Truveta privacy notice
Last Updated: June 30, 2026
Truveta Inc. (“Truveta,” “we,” “our,” or “us”) is committed to respecting your privacy. This Privacy Notice explains, in plain language, how we collect, use, share, and your personal information when you:
- visit Truveta.com, Truveta’s website; and
- have a corporate subscription to and use Truveta Services, which include:
- Truveta’s Trusted Research Environment; our data and analytics platform
- Truveta Intelligence (the Truveta mobile app); and
- Truveta’s research assistant powered by generative AI
“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with or linked to an identifiable person or household. Truveta is committed to handling your personal information responsibly and protecting it with administrative, technical, and physical safeguards appropriate to the nature of the information and the services that we provide.
We use the following principles to guide our privacy practices:
- We describe what personal information we collect, why we use it, and when we disclose it.
- We use direct language and organize this Privacy Notice so it is easier to find the information that matters to you.
- We describe the choices and rights available to you, including account settings, communication preferences, cookie controls, and your privacy rights.
- We distinguish your activity on Truveta.com from your authenticated use of Truveta Services, and we distinguish personal information covered by this Privacy Notice from patient information and de-identified research data that are governed by other laws.
1. What Does This Privacy Notice Cover?
This Privacy Notice applies to personal information that we process for:
- The Truveta.com website; and
- Truveta’s suite of services, including Truveta’s Trusted Research Environment (our data and analytics platform), Truveta Intelligence (our mobile app); Truveta’s research assistant powered by generative AI, and other Truveta websites, applications, or services that link to this Privacy Notice. In this Privacy Notice, we refer to these authenticated offerings as Truveta Services.
Many people use Truveta Services through an employer, health system, university, or other organization. If you access Truveta Services through an organization-provided account, your organization may control your account and may access and process your personal information and your interactions with Truveta Services. Your organization’s privacy, security, and acceptable-use policies may also apply.
This Privacy Notice does not apply to:
- patient information that we process on behalf of our member health care systems. If you are a patient of a Truveta member health system, please review that health system’s privacy notice and direct your questions about your patient records to that health system. If you interact with a third-party service through Truveta.com or Truveta Services, that third party’s privacy notice applies to the personal information it collects or receives;
- anonymized or de-identified health data that are made available through Truveta Services;
- employment application information;
- third-party websites, apps, or services that may be linked or made available on Truveta.com or through Truveta Services.
2. Personal Information That Truveta Collects
Truveta collects several categories of personal information:
A. Information That You Give Us
You may provide personal information directly to us, such as:
| Information Category | Description |
| Contact and account information | Name, email address, mailing address, phone number, username, alias, organization, and credentials or identifiers needed to create, manage, authenticate, and support your account. |
| Professional and organization information | Employer or organization, title, role, research area, area of expertise, research focus, areas of investigation, and similar professional details. |
| Profile information | Information you choose to include in a researcher profile, such as your area of expertise and profile photo. Profile photos are used within Truveta Services; we do not otherwise access your device’s photo library. |
| Survey, event, and demographic information | Information you submit when registering for events, responding to surveys, participating in research or feedback programs, or otherwise providing demographic or professional details. |
| Communications | Emails, support requests, forms, messages, and other communications you send to Truveta or submit through Truveta.com or Truveta Services. |
| AI assistant content | Prompts, questions, generated responses, feedback on responses, and study-specific chat history if you use Truveta’s generative-AI research assistant or AI-enabled features in Truveta Services. Note: Truveta is intended for professional research only (and not personal medical diagnosis). |
| User-submitted content and study-related activity | Information you submit, upload, contribute, or associate with studies, materials, profiles, searches, or workflows within Truveta Services, subject to your organization’s agreements and policies. |
B. Information That We Collect Automatically
When you use Truveta.com or Truveta Services, we may automatically collect technical, usage, diagnostic, and similar information. The information collected depends on the context and the device, browser, application, and settings you use:
| Information Category | Description |
| Computer, browser, and mobile-device information | IP address; device identifiers; device type; operating system; browser type and version; mobile app version; language; settings; configuration information; and related technical information. |
| Usage information | Pages, screens, or features viewed; links clicked; referral source; time spent on pages; access times; log-in and log-out activity; searches entered; features used; data accessed; and actions taken within Truveta.com, Truveta’s Trusted Research Environment,, Truveta Intelligence, or other Truveta Services. |
| Diagnostics and performance information | Crash logs, error reports, app launch time, performance information, resource usage, and other technical diagnostics used to maintain, troubleshoot, secure, and improve Truveta.com and Truveta Services. |
| General location information | Approximate location, such as city, state, and country, inferred from IP address or similar technical information. For Truveta Services, we do not access your device’s precise or coarse GPS-based location through mobile operating system location services. |
| Information from cookies and similar technologies | Cookie IDs, pixels, web beacons, tags, local storage, and similar identifiers or technologies used to operate Truveta.com, remember preferences, understand website performance, support analytics, support marketing and business development, help identify business visitors, tailor content or advertising, detect fraud, and protect our systems. |
| Mobile app authentication information | Where enabled, confirmation that device-level authentication succeeded or failed. If you use device-based biometric sign-in, Truveta does not receive or store your underlying biometric template or raw biometric data. |
| Information we create or infer | Inferences about likely preferences, general location, business or professional interests, potential interest in Truveta offerings, and other information that helps personalize content, features, support, or outreach. We may also create aggregated or de-identified statistics about use of Truveta Services and AI-enabled features. |
C. Cookies, Advertising, and Related Controls
Truveta.com may use third-party analytics, advertising, and business-information providers. These providers may collect information directly through cookies, pixels, tags, or similar technologies and may combine information collected on Truveta.com with information they receive from other sources. Depending on the circumstances and applicable law, this activity may be considered targeted advertising, a “sale” of personal information, or “sharing” for cross-context behavioral advertising. You may learn more about our current providers and exercise your choices with respect to targeted advertising or the sale/sharing of personal information by using our cookie-management tool.
Most browsers allow you to delete or block cookies. Blocking cookies may affect how parts of Truveta.com work. Some email applications allow you to block remote images, including web beacons. Some browsers send a “Do Not Track” signal; because there is no consistent industry standard for responding to that signal, Truveta.com does not currently respond to browser-based Do Not Track signals. Where required by law, we honor valid opt-out preference signals, such as Global Privacy Control, for the relevant website, browser, or device.
The website advertising practices described above do not apply in the same way to Truveta Services. For Truveta Services, we collect technical and usage information to operate, secure, support, personalize, and improve our offerings. For Truveta Services, we do not use mobile advertising identifiers to track you across unaffiliated third-party apps or websites for advertising purposes, and we do not use Truveta Services data for cross-context behavioral advertising.
D. Information Truveta Collects from Other Sources
We may receive personal information from other sources. The categories of sources depend on how you interact with us and which Truveta offerings you use.
| Source | Examples |
| Subscriber organizations and account administrators | Information needed to create, manage, authenticate, secure, support, or administer your access to Truveta Services. |
| Service providers | Information collected or provided by vendors, contractors, and agents that perform services on our behalf, such as hosting, security, customer support, communications, analytics, maintenance, troubleshooting, and business operations. |
| Analytics and advertising partners | Information related to Truveta.com analytics, advertising, measurement, retargeting, visitor identification, and related website activity. |
| Business information providers | Business contact information, professional profile information, company-level information, and other information used to identify, enrich, or understand business visitors or prospective customers. |
| Co-marketing, event, and business partners | Information related to joint events, webinars, business-development activities, co-branded activities, or other interactions involving Truveta and a partner. |
| Third-party services and social networks | Information from third-party services you choose to connect with or interact with through Truveta.com or Truveta Services, subject to your settings and the third party’s privacy practices. |
| Publicly available sources | Public sources of professional or business information and other publicly available materials. |
3. How Truveta Uses Personal Information
We use personal information for the purposes described below, depending on how you interact with us.
| Purpose | Use Description |
| Provide, operate, and support Truveta.com and Truveta Services | Provide requested features; create, manage, and authenticate accounts; deliver website and service functionality; provide secure access; support research workflows; troubleshoot problems; and personalize your experience. |
| Run our business | Support billing, accounting, administration, vendor management, internal operations, contract management, and related business functions. |
| Protect security and integrity | Secure Truveta.com and Truveta Services; detect, investigate, and prevent fraud, abuse, security incidents, unlawful activity, and violations of terms or policies; and protect users, systems, and data. |
| Improve and develop products and services | Improve existing features; develop new services or features; conduct internal research and analytics; understand usage trends; evaluate service quality; and use aggregated or de-identified information where permissible. |
| Communicate with you | Respond to questions and requests; provide customer support; send confirmations, technical notices, security alerts, support messages, administrative messages, product updates, and event communications; and send marketing communications where permitted by law. |
| Personalize content, support, and outreach | Understand your role, organization, preferences, usage, and likely interests to tailor content, features, support, communications, and business-development outreach. |
| Market and advertise on Truveta.com | Use website interaction data and third-party analytics or advertising technologies to measure campaigns, support lead generation, and show ads that may be more relevant to you, including retargeting ads. |
| Operate Truveta Services-specific features | Display your name, organization, association with studies or materials, and optional profile information to other authorized users if you choose to make studies available in the Truveta research library; operate AI assistant features; store study-specific chat history; review feedback about AI-generated responses; support mobile app diagnostics; and improve quality, safety, and reliability. |
| Comply with law and enforce rights | Comply with applicable law, legal process, contractual obligations, and regulatory requirements; respond to lawful requests; enforce agreements, terms, and policies; and protect the rights, property, or safety of Truveta, our users, customers, and others. |
If you access Truveta Services through an account provided by your organization, your organization may be able to access and process your personal information and your interactions within Truveta Services, subject to its own policies and arrangements with Truveta.
4. How Truveta Shares Personal Information
We share, disclose, or otherwise make personal information available only as described in this notice, with your consent, or as otherwise permitted or required by law. These include as follows.
| Recipients or Circumstances | Description |
| Service providers, contractors, and agents | We disclose personal information to vendors, contractors, and agents that help us operate our business and services, including providers of hosting and infrastructure, customer support, security, fraud prevention, analytics, communications, maintenance, troubleshooting, diagnostics, AI feature support, and other business operations. These providers process personal information subject to contractual obligations. |
| Subscriber organizations and account administrators | If you access Truveta Services through an organization-provided account, your organization may access and process your personal information and your interactions with Truveta Services. Your organization may also administer your account, manage access, receive usage or security information, and apply its own policies. |
| Other authorized users of Truveta Services | Where applicable, we may display your name, organization, association with studies or materials, and profile information you choose to provide to other authorized users of Truveta Services. Users in the same study cannot access one another’s AI assistant chat history unless content is separately shared through the platform. |
| Analytics, advertising, and business-information providers for Truveta.com | On Truveta.com, analytics, advertising, and business-information providers may collect or receive identifiers, device information, usage information, general location information, and inferences through cookies, pixels, or similar technologies. Depending on applicable law, this may constitute targeted advertising, sale, or sharing. You may use Cookie Settings and recognized opt-out preference signals where required by law. |
| Corporate transactions | We may disclose personal information in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, dissolution, sale of assets, divestiture, or similar corporate transaction or proceeding. |
| Legal, safety, and security purposes | We may access, use, preserve, or disclose personal information if we believe it is necessary to comply with law or valid legal process; respond to lawful requests by public authorities; enforce agreements or policies; protect rights, property, systems, users, customers, or others; detect, investigate, or prevent fraud, security incidents, or illegal activity; or help prevent harm, including serious injury or loss of life. |
| Third-party services | Truveta.com or Truveta Services may link to or integrate with third-party websites, applications, services, or tools. If you choose to interact with those third parties, their own privacy notices apply to the personal information they collect or receive. |
| Aggregated or de-identified information | We may disclose aggregated or de-identified information where permitted by law. Where we maintain or use de-identified information, we maintain it in de-identified form and do not attempt to reidentify it except as permitted by law. |
5. Truveta Services: Additional Information for Organization Accounts, Researcher Profiles, AI Features, and the Mobile App
This section only applies to Truveta Services.
A. Organization-Provided Accounts
Many users access Truveta Services through an account provided by an employer, university, health system, or other organization.
If that applies to you, your organization may control your account, may access and process your personal information and your interactions with Truveta Services, and may apply its own privacy, security, and acceptable-use policies.
B. Researcher Profiles and Visibility
If you create a profile i, we may display the information you provide to other authorized users, such as your name, organization, field of expertise, and profile photo. Profile photos are used within Truveta Services only, and we do not otherwise access your device’s photo library.
C. AI Assistant Features
If you use Truveta’s research assistant powered by generative AI, we may collect and use. your prompts and questions, generated responses, your feedback on responses, and study-specific chat history. Chat history is stored per user, per study so that you can review and continue prior conversations. Users in the same study cannot access one another’s chat history unless content is separately shared through the platform.
We use AI assistant content to provide AI-generated responses, maintain context in study-specific interactions, troubleshoot and support the feature, evaluate feedback, and improve performance, safety, and reliability. We do not use your personal data for the purpose of training our AI models.
Truveta Services are intended for professional research only (and not personal medical diagnosis).
D. Mobile App, Biometric Sign-In, and Medical Advice
If you use the Truveta mobile app (Truveta Intelligence), we may collect app version, app launches, taps, feature use, device information, diagnostics, crash logs, performance information, notifications settings, and similar technical information to operate, secure, maintain, and improve the mobile app.
If your device offers biometric sign-in, you may choose to unlock or access the app using a device feature such as Face ID or Touch ID. If you enable that feature, the app uses your device’s native authentication tools. Truveta receives confirmation that authentication succeeded or failed, but Truveta does not receive or store your underlying biometric template or raw biometric data.
Truveta Intelligence provides data-driven insights for research and decision support. It does not replace clinical judgment, establish causality, or provide medical advice.
6. Your Choices and Controls
You may have choices and rights about how we use your personal information, depending on where you live and the nature of our relationship with you. For information about your rights specific to European and other international privacy laws, or California and other states’ privacy laws, please see the sections below that reference those laws.
| Type | Choices |
| Account and profile settings | For Truveta Services, some personal information may be available through your account settings. You may edit profile information you choose to provide. Your organization may also control certain account, identity, access, or security settings. |
| Mobile app and device settings | Some mobile app settings, such as notifications, diagnostic sharing, and device-level authentication, may be managed through your device settings or the Truveta mobile app settings where available. |
| Communications preferences | You can opt out of promotional emails, text messages, or calls by following the instructions in the message, replying STOP to text messages where applicable, asking to be placed on our do-not-call list, unsubscribing, or contacting us. These choices do not prevent us from sending non-promotional messages, such as service, security, legal, or administrative communications. |
| Cookie and advertising choices | For Truveta.com, you can use our cookie-management tool, browser controls, industry advertising opt-out tools, and recognized opt-out preference signals where required by law. Blocking cookies may affect how parts of Truveta.com work. |
| Access, correction, deletion, portability, and related rights | Depending on applicable law, you may have the right to confirm whether we process personal information about you, access it, correct it, delete it, obtain a portable copy, opt out of targeted advertising or sale/sharing, and appeal a denied request. |
| Requests handled by your organization | If we process your personal information on behalf of a subscriber organization or another entity that determines the purposes and means of processing, we may direct you to submit your request to that organization. |
| Limits and verification | We may decline a request where permitted by law, including where we cannot verify your identity, the request would adversely affect another person’s rights, the information must be retained for legal or operational reasons, the request is unreasonable or excessive, or providing the information would be prohibited by law. |
| Appeals | If we decline to take action on a privacy request and applicable law gives you a right to appeal, you may appeal by contacting us and stating that you are submitting a privacy appeal. If your appeal is denied, you may have the right to contact your state attorney general, data protection authority, or other applicable regulator. |
7. UK, European, Swiss, Indian, and Other International Privacy Rights
If UK, European, Swiss, Indian, or other international data protection law applies to our processing of your personal information, you may have the right to:
- access the personal information we hold about you;
- correct inaccurate personal information;
- delete personal information in certain circumstances;
- restrict how we use personal information in certain circumstances;
- object to certain processing;
- receive a portable copy of certain personal information, where the law provides that right;
- withdraw consent at any time, if we rely on your consent for processing; and
- lodge a complaint with your local data protection authority.
If we process your information on behalf of another organization that acts as the data controller, you should direct your request to that organization first.
We rely on one or more legal bases depending on the context.
| Legal Basis | Examples |
| Consent | Where required or appropriate, including for certain cookies and similar technologies, certain marketing communications, and other processing for which consent is the applicable legal basis. You may withdraw consent at any time for future processing. |
| Performance of a contract | Where processing is necessary to provide Truveta.com or Truveta Services, manage accounts, authenticate users, provide requested features, support research workflows, and take steps at your request before entering into a contract. |
| Compliance with legal obligations | Where processing is necessary to comply with applicable laws, regulations, legal process, law-enforcement requests, recordkeeping obligations, and other legal requirements. |
| Vital interests | In limited circumstances, where processing is necessary to protect your vital interests or those of another person. |
| Legitimate interests | Where processing is necessary for our legitimate interests or those of a third party and not overridden by your interests, rights, or freedoms. These interests include operating and improving Truveta.com and Truveta Services, maintaining security, preventing fraud, understanding usage, personalizing content, supporting internal administration, conducting analytics, developing products and features, and supporting business development. |
8. Where Personal Information Is Processed
Truveta is based in the United States. personal information covered by this Privacy Notice is stored and processed in the United States and may also be processed in other countries where Truveta or our service providers operate. These countries may not provide the same level of data protection as your home country.
Where required by applicable law, we use appropriate safeguards for cross-border transfers, such as contractual protections, including standard contractual clauses or the UK International Data Transfer Addendum, or other lawful transfer mechanisms.
9. California and Other States’ Privacy Rights
If you are a California resident, the California Consumer Privacy Act or, as amended by the California Privacy Rights Act, applies to our processing of your personal information, or you live in a U.S. state that has enacted a comprehensive state privacy law, you may have the following rights, subject to exceptions and verification requirements:
- Right to know / access the categories and, in some cases, specific pieces of personal information we collected about you;
- Right to delete personal information we collected from you;
- Right to correct inaccurate personal information we maintain about you;
- Right to opt out of sale or sharing, where applicable;
- Right to non-discrimination for exercising your privacy rights; and
- the right to use an authorized agent to submit requests on your behalf.
A. Sale or Sharing
- For Truveta Services, we do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
- For Truveta.com, our use of certain analytics and advertising technologies may involve disclosures that could be considered a “sale,” “sharing,” or use of personal information for targeted advertising under applicable law, depending on the circumstances. If so, California residents may opt out of that activity through available cookie and advertising controls and, where required by law, through recognized opt-out preference signals such as Global Privacy Control.
B. Sensitive Personal Information
We do not use or disclose sensitive personal information for purposes that would require us to offer a separate California right to limit the use or disclosure of sensitive personal information, except as permitted by law.
C. Verification and Authorized Agents
To protect privacy, we may need to verify your identity before processing a request. The level of verification may depend on the type of request and the sensitivity of the information involved.
If you use an authorized agent, we may require:
- written permission signed by you;
- proof of the agent’s authority; and/or
- direct confirmation from you, unless the agent has valid power of attorney.
We will not discriminate against you for exercising your California privacy rights.
The table below gives a summary of the categories of personal information we may collect, where we get it, why we use it, to whom we may disclose it, and how we decide how long to keep it.
D. Your Right to Appeal
If we decline to take action on a privacy request, you may appeal our decision by contacting us using the information in the Contact Us section and request an appeal. If your appeal is denied, you may have the right to contact your state attorney general or other applicable regulator.
E. California “Shine the Light” Privacy Rights
California law permits our customers who are California residents to request certain information regarding the disclosure of certain personal information to third parties for their direct marketing purposes.
We do not currently disclose any personal information to third parties for direct marketing purposes. If we disclose any personal information to third parties for direct marketing purposes, we will provide a list of the categories of personal information, along with the names and addresses of these third parties to you at your request. To make such a request, write us at the postal or email address found in the Contact Us section below.
This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than to the specified email or postal address. You should put “California Privacy Rights-Direct Marketing” in the email subject line and in the body of your request. You must provide us with specific information regarding yourself so that we can accurately respond to the request.
10. How Long We Keep Personal Information
We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Notice, including to provide Truveta.com and Truveta Services, maintain accounts and records, complete transactions, comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent fraud and abuse, support legitimate business operations, and satisfy contractual, tax, accounting, regulatory, and operational requirements.
How long we retain personal Information depends on the type of information, the purpose for which it was collected, the sensitivity of the information, the risk of harm from unauthorized use or disclosure, whether the information is needed to continue providing Truveta.com or Truveta Services, and applicable legal, contractual, and operational requirements.
11. Personal Information of Minors
Truveta.com and Truveta Services are neither directed to, nor intended for, children. You will not be able to use Truveta Services if you are younger than 18. If you think that we have collected the personal information of a minor through the Truveta website or Truveta Services, please Contact Us immediately.
12. How We Protect Personal Information
We use reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. The specific safeguards used depend on the nature and sensitivity of the information and the services involved.
If you use Truveta Services through an organization account, you should access the services using organization-issued sign-in credentials and comply with your organization’s security requirements. If you use a password with any Truveta Services, use a strong password and do not share it with anyone.
No method of transmission or storage is completely secure. We cannot guarantee absolute security of personal information.
13. Changes to This Notice
We may update this Privacy Notice from time to time to reflect changes in Truveta.com, Truveta Services, our privacy practices, or applicable law. When we make changes, we will update the effective date at the top of this Privacy Notice. If required by law, we will provide additional notice or obtain consent for material changes.
The current version of this Privacy Notice is posted on Truveta.com and, where applicable, available in Truveta Services.
14. Contact Us
Truveta Inc. is responsible for personal information processed under this Privacy Notice, except where Truveta processes personal information on behalf of a Subscriber organization or another entity that determines the purposes and means of processing. In those cases, you should direct privacy requests to that organization first.
| Contact Type | Details |
| Privacy questions, concerns, complaints, and requests | Email: privacyconcern@truveta.com |
| General inquiries | Email: info@truveta.com |
| Postal mail | Truveta Inc., 15800 SE Eastgate Way, Fl 3, Bellevue, WA 98008, USA |