The policy states that personal information is retained as long as necessary for stated purposes including service delivery, legal compliance, dispute resolution, and agreement enforcement, without specifying fixed retention periods for particular data categories.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The absence of specific retention periods for particular data categories, including health and medical information, creates ambiguity about how long sensitive data is held and limits the practical predictability of data deletion requests.
Interpretive note: The document does not specify retention periods by data category, creating ambiguity about compliance with CPRA's retention disclosure requirements.
This provision establishes that personal information including health data is retained for unspecified durations determined by the company based on stated purposes. Users who submit deletion requests may find that certain data is retained under legal obligation or dispute resolution exceptions.
Cross-platform context
See how other platforms handle Data Retention and similar clauses.
Compare across platforms →Monitoring
Hims & Hers has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type of information and the purposes for which it is used.— Excerpt from Hims & Hers's Hims & Hers Privacy Policy
1) REGULATORY LANDSCAPE: CPRA requires that retention periods be disclosed in the privacy policy for each category of personal information. Vague retention language without category-specific periods may not satisfy this CPRA disclosure requirement. HIPAA also requires covered entities to retain certain health records for minimum periods specified by state law. 2) GOVERNANCE EXPOSURE: Medium. The absence of specific retention periods is a common compliance gap under CPRA. Regulators have indicated that vague retention language may not meet the specificity required by the statute. 3) JURISDICTION FLAGS: California CPRA requires disclosure of retention periods or criteria used to determine retention for each personal information category. This creates heightened exposure for California users. GDPR (applicable to EU users covered by regional policies) similarly requires specification of retention periods or criteria. 4) CONTRACT AND VENDOR IMPLICATIONS: Vendor data processing agreements should mirror the company's retention framework and require deletion of personal information when the company's retention period ends. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should develop and publish category-specific retention schedules to satisfy CPRA disclosure requirements, and confirm that retention periods for health and medical information account for applicable HIPAA and state medical records retention requirements.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The absence of specific retention periods for particular data categories, including health and medical information, creates ambiguity about how long sensitive data is held and limits the practical predictability of data deletion requests.
This provision establishes that personal information including health data is retained for unspecified durations determined by the company based on stated purposes. Users who submit deletion requests may find that certain data is retained under legal obligation or dispute resolution exceptions.
ConductAtlas has identified this type of provision across 137 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.