Hims: Telehealth for Men

"Marketing/Ad Partners. We may provide personal information to marketing and advertising partners. For example, we may disclose identifying information to an advertising partner in order to deliver personalized advertising to you or for the purpose of delivering advertisements to other people with similar interests to you. This may include sensitive personal information such as health data or information about your sex life to the extent it is not Protected Information."

The company shares sensitive health and sexual orientation data with advertising partners for targeted advertising purposes, which is especially concerning given the nature of the health services they provide (e.g., erectile dysfunction, hair loss).

"Third party analytics and advertising companies also collect personal information through our website and apps including identifiers and device information (such as cookie IDs, device IDs, and IP address), geolocation data, usage data, and inferences based on and associated with that data. These third-party vendors may combine this data across multiple sites to improve analytics for their own purpose and others."

Third-party advertising companies like Google, Facebook, and X collect device identifiers, usage data, and geolocation through the site and combine it across multiple websites to build cross-site profiles.

"Geolocation data. Depending on your device and app settings, we collect geolocation data when you use our apps or online services. ... we let advertising and analytics providers collect identifiers (IP addresses, cookie IDs, and mobile IDs), activity data (browsing, clicks, app usage, non-product identifying transaction data), device data, and geolocation data through our sites and apps when you use our online services."

Hims & Hers collects geolocation data and allows advertising and analytics partners to directly collect this data through their sites and apps.

"Biometric information. We or our service providers may use biometric information to verify your identity prior to your use of the Service. ... Identifiers and device information. When you visit our websites, our web servers automatically log your Internet Protocol (IP) address and information about your device, including device identifiers (such as MAC address); device type; and your device's operating system, browser, and other software including type, version, language, settings, and configuration."

The company collects biometric information and extensive device data including MAC addresses, device identifiers, and detailed software configuration, which goes beyond what a telehealth service typically requires.

"We retain personal information for as long as necessary to provide the services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and for other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the information, the availability of automated controls that enable users to delete data, and our legal or contractual obligations."

No specific retention periods are provided for any data category, and the broad justifications (legal obligations, business purposes, dispute resolution) effectively allow indefinite retention of sensitive health and personal data.

"Hims & Hers may supplement, amend, or otherwise modify this Privacy Policy at any time. Such supplements, amendments and other modifications will be posted on this or a similar page of the Service, and shall be deemed effective as of the "Last Updated" date; provided, however, that Hims & Hers will notify you via email and/or require you to accept the updated Privacy Policy if the supplemented, amended or otherwise modified Privacy Policy implements material changes."

Non-material changes take effect immediately upon posting with no notice requirement, placing the burden on users to constantly check the policy. Even for material changes, the company only commits to notification or consent "as may be required by law."