Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
The privacy policy indicates that Hims & Hers does not function as a HIPAA covered entity, which means your interactions and submitted information may not be protected by HIPAA, unless the company is acting as a business associate for another entity (risk_flags-2). Furthermore, any information you provide that is not strictly for diagnosis, treatment, lab, or prescription services is not considered protected health information and is subject only to their privacy policy and state laws (risk_flags-1).
90% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
Critical issues, especially those that can lead to significant and irreversible user harm.
high95% confidence
Lack of HIPAA Protection for Non-Medical Information
Information submitted to Hims & Hers that is not solely for diagnosis and treatment, lab services, or prescription fulfillment is not considered Protected Information under HIPAA and is subject only to their Privacy Policy and applicable state laws.
Why it matters: Information you provide to Hims & Hers that is not specifically for medical diagnosis, treatment, lab services, or prescription fulfillment may not be protected by HIPAA's strict privacy rules.
By accessing or using any part of the Service, you understand that any information that you submit to Hims & Hers that is not intended and used solely for the provision of diagnosis and treatment by the Medical Group and Providers, laboratory services by the Labs or prescription fulfillment by the Pharmacies, is not considered Protected Information, and will be subject only to our Privacy Policy and any applicable state laws that govern the privacy and security of such information.
Hims & Hers is not a "covered entity" under HIPAA, meaning HIPAA does not necessarily apply to your transactions or communications with them, although they may be a "business associate" of Pharmacy or Medical Group and subject to some HIPAA provisions in that role.
Why it matters: Your personal health information may not have the full protection of HIPAA when interacting directly with Hims & Hers, unless they are acting as a "business associate" for another HIPAA-covered entity.
One or more of the Labs, Pharmacies or Medical Groups (as defined in our Terms and Conditions) may or may not be a “covered entity” or “business associate” under HIPAA, and Hims & Hers may in some cases be a “business associate” of a Pharmacy or Medical Group. It is important to note that HIPAA does not necessarily apply to an entity or person simply because there is health information involved, and HIPAA may not apply to your transactions or communications with Hims & Hers, the Medical Groups, the Providers, the Labs, or the Pharmacies.
Practices and policies around the collection, processing, and sharing of user data.
✓
Looking good
No data-use concerns flagged
Verbaterm only flags concerns it can cite. No source-backed data-use findings are shown here.
Cancellation and Renewal
Terms related to subscription, cancellation, and renewal.
✓
Looking good
No billing surprises spotted
Verbaterm only flags concerns it can cite. No cancellation, auto-renewal, or refund terms needed attention here.
Gotchas
Potentially stealthy or unexpected clauses that could work against the user.
✓
Looking good
No hidden gotchas
Verbaterm only flags concerns it can cite. Nothing easy-to-miss stood out in this section.
Protections
Explicit commitments and features that benefit the user.
Protection90% confidence
Removal of Minor Information
Users under sixteen years of age (or their parent/guardian if under 13) can request the removal of content or information about them that is posted on the Platform.
Why it helps: This allows minors or their guardians to remove personal content or information, offering a degree of control over their digital footprint.
Furthermore, if you are under sixteen (16) years of age, then you (or your parent or legal guardian if you are under age 13) may at any time request that we remove content or information about you that is posted on the Platform.
Non-Collection of Personal Information from Children Under 13
The Service is not designed or intended to attract, and is not directed to, children under thirteen (13) years of age.
Why it helps: This demonstrates a commitment to protecting the privacy of young children by not intentionally targeting or collecting their personal information.
The Service is not designed or intended to attract, and is not directed to, children under thirteen (13) years of age.