The policy states that health information processed through clinical service workflows may be classified as HIPAA-protected health information governed by a separate Notice of Privacy Practices, while non-clinical consumer data remains subject to this general privacy policy.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a dual-document governance structure in which clinical and non-clinical data are subject to different privacy frameworks, and users receiving both clinical and consumer services from Hims & Hers operate under overlapping but distinct sets of data rights and protections.
Interpretive note: The document does not specify the precise operational boundary between HIPAA-covered and non-HIPAA-covered data collection touchpoints, which may create ambiguity for users who interact with both clinical and consumer services.
This provision establishes that users receiving telehealth or clinical services have their health information governed by a separate HIPAA Notice of Privacy Practices, while general consumer data collected through platform interactions is governed by this privacy policy. The applicable data rights, including those for access, amendment, and disclosure restrictions, differ across these two frameworks.
Cross-platform context
See how other platforms handle Separate HIPAA Notice of Privacy Practices for Clinical Data and similar clauses.
Compare across platforms →"If you receive clinical services through our platform, your health information may be considered protected health information (PHI) under HIPAA. In that case, our Notice of Privacy Practices governs the use and disclosure of your PHI, and the terms of this Privacy Policy apply to non-PHI information we collect about you.Excerpt from Hims & Hers's Privacy Policy
1) REGULATORY LANDSCAPE: HIPAA (enforced by HHS OCR) governs PHI processed by covered entities and their business associates.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a dual-document governance structure in which clinical and non-clinical data are subject to different privacy frameworks, and users receiving both clinical and consumer services from Hims & Hers operate under overlapping but distinct sets of data rights and protections.
This provision establishes that users receiving telehealth or clinical services have their health information governed by a separate HIPAA Notice of Privacy Practices, while general consumer data collected through platform interactions is governed by this privacy policy. The applicable data rights, including those for access, amendment, and disclosure restrictions, differ across these two frameworks.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.