Rebecca Hickey, individually and on behalf of all others similarly situated v. Futurehealth, Inc.

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 REBECCA HICKEY, individually and on Case No.: 25-cv-03051-H-DDL behalf of all others similarly situated, 12 ORDER GRANTING DEFENDANT’S Plaintiff, 13 MOTION TO DISMISS v. PLAINTIFF’S COMPLAINT WITH 14 LEAVE TO AMEND FUTUREHEALTH, INC., 15 Defendant. [Doc. No. 10.] 16

18 On January 16, 2026, Defendant Futurehealth, Inc. filed a motion to dismiss Plaintiff 19 Rebecca Hickey’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack 20 of subject matter jurisdiction and Rule 12(b)(6) for failure to state a claim, or, in the 21 alternative, to compel arbitration. (Doc. No. 10.) On March 20, 2026, Plaintiff filed a 22 response in opposition to Defendant’s motion. (Doc. No. 19.) On April 3, 2026, Defendant 23 filed a reply in support of its motion. (Doc. No. 20.) On May 4, 2026, the Court took the 24 matter under submission. (Doc. No. 22.) For the reasons below, the Court grants 25 Defendant’s Rule 12(b)(1) motion to dismiss for lack of subject matter jurisdiction with 26 leave to amend. 27 / / / 28 / / / 1 Background 2 The following background is based on the allegations in Plaintiff’s complaint. 3 Defendant owns and operates a website as a telehealth platform that provides virtual weight 4 loss consultations and prescription services for weight management medications. (Doc. 5 No. 1, Compl. ¶ 32.) The website allegedly requires users to submit detailed health 6 information through comprehensive onboarding quizzes before the user can create an 7 account, review any privacy policies, or access services. (Id. ¶ 36.) The website allegedly 8 contains numerous first- and third-party tracking implementations that measure and record 9 user data, including tracking pixels from third-party digital advertiser Taboola, Inc. 10 (“Taboola”). (Id. ¶¶ 37–38). Plaintiff alleges that when a user finishes an intake quiz on 11 the website and proceeds to purchase a product, Defendant transmits the user’s responses 12 to each of the questions in the intake quiz to Taboola. (Id. ¶ 66.) 13 Plaintiff, a resident of New York, New York, accessed Defendant’s website to seek 14 weight loss treatment in or around October 2024. (See id. ¶¶ 72–73.) Plaintiff alleges that 15 she “completed the initial qualification survey, which required her to input answer[sic] 16 sensitive questions about her health, including questions regarding previous surgeries, 17 weight loss goals, preexisting health conditions. She also entered her name, email address, 18 and personal[sic].” (Id. ¶ 74.) Plaintiff alleges that Defendant’s conduct violated her 19 privacy rights and she suffered harm. (Id. ¶ 80.) 20 On November 7, 2025, Plaintiff filed a complaint against Defendant, alleging claims 21 for: (1) violations of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 22 631 et seq; (2) violation of CIPA, Cal. Penal Code § 632 et seq; (3) violations of the 23 Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510 et seq; (4) violations 24 of the New York Deceptive Trade Practices Act (“NYDTPA”), New York Gen. Bus. Law 25 § 349 et seq; and (5) unjust enrichment. (See Doc. No. 1, Compl. ¶¶ 91–159.) By the 26 present motion, Defendant moves pursuant to Federal Rule of Civil Procedure 12(b)(1) to 27 dismiss Plaintiff’s complaint for lack of subject matter jurisdiction, and Defendant moves 28 pursuant to Federal Rule of Civil Procedure 12(b)(6) to dismiss Plaintiff’s complaint for 1 failure to state a claim. (Doc. No. 10-1 at 3–17.) Further, in the event the Court does not 2 dismiss the complaint in its entirety, Defendant moves to compel arbitration of all surviving 3 claims. (Id. at 17–22.) 4 Discussion 5 Defendant moves pursuant to Rule 12(b)(1) to dismiss Plaintiff’s complaint for lack 6 of subject matter jurisdiction. (Doc. No. 10-1 at 3.) Specifically, Defendant argues that 7 the Court should dismiss the complaint because Plaintiff has failed to plausibly allege an 8 injury-in-fact sufficient to confer Article III standing. (Id.) 9 I. Legal Standards for a Rule 12(b)(1) Motion to Dismiss 10 Federal Rule of Civil Procedure 12(b)(1) authorizes a court to dismiss claims for 11 lack of subject matter jurisdiction. “Rule 12(b)(1) jurisdictional attacks can be either facial 12 or factual.” White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the 13 challenger asserts that the allegations contained in a complaint are insufficient on their face 14 to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the 15 truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” 16 Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). 17 Here, Defendant’s Rule 12(b)(1) motion to dismiss focuses solely on the allegations 18 in Plaintiff’s complaint, and, thus, Defendant makes a facial attack under Rule 12(b)(1). 19 (See Doc. No. 10-1 at 3–8.) “In deciding a Rule 12(b)(1) facial attack motion, a court must 20 assume the facts alleged in the complaint to be true and construe them in the light most 21 favorable to the nonmoving party.” Strojnik v. Kapalua Land Co. Ltd., 379 F. Supp. 3d 22 1078, 1082 (D. Haw. 2019) (citing Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 23 1139 (9th Cir. 2003)); see Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa 24 Cty., 343 F.3d 1036, 1039 (9th Cir. 2003); Rimac v. Duncan, 319 F. App’x 535, 536 (9th 25 Cir. 2009). But a court need not accept as true conclusory allegations. See Winsor v. 26 Sequoia Benefits & Ins. Servs., LLC, 62 F.4th 517, 525 (9th Cir. 2023). 27 / / / 28 / / / 1 II. Analysis 2 Defendant argues that the Court should dismiss the complaint because Plaintiff has 3 failed to plausibly allege an injury-in-fact sufficient to confer Article III standing. (Doc. 4 No. 10-1 at 3.) Article III of the Constitution “confines the federal judicial power to the 5 resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 594 U.S. 413, 6 423 (2021). “For there to be a case or controversy under Article III, the plaintiff must have 7 a personal stake in the case—in other words, standing.” Id. 8 “[T]he ‘irreducible constitutional minimum’ of standing consists of three elements.” 9 Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 10 504 U.S. 555, 560 (1992)). To establish standing, “a plaintiff must show (i) that he suffered 11 an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury 12 was likely caused by the defendant; and (iii) that the injury would likely be redressed by 13 judicial relief.” TransUnion, 594 U.S. at 423 (citing Lujan, 504 U.S. at 560–61). 14 “The plaintiff, as the party invoking federal jurisdiction, bears the burden of 15 establishing these elements.” Spokeo, 578 U.S. at 338; accord Popa v. Microsoft Corp., 16 153 F.4th 784, 788 (9th Cir. 2025). Further, “‘[t]hat a suit may be a class action . . . adds 17 nothing to the question of standing, for even named plaintiffs who represent a class must 18 allege and show that they personally have been injured, not that injury has been suffered 19 by other, unidentified members of the class to which they belong.’” Spokeo, 578 U.S. at 20 338 n. 6 (quoting Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 40, n.20 21 (1976)); accord Lewis v. Casey, 518 U.S. 343, 357 (1996). 22 To establish the first element of standing, “injury in fact,” “a plaintiff must show 23 that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and 24 particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 25 U.S. at 339 (citing Lujan, 504 U.S. at 560). “A “concrete” injury must be ‘de facto’; that 26 is, it must actually exist.” Id. at 340. A concrete injury must be “real” and not “abstract.” 27 Id. 28 “[C]ertain harms readily qualify as concrete injuries under Article III. The most 1 obvious are traditional tangible harms, such as physical harms and monetary harms.” 2 TransUnion, 594 U.S. at 425. “Various intangible harms can also be concrete.” Id.; see 3 Spokeo, 578 U.S. at 340. “Chief among them are injuries with a close relationship to harms 4 traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for 5 example, reputational harms, disclosure of private information, and intrusion upon 6 seclusion.” TransUnion, 594 U.S. at 425. 7 Importantly, “‘Article III standing requires a concrete injury even in the context of 8 a statutory violation.’” TransUnion, 594 U.S. at 426 (quoting Spokeo, 578 U.S. at 341). 9 The Supreme Court “has rejected the proposition that ‘a plaintiff automatically satisfies the 10 injury-in-fact requirement whenever a statute grants a person a statutory right and purports 11 to authorize that person to sue to vindicate that right.’” Id. A legislature’s creation of a 12 statutory prohibition or obligation and a cause of action does not relieve courts of their 13 responsibility to independently decide whether a plaintiff has suffered a concrete harm 14 under Article III. Id.; see also Popa, 153 F.4th at 792 (“TransUnion clearly cautions courts 15 not to treat an injury as concrete for Article III purposes based only on Congress’s say- 16 so.”). “[U]nder Article III, an injury in law is not an injury in fact.” TransUnion, 594 U.S. 17 at 427. 18 Here, Plaintiff alleges several privacy act claims against Defendant. (See generally 19 Doc. No. 1, Compl. ¶¶ 91–159.) In TransUnion, the Supreme Court explained that 20 “disclosure of private information” type harms can be sufficiently concrete to confer 21 Article III standing. 594 U.S. at 425. Further, in a recent case, Popa v. Microsoft, the 22 Ninth Circuit explained what kind of harm is similar to the types of harm recognized by 23 common law privacy torts. 24 To show intrusion upon seclusion, a plaintiff must show an intentional interference with his interest in solitude or seclusion, either as to his person or 25 as to his private affairs or concerns, of a kind that would be highly offensive 26 to a reasonable man. Similarly, a claim for public disclosure of private facts requires that a defendant gives publicity to a matter that concerns the private 27 life of another, that the information is highly offensive to a reasonable person, 28 and that the information is not of legitimate public concern. 1 Popa, 153 F.4th at 791; see also, e.g., Khamooshi v. Politico LLC, No. 24-CV-07836-SK, 2 2025 WL 2822879, at *3 (N.D. Cal. Oct. 2, 2025) (applying Popa to an Article III standing 3 analysis of privacy claims brought under CIPA). 4 Here, Plaintiff asserts that the unauthorized disclosure of medical information is 5 highly offensive to a reasonable person and is sufficient to constitute a concrete privacy- 6 based injury-in-fact under the Ninth Circuit’s decision in Popa. The Court agrees that the 7 unauthorized disclosure of medical information is sufficient to constitute an injury-in-fact 8 under Popa. See, e.g., Semien v. PubMatic Inc., 2026 WL 216333, at *4 (N.D. Cal. Jan. 9 27, 2026) (finding Article III standing where the defendant allegedly intercepted 10 communications that included “health status and treatment, travel plans, political 11 affiliation, sexual orientation, and more”); see also Garcia v. Blackhawk Network, Inc., 12 No. 2:25-CV-07550-JLS-SSC, 2026 WL 925028, at *5 (C.D. Cal. Apr. 1, 2026) 13 (explaining that use of a tracking technology “may result in highly offensive conduct” 14 where “the information collected could be especially sensitive, for example health or 15 financial information”). 16 But the allegations in the complaint are insufficient to adequately allege that 17 Defendant disclosed Plaintiff’s medical information to a third-party. In explaining how 18 Defendant’s website works, Plaintiff alleges: “When a user finishes [the] intake quiz and 19 proceeds to purchase a product, Defendant transmits the user’s responses to each of these 20 questions to Taboola in a JSON Web Token (JWT) embedded within the checkout page 21 URL.” (Doc. No. 1, Compl. ¶ 66.) Here, Plaintiff alleges that the information at issue is 22 only transmitted to third-party Taboola once the user proceeds to purchase a product. This 23 is of consequence here because, in the complaint, Plaintiff only alleges that she accessed 24 the website and “completed the initial qualification survey.” (Doc. No. 1, Compl. ¶¶ 73– 25 74.) Plaintiff never alleges that she proceeded to purchase a product from Defendant’s 26 website. (See generally id. ¶¶ 72–80.) As such, Plaintiff’s allegations are insufficient to 27 allege that Defendant disclosed her medical information to Taboola or anyone else, 28 meaning Plaintiff has failed to adequately allege a privacy-based harm sufficient to confer 1 || Article III standing. 2 In sum, Plaintiff has failed to adequately allege sufficient facts demonstrating that 3 ||she has suffered a “concrete” injury in fact. Because Plaintiff has failed to adequately 4 allege that she has Article III standing, the Court must dismiss her complaint for lack of 5 subject matter jurisdiction.! See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 6 |}2011) (“[L]ack of Article III standing requires dismissal for lack of subject matter 7 ||jurisdiction.”). 8 Conclusion 9 For the reasons above, the Court grants Defendant’s motion to dismiss Plaintiffs 10 ||complaint for lack of subject matter jurisdiction. The Court’s dismissal of □□□□□□□□□□□ 11 || complaint is without prejudice and with leave to amend. See Telesaurus, 623 F.3d at 1003. 12 || Plaintiff may file a first amended complaint consistent with the analysis set forth in this 13 || order within 30 days from the date this order is filed. 14 IT IS SO ORDERED. 15 || DATED: May 14, 2026 | | wal | | | 16 MARILYN W. HUFF, Distri ge 17 UNITED STATES DISTRICT COURT 18 19 20 21 22 23 24 Mio Because the Court dismisses Plaintiff s complaint for lack of subject matter jurisdiction based on lack of Article III standing, the Court declines to address the other 27 || grounds for dismissal raised in Defendant’s Rule 12(b)(6) motion to dismiss, and the Court 28 weeunes 5 address Defendant’s motion to compel arbitration. (See generally Doc. No. 10-