Cloudflare × Hims & Hers
Solution concept · Not affiliated
MedMatch needs a substrate as governed as the prescription it informs

Every intake. Every ML call.
Every provider decision.
One audited edge.

MedMatch runs a recursive ML loop over 5 million anonymized patient data points to surface medication recommendations to licensed providers. Cloudflare is the substrate above the model calls (AI Gateway audit + PII redaction), underneath the training data (R2 zero-egress storage), and around the provider workflow (Zero Trust access) that HIPAA-adjacent AI demands.

Same discipline as the prescription. Same audit trail as the EMR. Cloudflare-native.

Cloudflare footprint today
✓www.hims.com (CF CDN)
✓app.hims.com (multi-CDN)
✓support.hims.com
Security posture
ASecurity headers grade
✓HSTS + CSP + XFO + XCTO
✓Referrer + Permissions
Stack signals
✓AWS Route 53 DNS
✓Fastly on apex (~10 min TTL)
✓Proofpoint email
MedMatch signal
5MAnonymized data points
RTReal-time inference
HILHuman-in-the-loop

Public DNS + HTTP header recon. Names not affiliated with Hims & Hers.

The MedMatch loop, layer by layer

Four steps in Hims' own words. One Cloudflare product mapped to each — additive to the EMR and multi-cloud stack you already run.

1
Data Ingestion
Patient completes digital intake — demographics, symptoms, medical history, self-reported metrics.
Workers + WAF
2
ML Analysis
MedMatch runs intake against 5M anonymized data points, predicts efficacy + side effects.
AI Gateway + R2
3
Provider Surfacing
Top recommendations surface to the licensed provider in the custom EMR interface.
Zero Trust
4
Clinical Decision
Provider reviews AI insights alongside patient record — independent prescribing decision.
Audit + Logs

Where Cloudflare fits without disrupting the EMR

Two lanes. Security & compliance around MedMatch. Delivery acceleration under it. Additive to your existing multi-cloud stack.

1
Securing MedMatch and patient data
📜
Compliance foundation
HIPAA + BAAs
Cloudflare executes Business Associate Agreements with enterprise healthcare platforms. Transit data carrying sensitive biometric or health markers is processed under statutory privacy guidelines — the compliance foundation MedMatch data flows require.
🔗
EMR-to-model boundary
API Shield
MedMatch is an algorithmic decision layer talking to the custom EMR over APIs. API Shield enforces mutual TLS (mTLS) authentication + schema validation so only authorized endpoints can push or pull patient data.
🛡️
Model + patient data
WAF + Bot Management
ML models block malicious scraping attempting to brute-force patient histories or reverse-engineer MedMatch's proprietary recommendation logic. Same posture as the EMR itself.
🔐
Provider workflow
Zero Trust Access
Licensed providers access MedMatch insights through Cloudflare Access — identity-aware, contextual authentication with least-privilege. No clumsy corporate VPN in the workflow.
🧠
Above the model
AI Gateway
Every ML call MedMatch makes passes through one policy plane. Per-call PII redaction, provider fallback if the primary model degrades, cost attribution per cohort, unified audit log auditors can query.
💾
Under the dataset
R2 Object Storage
5M anonymized data points and model artifacts need storage that versions cleanly and doesn't tax cross-region reads. S3-compatible, zero egress — sits alongside AWS storage, additive not displacing.
2
Accelerating and optimizing delivery
🚀
Real-time inference latency
Argo Smart Routing
MedMatch analyzes 5M+ customer touchpoints in real time during intake. Argo routes dynamic web requests across the fastest, least-congested internet paths — cutting server response latency for the provider-facing surface.
⚡
Intake experience
Cloudflare Workers
Basic triage logic, data masking, format rules run at the edge close to the patient — no round-trip to a centralized origin for every minor user action. The intake form feels instant.
🌐
Uptime under traffic spikes
Anycast DDoS Mitigation
Sudden influxes — weight loss campaign traffic, mental health request spikes, viral moments — get absorbed by the Anycast network. MedMatch stays online. Providers stay unblocked.

Regulated AI needs the same discipline as regulated prescribing. Cloudflare is the substrate that makes both defensible.

MedMatch is a real product. This concept illustrates how Cloudflare could sit above, below, and around it — without replacing what already works.