Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement establishes that use of the platform constitutes a request by the user for Hims & Hers and Medical Groups to process sensitive personal information, including health information, as necessary to provide the service, including personalized recommendations delivered by email and on the platform.
This analysis describes what Hims & Hers's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision frames the processing of sensitive personal information, including health and mental health data, as user-initiated through the act of using the service, which structures consent as implicit in platform use rather than through a separate affirmative consent mechanism. The consent-through-use framing may require evaluation against state privacy laws that impose specific opt-in consent requirements for sensitive data processing.
Interpretive note: Whether the consent-through-use framing satisfies opt-in consent requirements under CPRA, Washington's My Health MY Data Act, and analogous state statutes depends on regulatory interpretation and enforcement posture in each jurisdiction.
Under this clause, using the Hims & Hers platform constitutes a request for the company and affiliated Medical Groups to process sensitive personal information, including health data, for service delivery and personalization purposes including email recommendations. The agreement acknowledges that this information may be subject to heightened legal obligations in certain jurisdictions.
Cross-platform context
See how other platforms handle Sensitive Personal Information Processing Authorization and similar clauses.
Compare across platforms →Monitoring
Hims & Hers has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The Service may also involve certain uses of personal information that is considered sensitive in certain jurisdictions or otherwise subject to heightened legal obligations. You understand that by using the Service or Platform, you are requesting that Hims & Hers and/or the Medical Groups process your personal information, including sensitive personal information, as necessary to provide you the features described on the Hims & Hers website and the Platform or as otherwise required to provide the Service to you. This may include, for example, sending you personalized recommendations relating to your use of the Service by email and/or on the Platform.Excerpt from Hims & Hers's Terms and Conditions
REGULATORY LANDSCAPE: This provision engages the CCPA and CPRA, which require opt-in consent for the processing of sensitive personal information as defined under California law, including health data and mental health data. Washington's My Health MY Data Act, Nevada's consumer health data law, and analogous statutes impose affirmative consent requirements for collection and use of consumer health data by non-HIPAA-covered entities. The GDPR applies to any EU residents using the service and imposes explicit consent or other lawful basis requirements for sensitive data processing under Article 9. GOVERNANCE EXPOSURE: High. The consent-through-use framing for sensitive personal information processing may not satisfy the specific opt-in consent requirements imposed by CPRA, Washington's My Health MY Data Act, and other state health data privacy statutes. The use of sensitive health data for personalized email recommendations may trigger additional consent or opt-out requirements under applicable law. JURISDICTION FLAGS: California presents the highest exposure given CPRA's explicit opt-in consent requirement for sensitive personal information processing. Washington state's My Health MY Data Act imposes broad consent requirements for consumer health data regardless of HIPAA coverage. Nevada, Connecticut, Colorado, and other states with comprehensive privacy laws imposing heightened sensitive data protections create secondary exposure. CONTRACT AND VENDOR IMPLICATIONS: The processing of sensitive personal information by Medical Groups as co-processors under this provision creates vendor data governance implications. Data processing agreements with Medical Groups should address the legal basis for sensitive data processing in each applicable jurisdiction. The use of health data for personalized marketing communications should be reviewed against applicable consent requirements. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the consent-through-use framing satisfies opt-in consent requirements under CPRA and applicable state health data privacy laws. A data mapping exercise should identify all sensitive personal information flows, including health and mental health data, used for personalization purposes. Marketing communications using sensitive health data should be reviewed for compliance with applicable consent and opt-out requirements in each state of operation.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision frames the processing of sensitive personal information, including health and mental health data, as user-initiated through the act of using the service, which structures consent as implicit in platform use rather than through a separate affirmative consent mechanism. The consent-through-use framing may require evaluation against state privacy laws that impose specific opt-in consent requirements for sensitive data processing.
Under this clause, using the Hims & Hers platform constitutes a request for the company and affiliated Medical Groups to process sensitive personal information, including health data, for service delivery and personalization purposes including email recommendations. The agreement acknowledges that this information may be subject to heightened legal obligations in certain jurisdictions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Hims & Hers.