Hims & Hers Accused of Sharing Patients’ Health Data

The Facts

Hims & Hers sells access to online medical evaluations and prescription treatments for conditions including sexual health, hair loss, hormone health, weight loss, dermatology and mental health. To obtain treatment, a consumer moves through an online intake that can require intensely personal disclosures: current prescriptions, sexual function, mood, suicidal thoughts, recreational drug use, past surgeries, chronic conditions, height, weight and sex at birth.

The complaint describes a four-part intake. A consumer first answers roughly five to 15 questions about treatment goals, creates an account, completes another 25 to 50 medical-history questions, and then sees a proposed treatment and supplies billing and shipping details before a provider reviews the submission.

That process is the center of both disputes in the lawsuit. Plaintiffs allege that hidden tracking technology transmitted information from the intake to outside advertising and analytics companies. They also allege that submitting the intake could authorize an immediate prescription charge and recurring enrollment before the consumer had a meaningful chance to discuss or approve the recommended treatment.

What Hims & Hers Is Accused of Doing

Turning medical intake events into advertising data

According to the filing, Hims & Hers embedded tracking pixels in its websites and software development kits, or SDKs, in its mobile applications. A pixel is code that records actions on a website. An SDK can perform similar tracking inside an app. These tools can report which page someone viewed, which button they pressed and which event occurred. Website operators can also configure custom events that describe actions specific to their service.

The plaintiffs allege those tools sent more than anonymous traffic counts. The complaint says Meta received health-related events and identifiers; Google received identifiers, browser information, full web addresses revealing the type of questionnaire and event names showing that a consultation had begun; and Snap received events, identifiers and hashed email addresses used to match people to Snapchat accounts. It further alleges that Amplitude received treatment categories and, on the website, actual questionnaire answers.

Some of these allegations come from the separate government complaint. Others come from plaintiffs’ testing. The exact fields transmitted to every recipient, how long each practice continued and what each recipient retained are not established by the supplied record.

Converting provider approval into payment

The second alleged mechanism was simpler. Hims & Hers advertised “free” consultations or assessments and used checkout language including “Due Now – $0,” “Pay $0 today” and “You will only be charged if prescribed.” Plaintiffs say those statements suggested there would be time to speak with a provider, review the recommendation and decide whether to proceed.

The complaint alleges that in most states a provider could instead review the intake without a subsequent conversation, prescribe treatment, trigger an immediate charge, send the prescription for fulfillment and enroll the consumer in a recurring plan. Under that alleged design, the decision point belonged to the provider and platform—not to the consumer looking at a final prescription and price.

Who Had to Live With the Alleged Consequences

All seven plaintiffs say they supplied names, contact information, symptoms and medication histories while seeking healthcare. They did not disclose their underlying conditions in the complaint, explaining that those details would be handled in discovery under an appropriate health-privacy protective order. Each alleges that the information was transmitted without consent and that they would not have used the platform had they known it would be shared for advertising or other undisclosed purposes.

The complaint does not allege that a named plaintiff was denied insurance, lost a job or suffered another specific downstream consequence because an advertising company received the data. It alleges an invasion of privacy, loss of control over medical information and commercial use of that information. Those are the injuries the court will have to assess; broader harms cannot be treated as established from this filing.

Three billing accounts in the complaint

Smith alleges that his first cancellation request was neither acknowledged nor processed, that he had to submit another request and that he did not succeed in cancelling until mid-2025. Aimone says her first attempt was ignored and that she contacted customer service multiple times over several days before the subscription was cancelled; Hims & Hers allegedly retained the $39 charge.

The alleged injury wasn’t merely a confusing screen. For the named consumers, the filing describes medical information leaving the intake and money leaving their accounts before they believed they had approved either event.

The Promises in the Record

The complaint places Hims & Hers’s privacy statements beside the alleged transmissions. Until at least August 2023, it says, the company told consumers that medical records and sensitive information were accessible only to providers managing their care. Online advertising described the service as “100% online, private, and secure.” The company’s privacy policy, last updated March 26, 2026 according to the filing, contained an even more direct statement about protected information.

Plaintiffs argue that the tracking systems contradicted those representations. The filing specifically alleges that Hims & Hers created health-related events sent to Meta and used disclosed data to build advertising audiences. Whether the information legally qualified as protected medical information, whether users authorized any transmissions and how each recipient used the data remain contested issues rather than resolved facts.

What Hims & Hers Allegedly Knew—and Changed

The complaint’s knowledge theory relies on system design and repeated notice. It argues that Hims & Hers selected and configured the tracking tools, determined which pages contained them and received analytics generated from the resulting events. It also cites consumer complaints submitted directly and through the Better Business Bureau, Trustpilot and Apple’s App Store about unexpected enrollment, immediate charges and failed cancellations.

For billing, the filing cites years of complaints from people who believed a consultation would occur before payment. It also says the FTC issued a Civil Investigative Demand in October 2023. A demand is an investigative request, not a finding of wrongdoing.

The Evidence—and Its Limits

The strongest documentary contrast is between Hims & Hers’s quoted privacy promises and the alleged configuration of tracking events. The class complaint cites the government’s allegation that Meta and Snap received events conveying health information. Plaintiffs’ own investigation adds more granular claims: Amplitude allegedly received treatment categories, identifiers and actual questionnaire answers, while Snap received hashed email addresses used for account matching.

The filing also includes examples of the medical questions and a screenshot that plaintiffs describe as transmitted data showing a hair-loss treatment goal. For subscriptions, it quotes checkout language, lays out the cancellation path screen by screen and recounts charges experienced by three named plaintiffs.

Several important gaps remain. The complaint says discovery is needed to determine the full medical information transmitted, any server-side uploads invisible to outside testing and how recipients used the data. It speculates that discovery may uncover additional customer-list uploads; that possibility is not established evidence. The filing also estimates that proposed class members likely number in the millions, but no court has accepted that estimate or certified a class.

The Broader Stakes—Without Overstating Them

A telehealth intake is both a medical doorway and a digital product. This case alleges that Hims & Hers treated the same clicks as inputs to both systems: one used by a provider to evaluate treatment, the other used to measure and improve advertising. If proven, that overlap would show how ordinary marketing infrastructure can expose information whose sensitivity comes from context. An event labeled “consultation/hair-loss” means more on a medical platform than a generic page view on a retail site.

The complaint also describes how interface language can shift the moment of consent. A consumer may understand “$0 today” to mean that a decision comes later. The alleged system treated provider approval as the event that authorized payment. That difference is measured in actual charges and recurring shipments, not merely user-interface etiquette.

The record doesn’t establish that these practices caused a market-wide loss of trust, discrimination or insurance harm. Nor does it establish how many people experienced both the privacy and billing practices. The broader institutional question is narrower: whether a healthcare platform can use advertising technology and subscription design in the ways alleged while still delivering the privacy and informed choice it advertised.

Hims & Hers’s Response

The supplied source contains no answer, motion or public statement responding to this class complaint. Its quoted privacy policies and marketing statements describe what the company told consumers; they are not a litigation response. Without Hims & Hers’s account, the record does not explain whether it disputes the transmissions, considers them authorized, challenges the plaintiffs’ technical analysis or defends the subscription flow on other grounds.

The Legal Fight

The plaintiffs propose nationwide privacy and subscription classes, plus California subclasses. A proposed class is not yet a class action on behalf of everyone described. The court must first decide whether the named plaintiffs satisfy the requirements for class certification.

The complaint asserts 15 claims. The privacy theories include the federal Electronic Communications Privacy Act, California’s Confidentiality of Medical Information Act and Invasion of Privacy Act, the California Constitution, common-law privacy and California’s computer-access statute. The subscription theories invoke California consumer-protection and false-advertising laws, with the federal Restore Online Shoppers’ Confidence Act and California’s Automatic Renewal Law used as predicates for another state-law claim. Plaintiffs also allege negligence and unjust enrichment.

They seek injunctions, deletion of data, changes to advertising and cancellation practices, restitution, disgorgement, statutory and actual damages, punitive damages where available, fees and class certification. Those are requests, not awards.

What the court has actually decided

Nothing substantive appears in the supplied record. The document is the initial complaint. It does not show that Hims & Hers has been found liable, that any claim has survived a motion to dismiss, or that the proposed classes have been certified. The separate FTC case is also described at the complaint stage; its allegations are not converted into findings merely because government agencies made them.

What Remains Unresolved

• Which health fields, answers and identifiers were transmitted to each third party, and during what periods?
• Did Hims & Hers make additional server-to-server uploads that outside testing could not observe?
• How did Meta, Google, Snap, Amplitude or other recipients retain and use the information?
• What disclosures and consent mechanisms did each plaintiff see, and were they legally sufficient?
• How many consumers were charged, enrolled or unable to cancel under the challenged flows?
• Which practices remain in operation, and what data remains stored?