Privacy Policy (Including Cookie Policy)

Privacy Notice

Your care is now provided by Fill Function UK Limited and this notice applies to it. Hims & Hers UK Limited remains responsible for your payment contract and for records created before the move, under its own privacy notice. See our platform migration privacy notice for what the move means for your information.

1. Introduction

This privacy notice explains how Hims, as part of the Hims & Hers group ("Hims", "we", "us") collects, uses, shares and protects personal data when you use our websites, apps, and offerings, including our telehealth and healthcare-related services and communities.

2. Who we are and how this notice works

Hims provides consumer services through the Hims brand and related websites/apps. Responsibility for your personal data within the Hims & Hers group may vary based on your location and the specific service you use.

Annex A contains regional requirements for the United Kingdom that modify or add to this notice. Annex B lists the responsible entities (i.e. data controllers) and the services they manage (see Annex C for contact information).

This notice applies to a broad range of individuals, including our customers and users (including those who begin but do not complete our online questionnaires or onboarding processes), anyone who contacts us and/or anyone with an established business relationship with us.

It applies when you:

• Visit our websites or use our apps

• Create an account or complete forms/questionnaires

• Use telehealth or other healthcare services (including pharmacy fulfilment where applicable)

• Interact with clinicians, healthcare professionals, health coaches, companions and other partners

• Join and participate in our online health communities (e.g. WhatsApp groups)

• Connect wearables or other devices that integrate with our services

• Contact us online or by phone

Some healthcare professionals or service providers you interact with through our services may operate as separate and independent controllers of your personal data. They will have their own privacy processes and practices when handling your personal data.

3. Personal data we collect

The personal data we collect depends on your relationship with us and the services you use. It can include:

Identity and contact

• Name, date of birth, gender, username/account identifiers

• Postal address, email address, telephone number

• Details of your nominated general practitioner or external health care provider

• Identity verification information (including a photo of your face and/or ID where required)

• In some cases, government-issued identifiers needed for eligibility, dispensing or verification

Health and care

• Health history and questionnaire responses, symptoms, diagnoses, allergies, medications, side effects and outcomes

• Measurements and progress data you provide (e.g. weight and other body measurements where relevant)

• Messages, notes, files and images you share with clinicians, pharmacies, coaches or support teams (including clinical photos where relevant)

• Audio recordings and transcripts of calls, chats or consultations where these are recorded

• Prescription and dispensing-related information

• Racial or ethnic origin information that may be relevant to your care

Community and content

• Information you provide in community spaces we operate or facilitate (e.g. posts, comments, profile details and interactions) including any health data you choose to share

Transaction, billing and fulfilment

• Subscription status, orders, deliveries, returns, cancellations and refunds

• Billing address and delivery address

• Payment-related data

Device, website and app

• Device identifiers, IP address, browser/app settings, operating system

• Website/app usage and event data (pages viewed, clicks, referral URLs, session data)

• App diagnostics, crash logs and performance data

• Approximate location (derived from IP address or device settings where available)

Connected devices and integrations

• Data from devices or third-party services you choose to connect (e.g. fitness trackers, smartwatches)

• Device/product identifiers needed to support integrations (e.g. serial number, Bluetooth address, similar identifiers)

Business and recruitment

• Business contact details (name, job title, employer, work contact details, correspondence)

• Application and employment-related information if you apply for roles with us

4. How we collect personal data

We collect personal data from:

• You (e.g. questionnaires, account set-up, support requests)

• Automatic technical sources (e.g. device/app/web data, cookies and similar technologies)

• Our group companies to provide goods and services

• Partners assisting with services (e.g. partner practitioners/companions/providers; labs/tests; partner communications)

• Connected devices/services you choose to link

• Publicly available sources and third parties (e.g. suppliers, recruitment agencies, contractors, business partners)

• Government/official sources where relevant to providing a service (e.g. NHS services, electronic prescription transfer services)

If we collect personal data about you from a third party, we may ask the third party (where appropriate) to inform you that we hold the information and how it will be used and disclosed.

5. How we use personal data

We use personal data for various purposes, including those summarised below:

Provide services and support

• Create and manage your account and preferences

• Run questionnaires, onboarding and eligibility checks, and assess suitability for services

• Facilitate telehealth consultations and related care support, including messaging, follow-ups and care coordination

• Provide coaching and service features (including any in-app support tools), and respond to enquiries

• Send service communications such as confirmations, reminders, safety notifications, changes to services, and support messages

• Monitor service quality, provide training, and investigate complaints or incidents (including recording or transcribing certain calls/consultations where relevant)

Fulfil orders and prescriptions

• Process orders, subscriptions, payments, refunds and chargebacks

• Arrange prescribing, dispensing and pharmacy fulfilment where applicable (including sharing necessary data with pharmacies and healthcare partners)

• Arrange delivery (e.g. courier/post), returns, replacements and customer support for orders

• Maintain dispensing and fulfilment records as required by applicable healthcare and pharmacy rules

• Monitor the safety of treatments and medicines, including clinical safety monitoring and pharmacovigilance, and meet related reporting obligations

Operate communities and improve products

• Operate and moderate online communities and related content spaces

• Support community activities (e.g. coaching, programmes, events, prompts and engagement)

• Conduct analytics, reporting and internal research and development to improve services, develop new products, debug issues, and understand how services are used

• Measure outcomes and performance, including service evaluation and quality improvement

Marketing and personalisation

• Send marketing communications (e.g. email, SMS, push notifications, telephone calls where permitted) about our brands, services, products and offers

• Personalise communications, recommendations and website/app experiences, including based on your interactions with our services and (where permitted) information you provide

• Run promotions, competitions and referral programmes (where offered)

• Measure marketing performance and improve targeting, including creating audience segments (such as "lookalike" audiences) and retargeting based on interactions with our emails, websites/apps, subject to your choices and regional requirements

• Depending on where you live, we send marketing communications either with your consent (an express opt-in) or, where local law permits, on the basis of an existing customer relationship for similar products or services (sometimes called a "soft opt-in"). You can opt out at any time.

Safety and welfare

• Identify and address safety risks, including detecting content or patterns that suggest potential harm

• Where necessary and appropriate, share relevant information with emergency services or other appropriate parties to request a welfare check or urgent assistance (for example, where there is a professional opinion of imminent risk of harm)

Legal, compliance and business operations

• Comply with legal and regulatory requirements (including healthcare, pharmacy, identity verification, reporting, tax and accounting obligations)

• Prevent, detect and investigate fraud, misuse, security incidents and other unlawful activity

• Establish, exercise or defend legal claims, manage disputes, and enforce terms

• Manage corporate transactions (such as mergers, acquisitions, restructuring, financing or insolvency), including due diligence and transition planning

• Maintain internal governance, risk management, audits, and insurance-related processes

6. Lawful basis

Where the law requires us to have a lawful basis for using your personal data, we rely on the bases below. More than one can apply at the same time.

• Contract: To provide services you request or to take steps at your request before entering a contract

• Legal obligation: To meet legal and regulatory requirements (including healthcare and pharmacy obligations)

• Legitimate interests: To improve the safety and quality of our services and develop new features, to protect our business and services, to prevent fraud and misuse, and to defend legal claims

• Consent: Where we ask for your permission to process your personal data for a specific purpose

• Vital interests: To protect someone's life or safety where they cannot give consent or it would not be appropriate to ask

We only use sensitive or special category data, including health data, where an additional condition applies or you have given your explicit consent.

To provide your care, we rely on the condition that allows health data to be used for healthcare purposes by people bound by a duty of confidentiality.

For anything beyond your care, such as connecting a wearable, joining a community, or personalised marketing, we ask for your explicit consent instead. You can withdraw it at any time, and doing so will not affect the care you receive.

7. Sharing personal data

Who we share personal data with

We may share personal data with:

• Our group companies for internal administration and service delivery

• Clinicians, healthcare professionals and clinical partners to provide consultations, treatment support and related services

• Pharmacies, dispensing partners and delivery providers to fulfil prescriptions and deliver products

• Technology and operational service providers (e.g. hosting, communications, customer support tools, analytics, security, identity verification, payment processors)

• Advertising partners for purposes of measuring or improving our marketing

• Professional advisers (e.g. legal, audit, insurance)

• Regulators, courts and law enforcement where required by law

• Successors to our business in connection with a merger, acquisition, restructuring or asset sale

International transfers

We and our service providers may store or process personal data in countries other than where you live, including the United States (where our parent company, Hims & Hers Health Inc. is based), Australia, and South Africa and the Philippines (where our international operational support and service delivery staff are based).

Where applicable law requires additional safeguards, we use appropriate technical and organisational measures to provide an adequate level of protection to the processing of your personal data.

Further region-specific information is in Annex A.

8. Recording of calls and consultations

Some calls, chats or consultations may be recorded or transcribed for purposes such as:

• Quality assurance and training

• Safety and incident management

• Maintaining records where required

• Investigating complaints or disputes

Where recording is optional and you do not want a recording to be kept, tell us (or the clinician) at the start of the call/consultation and we will handle this in line with the service and legal requirements.

If we request identity verification using a photo ID, you may be able to obscure non-essential details (for example, covering your licence number) unless we need the full image for a specific legal or safety reason.

9. Cookies, analytics and online advertising

We use cookies, SDKs, pixels and similar technologies (collectively "cookies") to:

• Operate and secure our websites and apps

• Remember preferences

• Understand usage and performance (analytics)

• Measure the effectiveness of campaigns

• Show you relevant adverts on third-party platforms

The information transmitted via cookies to third party platforms and within the Hims & Hers group is not just technical data and can include details such as: browsing specific webpages for health conditions and your progress in completing questionnaires to determine eligibility for consults relating to specific medical conditions.

Online advertising may involve:

• Using cookies to understand what content is useful and which ads lead to sign-ups or purchases

• Creating and using audiences (including "lookalike" audiences) using limited identifiers, typically in hashed or pseudonymised form

• Retargeting based on interactions with our websites/apps

Where required by law, we will obtain consent before placing non-essential cookies or transmitting any information about your use of our health-related pages to third parties, and you can manage preferences using our cookie banners/settings or your device or browser. In addition to opting out of cookies via your browser, you can opt out of the following third-party analytical tools we use via the instructions available at the links below:

10. AI features and machine learning

We may use AI-enabled tools (including large language models) to support and improve our services, for example to:

• Help triage and respond to support queries

• Retrieve relevant account or service information to assist with responses

• Generate or draft content and materials (including patient-facing materials where appropriate)

• Support certain in-app features such as chat-based assistance

These tools may process the content you provide (such as messages you send us). We use access controls and contractual measures intended to protect personal data, and we limit use to the purposes described in this notice and applicable law.

We may also use a limited amount of personal data, de-identified wherever possible, to train internal AI tools so we can:

• Improve the accuracy, safety, consistency and clinical relevance of outputs

• Detect and correct failure patterns (e.g. hallucinations, unsafe suggestions, missed escalation cues)

• Improve routing, moderation, and quality checks

• Support auditing, incident investigation, and service improvement

Where we use personal data for AI training and evaluation we:

• Aim to use the minimum personal data needed for these purposes

• Only use health or other special category data where we have your explicit consent, where it has been de-identified to a robust standard so that it no longer identifies you, or where the law otherwise permits this

• Apply access controls, security measures, and other controls designed to protect personal data

• Limit our use of personal data to purposes compatible with those set out in this notice

• Keep training/evaluation datasets only as long as needed for the relevant diagnostic, debugging, safety and improvement purposes, then delete or de-identify them in line with our retention approach

AI features are designed to support services and are not a substitute for professional medical advice.

We do not make decisions about your treatment, eligibility or access to our services by automated means alone. A qualified person reviews and decides, and you can contact us at any time about any decision that affects you. We may use some automated checks to assess basic eligibility requirements based on the terms and conditions or legal requirements that apply to our services.

11. Keeping your personal data safe

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. This includes access controls, security monitoring and controls over suppliers.

If you suspect unauthorised activity on your account, contact us using the details in Annex C.

12. How long we keep personal data

We keep personal data for as long as needed to:

• Provide services and maintain accounts

• Comply with legal and regulatory requirements (including healthcare and pharmacy record-keeping rules)

• Resolve disputes and enforce agreements

• Protect and improve our services

Retention periods vary based on the type of data, the service you use and applicable legal requirements.

Where we no longer need personal data, we delete or de-identify it in accordance with applicable law and operational constraints.

13. Your choices and rights

Depending on where you live, you may have rights to:

• Access personal data we hold about you

• Correct inaccurate or incomplete data

• Delete data or restrict processing in certain circumstances

• Object to certain processing (including direct marketing)

• Receive a copy of your data in a portable format (where applicable)

• Withdraw consent (where we rely on it)

• Complain, either directly to us or to the appropriate regulator

We may need to verify your identity before processing a rights request. We may also refuse requests or apply exemptions where permitted by law, and we will explain why where required.

Region-specific rights and processes are set out in Annex A.

14. How to contact us

For privacy enquiries, complaints, or to exercise your rights, contact the privacy team using the details in Annex C.

For customer service queries (such as cancellations or subscription support), use the customer support contact for your brand and country (also listed in Annex C).

15. Updates to this notice

We may update this notice from time to time. If changes are material, we will take reasonable steps to notify you (for example via the website, app or email). We also encourage you to check periodically for the latest version.

Annex A: Regional Requirements

This annex contains regional requirements that modify or add to the above notice.

Where there is any conflict between the above notice and these regional requirements, the regional requirements prevail.

United Kingdom

Healthcare regulation

Where healthcare services are provided through our UK platforms, the service is regulated by the Care Quality Commission (CQC) and our pharmacy service is registered with the General Pharmaceutical Council (GPhC).

NHS Summary Care Records

We meet NHS Data Security and Protection Toolkit (DSPT) requirements (organisation code O6P4Y).

Where appropriate for your care, our clinicians and/or pharmacy professionals may access your NHS Summary Care Record (SCR) to support safe prescribing and clinical decision-making. Your SCR is a summary drawn from your GP record and typically includes your current medicines, allergies, previous adverse reactions, and may also include additional clinical information such as significant medical history, immunisations, care plan information, and communication needs.

Before we access your NHS SCR, we will normally ask for your permission to view it a) at the point of care or b) by asking for extended permission to view on an ongoing basis. If you are unable to give permission, an authorised clinician or pharmacy professional may access the record where it is in your best interests. Access is role-based, limited to those involved in your care, and is logged and auditable.

Your GP practice remains the data controller for your GP medical record. If you want to exercise your data protection rights in relation to your GP record, you should contact your GP practice. Your GP practice can also help with your NHS SCR preferences (including opting out).

We are the data controller for any SNOMED-coded information we create or add to our records following access to your NHS SCR. You can also ask us for a record of who has accessed your NHS SCR.

For more information about NHS SCR, please visit NHS Digital's Information of Patients webpage.

International transfers

When we transfer personal data outside the UK, we rely on UK adequacy regulations to freely transfer the personal data or other recognised safeguards to ensure a sufficient level of protection, including UK International Data Transfer Agreements (IDTA) or European Commission standard contractual clauses with the UK addendum.

Diagnostics and testing services

We facilitate diagnostic and pathology services (such as blood testing) via third-party partners, including Randox Laboratories Ltd and Thriva Limited.

These services necessitate the collection and processing of your personal data, including Special Category Data (health history, biological samples, and test results), for analysis, interpretation, and clinical decision-making.

Biological samples may be provided in-clinic or using at-home testing kits.

For the data shared in connection with these services, we and the testing provider act as separate and independent data controllers, and the testing provider will handle your information according to their own privacy notices (linked below):

• Randox: https://www.randox.com/privacy-and-cookies

• Thriva: https://thriva.co/privacy-policy

Rights request timeframe and complaints

We normally respond to rights requests within 30 days (subject to permitted extensions).

If you have concerns regarding our processing activities or are not satisfied with our response to your privacy requests/concerns, you can complain to the Information Commissioner's Office (ICO) - https://ico.org.uk/

Annex B: Responsible Group Entities

This annex lists the responsible entities (i.e. data controllers) and the services they manage in relation to the processing of personal data.

United Kingdom

• Fill Function UK Limited - Employer, Consumer Services and Service Provider Contracts

• Juniper Technologies UK Limited - Service Provider Contracts

Annex C: Regional Contact Information

This annex lists the contact information for each region. For general privacy queries, you can also contact privacy@eucalyptus.vc

United Kingdom

• Customer Service: Hims: support@forhims.co.uk [confirm this is the right support address for the Fill Function Hims UK service]

• Address: 12 New Fetter Lane, London, United Kingdom, EC4A 1JP