The Federal Trade Commission (FTC) is suing Telehealth company Hims & Hers over allegations that it shared customers’ sensitive health data with advertising platforms and misled them about billing and cancellations
Hims & Hers (H&H), which offers online treatments for conditions including male pattern baldness, erectile dysfunction, obesity, and mental health disorders, shared “sensitive health information about medical conditions with Meta, Snap, and more,” according to the FTC’s complaint [PDF]
H&H shared “lists of certain customers” with the advertising platforms and transmitted health information through online tracking technologies, the FTC alleges
For those suddenly overcome with a sense of déjà vu, yes, we have been here before. The regulator accused the company of failing to honor its promise to provide a private and secure service to consumers.
The complaint reads: “Hims has also assured consumers that Hims’ platform offers consumers a ‘100 percent online, private, and secure’ process and that consumers’ sensitive health information would only be accessed by Hims’ medical providers – leading consumers to believe that Hims would not disclose consumers’ health information to third parties without their consent. But those assurances were false or misleading.”
The Register contacted Hims for its response to the allegations, filed in the US District Court for the Northern District of California, but it did not immediately respond. It did, however, publish a blog post titled “Our Commitment to Privacy” on the day the FTC filed its sueball
The post mentions nothing about the FTC nor any lawsuits filed against the company, but instead serves as a reminder to consumers to review the Hims & Hers privacy policy to understand more about its data practices
“Beyond those disclosures, our internal practices are designed to protect your information,” the post reads.
“For example, we separate and exclude information that patients share with their healthcare providers from marketing activity, configure technologies to prevent the transmission of protected health information, and use measures such as abstraction and hashing to reduce identifiable information, among other protective actions.”
It also reminded consumers that they can change their preferences governing how their personal information is used
Bad billing
H&H’s statement addressed privacy but not the FTC’s allegations about its billing practices
The company’s websites tell customers they will be able to consult a medical provider about potential treatments. Customers must then complete an intake form and provide payment details, accompanied by assurances that they will not be charged unless medication is prescribed
The FTC alleges that most customers instead receive no consultation or opportunity to approve the recommended treatment before it is prescribed, at which point they are charged and enrolled in a recurring subscription
MORE CONTEXT
FTC: BetterHelp pushed users to share mental health info then gave it to Facebook
You’re too dumb to use click-to-cancel, Big Biz says with straight face
FTC to probe whether Microsoft’s cloud clout crosses the line
Media giant settles for $930k with FTC over allegations it lied about eavesdropping on conversations through smart devices
Further, Hims & Hers is accused of failing to clearly communicate when customers’ prescriptions will be refilled, which prevents them from cancelling their service before being charged for potentially months’ worth of medications
Before April 2023, most customers had to contact customer service by phone, email, or online chat to cancel. Hims & Hers then introduced website cancellations for most customers, although not through its mobile apps, but the FTC alleges that the cancellation option remained buried within a confusing and unintuitive process
According to the complaint, consumers need to enter an account section for adding/removing medications from their subscriptions and uncheck all the medications prescribed to them before the cancel button appears
“Even after clicking the ‘cancel subscription’ button, the consumer’s subscription would not be cancelled,” the complaint alleges. “Instead, the consumer would then have to click through approximately three to ten survey questions – each its own page or screen – and reaffirm that they wished to cancel before Hims accepted their cancellation request.”
With the lawsuit, the FTC, along with partners from California and Utah, says it is looking to obtain injunctions to put an end to the company’s problematic business practices. They also seek monetary relief for affected consumers, plus civil penalties for violations of consumer protection laws
“The FTC’s complaint lays out a troubling scenario – consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent,” said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection.
“The FTC will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private.” ®
