Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy provides a web-based mechanism at privacy.hims.com/policies for users to submit requests to access, copy, download, correct, or delete personal information, and states that in some states users may additionally request information about third-party sharing.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational mechanism through which users exercise data subject rights under applicable state privacy laws, including CCPA and CPRA, and notes that the scope of available rights varies by jurisdiction.
The agreement directs users to privacy.hims.com/policies to exercise rights to access, copy, correct, or delete their personal information. The policy notes that the company may decline requests in certain circumstances including where it cannot authenticate the user, the request is unreasonable or excessive, or where legal retention obligations apply; declined requests may be appealed using the contact method described in the policy.
Cross-platform context
See how other platforms handle Data Access, Correction, Deletion, and Portability Rights and similar clauses.
Compare across platforms →Monitoring
Hims & Hers has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Access, portability, correction, and deletion. If you wish to access, copy, download, correct, or delete personal information about you that we hold, please visit privacy.hims.com/policies. If you are unable to access, copy, correct, or delete certain personal information we have via those means, you can send us a request by using contact methods described at the bottom of this Privacy Policy. In some states, you also have the right to request information about third parties with whom we share your personal information, which you may exercise through these same mechanisms.Excerpt from Hims & Hers's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages CCPA and CPRA data subject rights including the rights to know, correct, delete, and data portability. Similar rights exist under Colorado, Connecticut, Virginia, Texas, and other state comprehensive privacy laws. The right to information about third-party sharing described for 'some states' reflects CCPA and similar statutory requirements. The FTC and state attorneys general are relevant enforcement authorities for failures to honor data subject rights requests. 2. GOVERNANCE EXPOSURE: Medium. The policy's reservation of the right to decline requests on multiple grounds including inability to authenticate and unreasonable or excessive requests is consistent with applicable state law exemptions but requires that the company's authentication and declination processes be documented and consistently applied. The appeal mechanism described is required under CCPA and CPRA and should be operationally functional. 3. JURISDICTION FLAGS: California CPRA imposes specific response timelines (45 days with one 45-day extension) and appeal rights for data subject requests. Colorado, Connecticut, and Virginia privacy laws impose similar timelines and mandatory appeal mechanisms. The policy does not specify response timelines in this section, which compliance teams should verify are addressed in operational procedures. 4. CONTRACT AND VENDOR IMPLICATIONS: Service provider agreements should include contractual obligations for vendors to assist in fulfilling data subject rights requests, including deletion and access requests, within the timeframes required by applicable law. The policy's reference to third-party sharing disclosure rights requires that the company maintain sufficiently detailed records of third-party data disclosures to respond to those requests accurately. 5. COMPLIANCE CONSIDERATIONS: Legal teams should verify that the privacy.hims.com/policies portal is operationally functional and accurately routes requests to responsible processing teams; confirm that response timelines meet CCPA, CPRA, and other applicable state law requirements; review the authentication process for data subject requests to ensure it is proportionate and does not create unreasonable barriers to rights exercise; and assess whether the appeal mechanism meets applicable statutory requirements.
This provision establishes the operational mechanism through which users exercise data subject rights under applicable state privacy laws, including CCPA and CPRA, and notes that the scope of available rights varies by jurisdiction.
The agreement directs users to privacy.hims.com/policies to exercise rights to access, copy, correct, or delete their personal information. The policy notes that the company may decline requests in certain circumstances including where it cannot authenticate the user, the request is unreasonable or excessive, or where legal retention obligations apply; declined requests may be appealed using the contact method described in …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.