Lilly (Eli)
Health Care
67
out of 100. Number 64 of 512, counting from the worst.
Where Lilly (Eli) does well
- Renewals 3 of 20. Few problems found.
- Lilly is unusually blunt where peers are vague: the privacy notice carries an explicit all-caps 'NOTICE: We may sell your Sensitive Personal Information' and a line-by-line table naming the ad-tech recipients, rather than burying it in legalese.
- It honors opt-out preference signals (Global Privacy Control) at the browser level and states 'We will not discriminate against you for exercising your privacy rights.' Arbitration includes a genuine opt-out — email to ArbitrationOptOut@lilly.com within 30 days — which many consumer companies don't offer.
- The patient enrollment form plainly tells signers that doctors 'may receive compensation from us in exchange for sharing your PHI' and that 'after your PHI has been released to Lilly, it may no longer be covered by HIPAA' — dark disclosures, but disclosed.
- The LillyDirect Pharmacy operates under a HIPAA-covered-entity Notice of Privacy Practices with a formal rights process, and the company provides a dedicated rights-request portal (dsar.lilly.com) plus phone line and an appeal path.
Just by using lilly.com or LillyDirect, you give up your right to sue Lilly in court or join a class action.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Just by using lilly.com or LillyDirect, you give up your right to sue Lilly in court or join a class action. You get a 30-day opt-out window, but the bar is high: to even start arbitration you must first mail a personally-signed, individually-conference-capped dispute notice by U.S. mail or courier to Indianapolis and wait out a 60-day informal process, and mass claims (15+ similar claimants) get funneled into a staged 'Coordinated Arbitration' that can pause everyone else's case.
YOU AGREE THAT DISPUTES BETWEEN YOU AND LILLY (AS DEFINED BELOW) WILL BE RESOLVED BY BINDING ARBITRATION UNLESS YOU OPT-OUT IN ACCORDANCE WITH THE PROCESS DESCRIBED IN SECTION 14 BELOW. UNLESS YOU OPT-OUT OF ARBITRATION, YOU CANNOT FILE A LAWSUIT IN COURT AND WAIVE CERTAIN RIGHTS, INCLUDING THE RIGHT TO A JURY TRIAL AND THE RIGHT TO BRING OR TO PARTICIPATE IN A PURPORTED CLASS ACTION OR REPRESENTATIVE PROCEEDING.
Terms of Use Statement, Eli Lilly and Company (Last Updated: June 2026)
-
Lilly explicitly discloses it can SELL your sensitive personal info — and its own disclosure table shows that category includes inferences about your health and records of which health-related pages you visited, flowing to advertisers, ad networks, social media platforms, and data brokers.
NOTICE: We may sell your Sensitive Personal Information. ... Sensitive personal information [is sold or shared to] Advertisers, ad platforms and networks, and social media platforms; Data brokers (limited data, such as information related to your interactions with certain health related pages on our Digital Properties); Third parties whose Cookies we use ... including data analytics providers.
Global Privacy Notice – United States, Eli Lilly and Company (PP-LU-US-0860 10/2025)
-
To enroll in Lilly's patient support program you sign a HIPAA authorization letting Lilly use your protected health information — diagnosis, meds, adherence history — for marketing and market research, your doctor may be paid by Lilly for sharing it, and once Lilly has it, HIPAA no longer protects it.
Your PHI will be used ... for marketing and promotional purposes, such as sending you marketing communications and information about Lilly services, market research, clinical research opportunities and other product offerings. ... Your Health Care Entities may receive compensation from us in exchange for sharing your PHI. ... After your PHI has been released to Lilly, it may no longer be covered by HIPAA.
-
Lilly's pharmacy can rewrite its privacy rules and apply them retroactively to your medical data from BEFORE the change — you can't rely on the rules that existed when you handed over your health information.
LILLYDIRECT PHARMACY reserves the right to change its privacy practices and the terms of this notice at any time, provided that such changes are permitted by applicable law. LILLYDIRECT PHARMACY reserves the right to make the changes in LILLYDIRECT PHARMACY's privacy practices and the new terms of the notice effective for all PHI that LILLYDIRECT PHARMACY maintains, including PHI created or received before the changes are made.
Notice of Privacy Practices for LillyDirect Pharmacy, LLC (Effective Date: November 1, 2025)
-
The advertised savings card for a chronic-use drug can be reduced, yanked, or have its fine print rewritten unilaterally — no notice required — leaving a patient budgeting around $5/fill exposed to sudden price changes.
Subject to Lilly USA, LLC's right to terminate, rescind, revoke, or amend Card eligibility criteria and/or Card terms and conditions which may occur at Lilly's sole discretion, without notice, and for any reason. ... Monthly and annual maximum savings are set at Lilly's sole and absolute discretion and may be charged with or without notice at any time for any reason.
Lilly Support Services for EBGYSS® Savings Card Terms and Conditions (PUBLISHED 08/2026)
-
Anything you submit to Lilly is licensed to them forever and can't be taken back — and even the HIPAA authorization only lets you revoke by writing a physical letter, with everything already shared staying with Lilly permanently. Deleting your account doesn't delete what's already been handed out or the perpetual license.
You hereby grant us and our sublicensees a worldwide, royalty-free, non-exclusive, transferable, perpetual, and irrevocable license to use, distribute, transmit, reproduce, modify, publish, translate, publicly perform and display and create derivative works of Your Content... If you wish to revoke this Authorization, send your revocation in writing to PO Box 221349, Charlotte, NC 28222. Your revocation of this Authorization ... will not apply to any information shared with Lilly prior to receipt of the notice.
How these were found
Documents read Oct 1, 2026. (1) The current Terms of Use (Last Updated: June 2026) was fetched at https://www.Lilly.com/de/nutzungsbedingungen — an odd German-path URL whose content is fully English and covers lilly.com and LillyDirect.com; it points to lillyhub.com for the canonical copy, which returned 403 to automated fetching, so the German-path copy was used as the accessible verbatim mirror. (2) Older 'Terms of Access' PDF on assets.ctfassets.net (no date shown) appears superseded by the June 2026 Terms of Use. (3) Global Privacy Notice – United States fetched from https://privacynotice.lilly.com, document ID PP-LU-US-0860 dated 10/2025. (4) LillyDirect Pharmacy Notice of Privacy Practices PDF effective November 1, 2025. (5) EBGYSS® Support Services enrollment form published 08/2026 via Lilly's official Adobe AEM delivery domain; the savings-card clause applies to a single drug's program, though parallel 'terminate/rescind/revoke/amend at sole discretion, without notice' language appears across Lilly's savings-card programs. (6) lillyhub.com blocked all automated access (HTTP 403), so the referenced Consumer Health Privacy Notice could not be verified and was not used. No auto-renewal/cancellation-trap clause was found in Lilly's current documents; the auto-refill program in the Lilly Cares form is opt-in with phone opt-out. Third-party summaries of the Zepbound Self Pay Journey Program were not used since no official terms page could be fetched.
These notes come from the original draft and are not independent verification.