Consumer Health Data Privacy Policy and Notice

This Consumer Health Data Privacy Policy and Notice (“Policy”) describes Uber’s processing of consumer health data under U.S. state privacy laws, including Washington’s My Health My Data Act and Nevada’s Health Privacy Law. This Policy supplements the information regarding Uber’s processing of user personal data described in its Privacy Notice.

Consumer Health Data We Collect

For purposes of this Policy, “consumer health data” (“CHD”) shall have the meaning set forth in Washington’s My Health My Data Act, which defines CHD as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.”

This may include some personal data that Uber collects in connection with your use of our services, including:

• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies. For example, Uber collects precise location information from riders and/or drivers during trips, including those to hospitals or other locations where you could receive health-related services.
  
• Usage of Uber services or features that may indicate information regarding your health or receipt of health services or supplies. For example, we may collect such information when you request trips in wheelchair accessible vehicles, indicate your allergies when submitting food delivery requests to merchants, use in-app accessibility features that may indicate disabilities, or request wait-time fee waivers due to disabilities.
• Information relating to deliveries of prescription drugs or other items that may relate to your health.
  
• Photographs, including those which Uber may use to detect and prevent fraud.
  
• Other information that may be used to infer or derive data related to individuals’ physical or mental health status.

CHD does NOT include information that meets the definition of “protected health information” under the Health Insurance Portability and Accountability Act of 1996.

Sources of Consumer Health Data

We collect personal data, which may include CHD, from the sources described in the The data we collect section (Section III.A) of Uber’s Privacy Notice. This includes collecting data:

• When you submit it to Uber.
  
• When you use Uber’s services. This includes collecting location data, and transaction data including the type of services requested or provided and trip or order details (such as date and time, requested pick-up and drop off addresses, distance traveled and items ordered).
  
• From Uber account owners who request services for or on behalf of other users, or who enable other users to request or receive services through their business accounts.
  
• Other sources, such as public health officials.

For additional information on the personal data Uber collects, please see the The data we collect section (Section III.A) of Uber’s Privacy Notice.

How We Use Consumer Health Data

We collect and use personal data, which may include CHD, to provide the services that you request. This includes using personal data to enable transportation, delivery and other services/features, including for purposes of calculating prices and fares; using location data to navigate rider pick-ups and order drop-offs; calculating ETAs, and tracking the progress of rides or deliveries; matching available drivers and delivery persons to users requesting services; and enabling accessibility features.

We also collect and use personal data, including CHD, for purposes of:

• Safety, fraud protection and security. We may use CHD to help maintain the safety, security, and integrity of our services and users, including to prevent, detect, and combat fraud.
  
• For customer support. This includes using CHD to investigate and address user concerns and to monitor and improve our customer support responses and processes.
  
• Research and development. This includes analysis, machine learning, product development, research, and testing.
  
• Legal proceedings and requirements. We may use CHD to investigate or address claims or disputes relating to use of Uber’s services, to satisfy requirements under applicable laws, regulations, operating licenses or agreements, insurance policies, or pursuant to legal process or governmental request, including from law enforcement.

For additional information on our uses of personal data, please see the How we use data section (Section III.B) of Uber’s Privacy Notice.

Sharing Consumer Health Data

We may share CHD for purposes of providing services that you request.

For example, we share:

• your first name, delivery address, and order information (including drug prescriptions, special instructions, allergies or food preferences) with the restaurant or merchant you order from, and with the delivery person.
  
• your first name and last initial with your driver or delivery person, as well as the location of your pick-up or trip/order destination.
  
• your data when you use a feature that involves data sharing with other users, such as ETA sharing or certain accessibility features.

We may also share personal data, which may include CHD, with your consent. For example, we enable riders to share their real-time location data with their drivers or delivery persons (as applicable).

We may also share personal data, which may include CHD:

• with our subsidiaries and affiliates to help us provide our services or conduct data processing on our behalf.
  
• with payment processors and facilitators, including PayPal and Hyperwallet.
  
• with Uber service providers, including cloud storage providers, customer support platform and service providers, service providers that assist Uber to enhance the safety and security of Uber apps and services, and service providers that provide us with artificial intelligence and machine learning tools and services.
  
• with Google, in connection with the use of Google Maps in Uber’s apps.
  
• for legal reasons or in the event of a dispute. This includes sharing users’ data if we believe it’s required by applicable law, regulation, operating license or agreement, legal process or governmental request, insurance policy, or where the disclosure is otherwise appropriate due to safety or similar concerns. This also includes sharing data with law enforcement officials, public health officials, other government authorities, airports (if required by the airport authorities as a condition of operating on airport property), insurance companies, or other third parties as necessary to enforce our Terms of Service, user agreements, or other policies; to protect Uber’s rights or property or the rights, safety, or property of others; or in the event of a claim or dispute relating to the use of our services.

For more information on Uber’s sharing of personal data, please see the Data sharing and disclosure section (Section III.D) of Uber’s Privacy Notice.

How to Exercise Your Rights

The laws of your state may provide you with certain rights with respect to consumer health data, including the rights to access or delete your data.

You can submit these requests here, and/or through Uber’s Privacy Center.

If your request is denied, you may appeal that decision by contacting us here. If your appeal is unsuccessful, and you are a resident of Washington, you can raise a concern or lodge a complaint with the Washington State Attorney General here.