Retirement & Telehealth · Telehealth · Data breach
Hims & Hers
Headline
The 2026 breach sits inside a broader telehealth incident pattern, and the specific sensitivity here is the product line: Hims & Hers built its business on conditions people specifically do not want discussed - sexual…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The 2026 breach sits inside a broader telehealth incident pattern, and the specific sensitivity here is the product line: Hims & Hers built its business on conditions people specifically do not want discussed - sexual health, hair loss, mental health, weight management. The entire value proposition is discretion, which means the customer list is itself a diagnosis list. Direct-to-consumer telehealth also frequently sits at the edge of the HIPAA perimeter depending on how the clinical relationship is structured, so the protection a customer assumes applies may not. Cross-ref the Teladoc and Talkspace rows.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED 2026 DATA BREACH (part of a broader telehealth/mental-health industry breach wave documented in a privacy roundup alongside Talkspace, BetterHelp, Cerebral, and Confidant Health): the breach exposed customer names and contact information tied to CUSTOMER SERVICE RECORDS — TWO SEPARATE class action lawsuits allege Hims & Hers failed to adequately safeguard sensitive customer data and DELAYED NOTIFICATION to affected customers, increasing identity-theft risk. Given Hims & Hers' business (telehealth prescriptions for sensitive conditions like hair loss, sexual health, and mental health), even 'just' contact information exposure carries an implicit health-condition-association risk beyond the literal data exposed.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy hims.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service hims.com/terms-and-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.