{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"38c3e38f-4376-485b-a86b-0582ba50537a","screeningDate":"2026-11-07T19:40:25.772Z","publicationGate":"published","company":{"id":"83da1ad9-8891-4372-a9db-bdf82c894d2a","name":"Anthropic","slug":"anthropic","industry":"Tech Giant"},"policy":{"id":"295e4c7f-fa6e-4e4d-908e-383cb91a59ae","name":"Consumer Health Data Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-07T19:40:25.767Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"bd8c449ea59d6cc2a19837df133615950fd48f5eeb6111bc1c3e80744be37511","capturedAt":"2026-10-22T11:41:15.173Z"},"current":{"version":3,"sha256":"41f9cca4544c0b45023b5291331585c0ed7c5a8e69da8c0f6ef6f553cfbf45ee","capturedAt":"2026-11-07T19:40:25.767Z"}},"analysisLineage":{"status":"verified","requestSha256":"bc66e5696059a634de24d9b1f62dcd63e2637a1a4c52df245b38acfaf1497f57","responseSha256":"8d929e3f928d8b45f4676c45676e8844bf07e8311777282a202b14f00cb34dce","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"bd8c449ea59d6cc2a19837df133615950fd48f5eeb6111bc1c3e80744be37511","charLength":3952,"byteLength":3978,"rangeUnit":"utf16-code-unit","includedRanges":[[0,3952]],"excludedRanges":[]},"new":{"sha256":"41f9cca4544c0b45023b5291331585c0ed7c5a8e69da8c0f6ef6f553cfbf45ee","charLength":3942,"byteLength":3968,"rangeUnit":"utf16-code-unit","includedRanges":[[0,3942]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy","requestedUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy","finalUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy","capturedAt":"2026-10-22T11:41:15.173Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy","requestedUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy","finalUrl":"https://www.anthropic.com/legal/consumer-health-data-privacy-policy","capturedAt":"2026-11-07T19:40:25.767Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"No changes were found in this policy; it continues to detail extensive collection and use of sensitive consumer health data.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"ee14057b-75d0-4a19-8851-88a2577bf385","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-22T11:41:15.180Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"alert","textEn":"Extensive collection of sensitive health data, including biometric and genetic.","textIt":"Ampia raccolta di dati sanitari sensibili, inclusi biometrici e genetici.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad disclosure to unspecified third parties, referencing the main Privacy Policy.","textIt":"Ampia divulgazione a terze parti non specificate, con riferimento alla Privacy Policy principale.","deltaScore":0,"evidenceQuote":"Anthropic will disclose the categories of consumer health data described above to the categories of third parties described in “3. How We Disclose Personal Data” in our Privacy Policy.","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"},{"icon":"warning","textEn":"Aggregated data is used for service development, testing, and improvement.","textIt":"I dati aggregati sono usati per lo sviluppo, il test e il miglioramento del servizio.","deltaScore":0,"evidenceQuote":"In an aggregated form, to help us develop, test and improve our services.","evidenceSide":"old","relatedKpi":"kpiAiTrainingOptOut","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Extensive collection of sensitive consumer health data, including biometric and genetic information.","textIt":"Ampia raccolta di dati sanitari sensibili dei consumatori, incluse informazioni biometriche e genetiche.","sentiment":"negative"},{"textEn":"Data is used for third-party app integration, fraud prevention, and aggregated service improvement.","textIt":"I dati sono usati per l'integrazione di app di terze parti, prevenzione frodi e miglioramento aggregato del servizio.","sentiment":"neutral"},{"textEn":"Users can access, delete, or withdraw consent for their consumer health data via Privacy Settings.","textIt":"Gli utenti possono accedere, eliminare o revocare il consenso per i propri dati sanitari tramite le Impostazioni Privacy.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"High risk for compliance with GDPR and the upcoming AI Act due to sensitive data processing. Enterprises must ensure robust consent mechanisms and transparency for AI system development.","complianceNoteEn":"GDPR, AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk due to extensive collection of sensitive health data, potentially violating GDPR Article 9. Users should be aware of limited transparency regarding data processing for AI training.","complianceNoteEn":"GDPR Art. 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"High","impactAnalysisEn":"High risk. Managing sensitive health data across diverse global jurisdictions without explicit, harmonized standards is challenging. This requires robust internal governance and compliance frameworks.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"High risk. The collection of biometric, genetic, and precise location data raises universal privacy concerns. Users should be cautious about sharing such sensitive information.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Medium risk. Compliance with evolving state-specific health data laws is critical. Broad data sharing and AI use require careful management to avoid regulatory penalties.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Medium risk. The policy acknowledges state-specific consumer health data laws (e.g., Washington My Health My Data Act). Users should review their rights regarding sensitive data collection and sharing.","complianceNoteEn":"My Health My Data Act"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Consumer Health Data Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/38c3e38f-4376-485b-a86b-0582ba50537a","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"6a6015ea1adf20b58be1311b7f951a66ccd8ed616b0bbe883eb44ac2d71bf844"}