The policy states that the platform collects health and medical information including symptoms, conditions, medications, allergies, and medical history submitted by users through intake forms, consultations, and other service interactions.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that sensitive health information is collected directly from users as part of the core service workflow, and the data's regulatory treatment may differ depending on whether it is processed through a HIPAA-covered clinical context or through consumer-facing intake flows outside that coverage.
Interpretive note: The document does not specify with precision which data collection flows are within HIPAA-covered entity operations versus general consumer flows, creating classification ambiguity.
This provision establishes that health and medical details including diagnoses, medications, and symptom history are collected and retained as part of platform use. The applicable privacy protections for this data depend on whether the information is processed within HIPAA-covered clinical operations or through general platform interactions.
Cross-platform context
See how other platforms handle Collection of Sensitive Health and Medical Information and similar clauses.
Compare across platforms →"We collect information you provide to us directly, such as when you create an account, fill out a form, make a purchase, communicate with us, or otherwise use our Services. This includes: Health and medical information (e.g., information about your symptoms, conditions, medications, allergies, medical history, and other health-related information you provide in connection with our Services).Excerpt from Hims & Hers's Privacy Policy
1) REGULATORY LANDSCAPE: Health information collected through HIPAA-covered clinical workflows is governed by HIPAA (enforced by HHS OCR).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that sensitive health information is collected directly from users as part of the core service workflow, and the data's regulatory treatment may differ depending on whether it is processed through a HIPAA-covered clinical context or through consumer-facing intake flows outside that coverage.
This provision establishes that health and medical details including diagnoses, medications, and symptom history are collected and retained as part of platform use. The applicable privacy protections for this data depend on whether the information is processed within HIPAA-covered clinical operations or through general platform interactions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.