Insulet Corporation
Health Care
38
out of 100. Number 320 of 512, counting from the worst.
Where Insulet Corporation does well
- Arbitration 0 of 20. Nothing found.
- Renewals 0 of 20. Nothing found.
- NO forced arbitration or class-action waiver: the full Terms of Use and EULA were read end-to-end and neither contains one — disputes go to real courts (exclusive venue: Middlesex County, Massachusetts). Genuinely rare for a US consumer company.
- The HIPAA Notice explicitly commits: 'We will not sell your Medical Information, without first obtaining your written authorization.'
- The privacy policy honors the Global Privacy Control (GPC) browser signal as an opt-out of 'sale'/'sharing'/targeted advertising, and provides a 'Do Not Sell or Share My Personal Information' link.
- No auto-renew or subscription traps found anywhere; Omnipod is sold as devices/Pods through DME/pharmacy, not as a subscription.
- Grants standard deletion, correction, access, portability, and appeal rights, including under Washington's WMHMDA consumer-health-data rights.
Even though you buy medical devices, not ads, Insulet may hand your personal info to third parties so they can show you tailored ads across the web — and admits this counts as legally 'selling' your data even though no money changes hands.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Even though you buy medical devices, not ads, Insulet may hand your personal info to third parties so they can show you tailored ads across the web — and admits this counts as legally 'selling' your data even though no money changes hands.
We may disclose certain Personal Information with select third parties for their and our advertising and marketing efforts, including delivering tailored advertising to you on third-party digital properties. Our disclosure of such information may be considered a 'sale' or 'sharing' of Personal Information as defined under certain state laws, even where no money is exchanged.
-
In the past year Insulet gave outside analytics/ad companies your identifiers and browsing data, and gave third-party 'health care management platforms' your sensitive health data — defined to include blood glucose and insulin dosing data, health insurance info, age, and precise geolocation.
In the last 12 months, we disclosed the following categories of Personal Information to the following categories of third parties for a business or commercial purpose: Identifiers ... Analytics and advertising partners; ... Sensitive Information ... Health care management platforms and providers of similar services.
-
Your data can be fed into AI and automated profiling systems to predict your interests, preferences, and behavior patterns — for marketing and 'personalization,' not just running the pump. You can opt out, but only if you find and follow the rights-request directions.
Additionally, we may use Personal Information, alone or combined with other information we collect, to perform analytics and predictive analyses that help us understand how individuals engage with Services... These activities may involve automated processing, including profiling, to evaluate or predict interests, preferences, or engagement patterns. We may also use artificial intelligence or other automated tools to help collect, organize, analyze, or process information in accordance with this Privacy Policy.
-
Your protected medical info — the same category HIPAA guards most closely — can be used to market not just Insulet's own products but also other companies' treatments and providers 'that may be of interest to you,' without a separate signed authorization.
Marketing: We may use or disclose your Medical Information to provide you with marketing communications about the health-related products and services that we provide, and about products, services, treatment or healthcare providers that may be of interest to you.
HIPAA Privacy Notice ('Uses and Disclosures of Medical Information')
-
Insulet can rewrite the rules at any time with no email, no pop-up, no real notice — just a new version posted on a page. If you keep using the Omnipod app or site after that, you've 'accepted' whatever changed. The privacy policy goes further: changes apply 'whether or not we have given you specific notice of any changes.'
We reserve the right to change the terms of this Agreement, in which event we will post the changes on this page. Your use of the Services after such changes are posted will mean that you accept such changes.
-
You have only one year to sue Insulet over anything the app does — much shorter than most state laws allow. After 12 months, even a claim you didn't discover in time is 'permanently barred.'
ANY CAUSE OF ACTION OR CLAIM YOU MAY HAVE ARISING OUT OF OR RELATING TO THIS EULA OR THE SERVICES MUST BE COMMENCED WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION ACCRUES OTHERWISE SUCH CAUSE OF ACTION OR CLAIM IS PERMANENTLY BARRED.
How these were found
Documents read Oct 1, 2026 via browser_open on official omnipod.com pages. The current US Privacy Policy page (https://omnipod.com/privacy-policy) displayed no explicit 'Version/Last revised' date on the newest text; the same page stacks the older policy text showing 'Effective Date: August 11, 2004; Revision Dates: ... September 15, 2022'. Regional variants of the policy show 'Version April 2025', suggesting the US policy was refreshed ~April 2025, but this was not stated on the US page. Terms of Use read at https://www.omnipod.com/terms-of-use (no version date shown). EULA read at http://www.omnipod.com/eula (no version date shown). HIPAA Privacy Notice read at https://www.OmniPod.com/node/436; note https://www.omnipod.com/hipaanotice (referenced in an Omnipod Discover user guide) now returns 404. A Canada-specific privacy policy (Last Revised September 15, 2022) was found but not scored. No mirrors were needed; omnipod.com allowed direct fetching.
These notes come from the original draft and are not independent verification.