The policy states that personal information is retained as long as necessary for stated purposes including service delivery, legal compliance, dispute resolution, and agreement enforcement, without specifying fixed retention periods for particular data categories.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The absence of specific retention periods for particular data categories, including health and medical information, creates ambiguity about how long sensitive data is held and limits the practical predictability of data deletion requests.
Interpretive note: The document does not specify retention periods by data category, creating ambiguity about compliance with CPRA's retention disclosure requirements.
This provision establishes that personal information including health data is retained for unspecified durations determined by the company based on stated purposes. Users who submit deletion requests may find that certain data is retained under legal obligation or dispute resolution exceptions.
Cross-platform context
See how other platforms handle Data Retention and similar clauses.
Compare across platforms →"We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type of information and the purposes for which it is used.Excerpt from Hims & Hers's Privacy Policy
1) REGULATORY LANDSCAPE: CPRA requires that retention periods be disclosed in the privacy policy for each category of personal information.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The absence of specific retention periods for particular data categories, including health and medical information, creates ambiguity about how long sensitive data is held and limits the practical predictability of data deletion requests.
This provision establishes that personal information including health data is retained for unspecified durations determined by the company based on stated purposes. Users who submit deletion requests may find that certain data is retained under legal obligation or dispute resolution exceptions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.