This increases profiling, re-identification, targeted advertising, and sensitive-health-inference concerns. The prior reference to reporting only aggregate, non-identifiable information is replaced or displaced by broader individualized data-use language.

3. Expanded advertising and third-party sharing

The revised language authorizes sharing with subsidiaries, affiliates, acquired or merged companies, advertisers, business partners, and PulsePoint. PulsePoint may use cookies and tracking technologies for behavioral or targeted advertising and provide WebMD with analytics and insights concerning use of WebMD or third-party services.

Risk: Data may circulate among a broader corporate and advertising ecosystem, with less precise limits on recipient use. Users are directed to PulsePoint’s separate privacy practices, creating additional transparency and control issues.

4. AI/model-training implications

No direct authorization to:

• Train generative AI or machine-learning models;
• Use prompts, content, health information, or account data as training data;
• Retain data for model improvement; or
• Share data with AI providers

is included in the provided changes.

Nevertheless, the new “improve and create new Services,” behavioral analytics, market research, and third-party information-sharing provisions are broad enough to create ambiguity. WebMD should expressly state whether personal or health-related information may be used for AI training, whether de-identification is required, and what opt-out or deletion rights apply.

5. Administrative and contact updates

The revision adds or updates privacy contact details, including a Data Protection Officer email address and UK complaint contact information, and updates the effective date to June 19, 2026.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 208 words to the document”

Without the text of those additions, deletions, or replacements, it is not possible to determine:

• What contractual provisions changed;
• Whether customer rights or provider obligations were expanded or reduced;
• Whether liability, indemnity, confidentiality, security, or termination terms changed; or
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models.

AI Training and Data-Use Risk

No conclusion can be drawn about AI-model training from the information provided. The missing language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “optimize” models;
• “customer data,” “content,” “inputs,” “outputs,” “usage data,” or “aggregated data”;
• Rights to use data on an “irrevocable,” “perpetual,” “worldwide,” “royalty-free,” or sublicensable basis;
• Claims that data is anonymized, de-identified, aggregated, or otherwise excluded from confidentiality protections;
• Opt-out, consent, or account-setting mechanisms;
• Retention periods and deletion obligations; and
• Whether human reviewers, affiliates, vendors, or third-party AI providers may access the data.

Information Needed

Please provide the actual diff, including the approximately 208 added words and any deleted or replacement language. The changes should be shown using the stated notation:

• Additions: {new language}
• Deletions: [removed language]
• Replacements: [old language]{new language}

Once provided, the changes can be assessed for their legal effect and any new risks concerning AI training and customer-data use.

No

No

No