The Federal Trade Commission announced on July 29, 2026 that it and state/local partners filed a federal complaint against telehealth provider Hims & Hers. The complaint alleges that Hims shared sensitive health information with advertising platforms such as Meta and Snap despite privacy representations, charged many consumers soon after intake forms were submitted, enrolled consumers in recurring prescription plans, and made cancellation difficult.
Those are allegations, not a court finding. But the owner-level lesson does not have to wait for a final ruling. If a business collects sensitive information, uses tracking pixels or ad-platform audiences, promises privacy, and charges customers through an online workflow, those pieces need to be reviewed together. Privacy cannot live in one document while marketing, checkout, and customer support operate from a different playbook.
The business risk is the gap between promise and plumbing
Healthcare practices, wellness providers, med spas, therapy groups, direct-to-consumer health services, membership businesses, and other recurring-service companies often depend on the same digital stack: intake forms, scheduling tools, payment processors, analytics tags, advertising pixels, email platforms, customer portals, and help-desk systems. Each tool may look ordinary on its own. Together, they can move sensitive data in ways the owner may not see.
The FTC's complaint puts that plumbing in focus. The agency alleges that health-related information was shared with advertising platforms through customer lists and tracking technologies while consumers were told their privacy would be protected. For a New Jersey healthcare or wellness business, the practical question is not whether its facts match Hims & Hers. The question is whether anyone has confirmed what the website, ads, forms, payment flow, and cancellation process actually do.
Checkout and cancellation are part of the privacy review
Many owners think of privacy as a policy-page issue. Regulators tend to look at the whole customer experience. If the intake form asks for health details, the checkout screen requests payment information, the subscription renews automatically, and cancellation is hard to find, the business has more than a marketing problem. It has an evidence problem.
That evidence includes what the customer was told before being charged, what consent was collected, which third-party tools received data, how recurring billing was disclosed, and whether cancellation instructions were easy to use. The most uncomfortable findings usually appear when those records are scattered across the website vendor, marketing agency, payment provider, EHR or practice-management system, and internal staff.
Questions owners should ask
- Which tracking pixels and analytics tags run on sensitive pages? Review intake forms, appointment pages, payment pages, portals, landing pages, and thank-you pages, not just the home page.
- What data is sent to advertising or analytics vendors? Ask whether events, URLs, form fields, customer lists, hashed identifiers, or purchase details are shared with platforms such as social media ad networks.
- Do privacy promises match the actual setup? Compare the privacy policy, ad copy, intake language, consent notices, and vendor configuration.
- When is the customer charged? Make sure checkout language clearly explains whether payment happens before or after consultation, approval, fulfillment, or enrollment.
- How does recurring billing work? Confirm renewal timing, refill timing, notices, receipts, and the owner's ability to prove what the customer saw.
- Can a customer cancel without a maze? Document the cancellation path, test it, and keep proof that it works across web, mobile, email, phone, and support channels where applicable.
- Who owns vendor oversight? Assign responsibility across marketing, IT, compliance, operations, and outside vendors so no one assumes another party checked the data flow.
A practical next step
Start with a sensitive-page inventory. List the website pages and digital workflows where customers provide health, wellness, financial, identity, or other sensitive information. Then ask your website vendor, marketing agency, IT provider, and payment or practice-management vendor to identify every tracking tool, form integration, audience upload, automation, and recurring-billing step connected to those pages.
The goal is not to panic or remove every tool by default. The goal is to make privacy claims, marketing behavior, checkout language, and subscription operations line up before a customer complaint, regulator inquiry, or vendor dispute forces the review. Health privacy promises are easier to defend when the business can show how the promise was built into the system.
Sources and further reading
