The policy prohibits merchants from uploading Protected Health Information (PHI) as defined under HIPAA to the Shopify platform, identifying this as a category of business activity the platform does not support.
This analysis describes what Shopify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Shopify does not function as a HIPAA-compliant platform for PHI storage or processing, and that merchants who upload PHI are in violation of this policy regardless of their own HIPAA status.
Under this clause, merchants operating in healthcare-adjacent industries who handle PHI are prohibited from uploading such data to Shopify, meaning platform use must be structured to exclude PHI from any data submitted to the platform.
Cross-platform context
See how other platforms handle HIPAA Protected Health Information Upload Prohibition and similar clauses.
Compare across platforms →"You must likewise respect that certain business activities are not supported by our platform, such as uploading Protected Health Information subject to HIPAA.Excerpt from Shopify's Acceptable Use Policy
(1) REGULATORY LANDSCAPE: This provision directly engages HIPAA, enforced by the HHS Office for Civil Rights.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Shopify does not function as a HIPAA-compliant platform for PHI storage or processing, and that merchants who upload PHI are in violation of this policy regardless of their own HIPAA status.
Under this clause, merchants operating in healthcare-adjacent industries who handle PHI are prohibited from uploading such data to Shopify, meaning platform use must be structured to exclude PHI from any data submitted to the platform.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Shopify.