Charles River Laboratories
Health Care
36
out of 100. Number 341 of 512, counting from the worst.
Where Charles River Laboratories does well
- Arbitration 2 of 20. Few problems found.
- Renewals 0 of 20. Nothing found.
- No forced arbitration or class-action waiver anywhere: website disputes go exclusively to Delaware state/federal courts, Apollo portal disputes to Massachusetts courts.
- California consumers get an explicit opt-out of the 'sale'/'sharing' of personal data for personalized advertising, a toll-free rights-request line (877.CRIVER.1), and no knowing sale/sharing of under-16 data.
- Apollo customers keep ownership of their own data ('Your Content'), which CRL must treat as confidential, and the Curated Data clause bars revealing identifiable characteristics of clients, samples, study designs, or primary data use.
- Security posture is comparatively strong: CRL states it is ISO/IEC 27001 certified.
When a drug/biotech client uploads study data to CRL's Apollo customer portal, CRL can de-identify and pool that data with other clients' data, publish aggregated results, use it to train AI/ML models, and owns any resulting IP — the client's original rights survive, but CRL keeps permanent reuse rights over derivative insights.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
When a drug/biotech client uploads study data to CRL's Apollo customer portal, CRL can de-identify and pool that data with other clients' data, publish aggregated results, use it to train AI/ML models, and owns any resulting IP — the client's original rights survive, but CRL keeps permanent reuse rights over derivative insights.
CRL may use, copy, transmit, index, model, and aggregate (including with other customers' data and Content) Your Content and any data related to the performance and use of the Portal which has been de-identified and anonymized ('Curated Data'), for the purpose of (a) developing, improving or customizing the Portal, CRL Content and the Services... (f) to develop and/or improve CRL products and services including, but not limited to, developing, testing and/or validating artificial intelligence or machine learning algorithms... We shall be the sole owners of any intellectual property arising from the use of Curated Data (subject in all cases to Your underlying rights in and to Your Content).
-
CRL admits that sharing visitor data for personalized ads may legally count as 'selling' your personal information under California law; you can opt out, but the data-sharing is opt-out, not opt-in.
California and other states allow users to opt out of the 'sale' or 'sharing' of their personal information. 'Sale' means disclosing personal information to a third party for money or value. 'Sharing' means disclosing personal information to a third party for targeted advertising. Charles River shares personal information for personalized advertising on its websites or other properties. This may be considered 'sale' or 'sharing' under the law. You can opt out of this by submitting your request to opt out here.
-
CRL can rewrite its website terms whenever it wants, and the new terms take effect the moment they're posted — no notice required for ordinary visitors, and continued use counts as consent.
CRL may, at any time and from time to time, change these Terms and Conditions, in whole or in part. ... Any changes to these Terms and Conditions will be effective immediately upon the posting of the modified Terms and Conditions to the Online Services.
-
Data CRL already collected from you gets governed by future versions of the privacy notice, not the version in force when you handed it over — so new, potentially less protective rules can be applied retroactively to your old data.
This Privacy Notice will be amended from time-to-time. The handling of your personal data is subject to the most recent version of this Privacy Notice.
-
If anything goes wrong tied to your use of CRL's websites, you owe CRL — plus a long list of related parties — coverage for their losses and their lawyers' fees.
You agree to indemnify, defend, and hold harmless CRL and its affiliates, subsidiaries, employees, officers, directors, agents, contractors, servants, insurers, and representatives from any liability, loss, claim, suit, damage, judgment and expense (including reasonable attorneys' fees and expenses) that arise out of or are related to your violation of these Terms and Conditions or your use or misuse of the Online Services.
-
CRL gives no fixed time limit for deleting your data — it keeps personal data for an open-ended 'as long as necessary' window plus any statutory retention periods, with no deletion schedule disclosed.
We retain your personal data for as long as necessary to fulfill the purposes mentioned in this Privacy Notice, including for any legal, accounting, or reporting purposes which may require us to retain your personal data in accordance with statutory retention periods.
How these were found
Thin consumer surface: CRL is a B2B non-clinical CRO; there are no consumer subscriptions, so no auto-renew or cancellation-trap mechanics exist to score. Website Terms & Conditions last updated 12/12/2017 (stale document). The current Website Privacy Notice (2026 version) live page only rendered its introduction in the fetch tool, so the full text was read from CRL's official Widen-hosted PDF (https://criver.widen.net/content/qd0kciuv8b/original/CR_2026_website-privacy-notice.pdf?u=atq9fr&download=true) — same document linked from criver.com, read directly, not a third-party mirror. Apollo Terms of Use read in full; it carries no posted version date. The T&C notes that portal-specific services (The Source, MyDISCOVERY, MyCHARLESRIVER, LTM, ICM, Endosafe/Accugenix/Celsis portals) have additional service-specific terms that were not reviewed here.
These notes come from the original draft and are not independent verification.