Cardinal Health
Health Care
46
out of 100. Number 248 of 512, counting from the worst.
Where Cardinal Health does well
- Renewals 2 of 20. Few problems found.
- Cardinal Health explicitly disavows monetary data sales and admits cookie-based tracking counts as a 'sale' under the CCPA rather than hiding it.
- It offers an opt-out via the cookie banner and Privacy Preference Center, and honors Global Privacy Control browser signals.
- It states it does not use sensitive personal data in ways that trigger limit-use rights and does no automated profiling/decision-making that would create opt-out rights.
- Its privacy policy publishes a detailed California 'Notice at Collection' chart mapping each data category to sources, purposes, and retention.
- It recognizes consumer privacy rights in any US state with an active privacy law (not just the 21 named states) and provides a right-to-appeal process via privacy@cardinalhealth.com.
Anyone who uses Cardinal Health's public website gives up the right to sue or join a class action — all disputes go to a private arbitrator, one at a time.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Anyone who uses Cardinal Health's public website gives up the right to sue or join a class action — all disputes go to a private arbitrator, one at a time. Arbitration is confidential, held in Dublin, Ohio, under AAA rules, and each side pays its own lawyers.
You and Cardinal Health agree to submit all Disputes to confidential arbitration on an individual and purely bilateral, non-class/non-representative basis. Arbitration on an individual basis is the exclusive remedy for any Disputes which might otherwise be brought on a class, collective or representative basis between you and Cardinal Health.
-
They can shut down your website account or refuse you service for any reason, without warning and without explaining why.
We reserve the right to refuse service or terminate accounts for any reason, in our sole discretion without prior notice.
-
They can change anything on the site — including prices — whenever they want, without telling you first. Whatever price you saw could be gone or different next time you visit.
We reserve the right to correct any errors, inaccuracies or omissions, and to discontinue, add to, modify, upgrade, or replace all aspects of the Site in our sole discretion and without notice. ... We also reserve the right to adjust prices, products and special offers at any time at our discretion.
-
They don't take cash for your data, but they do let advertisers track you via cookies — which legally counts as selling your personal information in California. There is an opt-out via the cookie banner.
We do not "sell" your data to third parties for monetary value. However, we do use cookies and other tracking technologies for targeted advertising, which constitutes a "sale" under the CCPA. We also "share" your information through the use of cookies and tracking technologies for targeted advertising purposes.
-
There is no fixed deletion timeline. They keep your data 'as long as necessary' — and the catch-all 'or otherwise permitted to retain for other uses' gives them room to keep it indefinitely.
Cardinal Health retains Personal Data as long as necessary to fulfill the purposes for which your Personal Data was collected, unless a longer retention period is necessary, the Personal Data is required to fulfill a legal obligation, or we are otherwise permitted to retain the Personal Data for other uses.
-
Your 'do not sell my data' choice is fragile: it lives in a cookie, so clearing cookies, switching browsers, or visiting another Cardinal Health site turns the tracking back on until you opt out again.
Please note that, because these activities are based on online cookies, your opt-out choice is specific to this property. If you access other Cardinal Health digital properties, you will need to make your election for each. Also, if you clear your cookies on this browser or use another browser or device, you may need to opt out again on this property.
How these were found
Cardinal Health is a B2B pharmaceutical/medical distributor with a thin consumer surface: the scoring reflects only its public-facing website documents (site terms + global privacy policy), not private B2B customer contracts, which were out of scope. The Terms page (terms-and-conditions-english.html) timed out on direct fetch, so its clauses are verbatim snippets from the search index of the official cardinalhealth.com URL (crawled ~306 days ago); quotes were not re-read from the live page on Oct 1, 2026. The Global Privacy Policy (privacy-policy.html) was read in full via browser_open on Oct 1, 2026 (sections 6-10 captured directly; sections 1-5 referenced via indexed snippets of the same official URL). No document dates are shown on the pages themselves; search metadata labels the terms page 'Last Updated: 3561 days ago,' which likely reflects index staleness rather than the real version. No arbitration opt-out was found. No forced-arbitration carve-outs (IP, small claims) were visible in the captured text.
These notes come from the original draft and are not independent verification.