Privacy Policy

1. Data we collect

We collect personal information that is reasonably necessary to operate and improve FEMSTATE, provide requested services and recommendations, fulfill orders, communicate with you, maintain the security of our services and comply with applicable law.

• Account information When you create an account, we may collect your name, email address and authentication information. Authentication is provided through Supabase Auth. Femstate does not directly store your password in readable form.
• Quiz and cycle information When you complete the FEMSTATE quiz, we may collect information you voluntarily provide, including your:
• age range;
• life stage;
• menstrual-cycle timing;
• date of your most recent period;
• symptoms;
• wellness goals;
• nutritional preferences; and
• other information you choose to provide.
• We may use this information to generate health- or wellness-related inferences, including an estimated cycle phase and corresponding FEMSTATE product or wellness recommendations.
• Daily check-ins If you choose to use daily check-ins, we may collect information such as mood, energy, symptoms and free-text notes you voluntarily provide. Daily check-ins are optional.
• Order and subscription information We collect information relating to your purchases, including products ordered, transaction history, shipping information and subscription status.
• Payment-card information is processed by third-party payment providers such as Stripe. Femstate does not directly store full payment-card numbers on its own servers.
• Communications If you contact us, we may collect the information contained in your message together with information reasonably necessary to respond to and manage your request.
• Newsletter and marketing sign-ups If you sign up to receive marketing communications, we may collect your email address together with information regarding your subscription request, including the form used, language preference, date of signup, confirmation status and unsubscribe history.
• We may retain certain records to demonstrate and honor your communication preferences.
• Approximate location We may receive information that allows us or our service providers to estimate your general country or region.
• Unless otherwise disclosed, FEMSTATE does not intentionally collect precise GPS location through the website.
• Website and usage information We may collect information about how visitors interact with FEMSTATE, including pages viewed, approximate time spent on pages, device or browser information and other usage information.
• Where required, non-essential analytics technologies are activated only after appropriate consent.

2. Consumer health data

Certain information processed by FEMSTATE may constitute consumer health data under applicable law. Consumer health data may include information you provide about:

• menstrual-cycle timing;
• symptoms;
• life stage;
• mood;
• energy;
• wellness concerns; and
• other health- or wellness-related information.
• It may also include health-related inferences we derive from that information, such as an estimated cycle phase or corresponding product or wellness recommendation. We treat consumer health data as sensitive information and apply additional safeguards and limitations to its use. We do not disclose consumer health data for targeted or cross-context behavioral advertising. We do not sell consumer health data. We disclose consumer health data only as described in this Privacy Policy and our Consumer Health Data Privacy Notice , with your authorization or consent where required, or as otherwise permitted or required by applicable law. Where technically implemented, session-recording technologies are disabled on areas of the website that collect consumer health data, and form inputs are masked or otherwise excluded from recording. We do not use consumer health data to make decisions that produce legal or similarly significant effects concerning you. Residents of jurisdictions that provide additional rights relating to consumer health data may exercise those rights as described in our Consumer Health Data Privacy Notice.

If you are a resident of Washington State or Nevada, you have additional rights over this data. See our Consumer Health Data Privacy Notice.

3. Cookies and analytics

We use cookies and similar technologies to operate the website, maintain account sessions, support the shopping experience, understand website performance and, where permitted, measure marketing effectiveness.

Essential technologies

Certain cookies and technologies are necessary for core website functionality, including authentication, account access, security and checkout.

These technologies may operate without consent where permitted by applicable law.

Analytics technologies

Where consent is required, analytics and non-essential technologies are activated only after you provide the applicable consent. If you decline non-essential cookies, we will not intentionally activate those technologies through our consent-management system. You may adjust available cookie preferences using our website privacy controls.

Global Privacy Control

Where required by applicable law, we recognize supported browser-based opt-out preference signals, including the Global Privacy Control ("GPC"), as a request to opt out of the sale or sharing of personal information for the browser or device through which the signal is communicated.

Additional information is available through our Your Privacy Choices / Do Not Sell or Share My Personal Information page, where applicable.

Your Cookie Choices

You can use the cookie or privacy controls available on our website to accept or reject non-essential cookies and similar technologies where those choices are available. Essential technologies required for authentication, security, checkout and core website functionality may operate regardless of your preference where permitted by law. Changing your cookie preferences does not necessarily delete cookies already stored on your device. You may also use your browser settings to view, block or delete cookies. Where required by applicable law, we recognize supported browser-based opt-out preference signals, including Global Privacy Control, as described in our Your Privacy Choices page.

Analytics providers

Depending on your consent choices and our current technology configuration, we may use providers such as:

PostHog — product analytics, including information about how visitors move through the website and where users may discontinue a process. Where session recording is enabled, we configure the service to exclude sensitive areas and mask form inputs as appropriate.

Microsoft Clarity — website analytics, heatmaps and session-replay functionality, subject to our consent controls and configuration.

Vercel Web Analytics — website traffic and page-view analytics.

Google Analytics — page-view measurement, used to understand how much traffic our advertising brings. It is not loaded on the quiz, account or contact pages.

Attribution

We may use first-party technologies to understand which marketing campaigns or referral sources bring visitors to FEMSTATE. Where required by law, these technologies are used only after the appropriate consent has been obtained.

Advertising and marketing measurement (only if you choose “Accept all”)

Advertising is a separate choice in our cookie banner and stays switched off unless you choose “Accept all”. These technologies are never loaded on the quiz, account or contact pages, and they receive no information about your cycle, symptoms, life stage or formula:

Meta pixel — measures which ads bring visitors to FEMSTATE. It places Meta's own cookies (`_fbp` and `_fbc`, approximately 90 days) that identify the browser or device. When you buy, we also send Meta a server-side record with the amount, the currency, an order reference and the plan name, with your contact details converted into an irreversible code before they are sent.

FrontrowMD — measures how its “Clinicians' Choice” badge performs on our home page and plan cards. Its script keeps an identifier for your browser (`frontrow_visitor_token` and `frontrow_visit_token`), places FrontrowMD's own cookies (`ahoy_visitor`, approximately 2 years, and `ahoy_visit`, approximately 1 hour) that FrontrowMD uses to recognize the same browser on other websites that display its badges, and tells FrontrowMD the page address (including any campaign tags), when the badge is viewed or clicked, and when a buy button is clicked, with that button's text. The badge itself is displayed to all visitors: without “Accept all” it loads without this measurement and stores nothing on your device, although, like any embedded content, loading it lets FrontrowMD and Google, whose fonts it uses, see technical information such as your IP address and browser.

If your browser sends the Global Privacy Control signal, we honour it: nothing loads, no attribution cookie is written and our own usage counters do not record — even if you had accepted before on that browser. The signal wins. The full detail is on Do Not Sell or Share My Personal Information.

If you accept, these are the tools that load and what each one does:

4. How we use your data

• We use personal information for purposes including:
• Providing FEMSTATE services We may use account, quiz, cycle and wellness information to provide requested educational information, estimated cycle-phase insights and
• FEMSTATE product recommendations.
• Processing purchases We use order, payment, contact and shipping information to process purchases, fulfill orders, administer subscriptions, process returns and refunds, and provide customer support.
• Communications We use contact information to send transactional communications such as order confirmations, subscription notices, account communications and other messages relating to services you requested. If you consent to marketing communications, we may also send educational content, product information and promotional communications.
• Product and service improvement We may use information to understand how FEMSTATE is used, improve the website and customer experience, develop products and content, and understand consumer needs and demand.
• Where possible and appropriate, we may use aggregated or de-identified information for these purposes.
• Security and fraud prevention We may process information to protect accounts, detect or prevent fraud and abuse, secure our systems, investigate suspicious activity and enforce our terms.
• Legal and regulatory purposes We may process information as reasonably necessary to comply with applicable legal obligations, respond to lawful requests, maintain required records and establish, exercise or defend legal claims.

Where applicable law requires consent for a particular use of personal information or consumer health data, we will obtain that consent.

5. Email communications

Transactional communications We may send emails that are necessary to provide services you request, such as account communications, requested guides, order confirmations, shipping information, subscription notices and customer-support messages.

Marketing Communications and Opt-Outs You may unsubscribe from FEMSTATE marketing emails at any time by using the unsubscribe link included in the message or by contacting us at support@femstate.me. We may retain limited information about your opt-out request as necessary to maintain a suppression record and ensure that we honor your communication preference. Unsubscribing from marketing communications does not prevent us from sending non-marketing communications that are reasonably necessary to provide services you requested, including order, shipping, account, subscription, security and customer-service communications.

Double opt-in Where we use double opt-in, submitting your email address does not immediately enroll you in marketing communications. We may first send a confirmation message asking you to verify your request. If the confirmation is not completed, we may delete or expire the pending subscription record according to our retention practices.

Email analytics Our email providers may provide technical information about email delivery and engagement, such as whether a message was delivered, bounced or interacted with. The availability and accuracy of this information may depend on the recipient's email provider, device and privacy settings.

6. Service providers and other disclosures

We use service providers to operate FEMSTATE and provide requested products and services. Our service providers process personal information on our behalf subject to contractual terms and applicable law. Their permitted processing depends on the services they provide and our agreements with them. Current providers may include:

• Supabase Supabase provides database infrastructure and authentication services and may store account information, quiz information, consumer health data and other information associated with your use of FEMSTATE.
• Stripe Stripe provides payment and subscription-billing services. Stripe may receive information such as your name, email address, billing information, order information and the product or subscription you purchase.
• Femstate does not intentionally provide Stripe with menstrual-cycle dates, symptom logs or daily check-in information unless disclosure is necessary for a service you specifically request and is otherwise permitted by law.
• Resend Resend provides email-delivery services. Depending on the communication you request, Resend may process your email address and the content of messages sent to you. Where practical, FEMSTATE may limit the amount of sensitive wellness information included directly in email communications.
• Vercel Vercel provides website hosting, storage, infrastructure and website-performance services.
• PostHog and Microsoft Clarity Where enabled in accordance with our consent controls, these providers may process website analytics information. We configure analytics tools to limit the collection of consumer health data and other sensitive form information.
• Upstash Upstash may provide infrastructure functions such as rate limiting, security or performance support.
• Legal and safety disclosures We may disclose personal information where reasonably necessary to:
• comply with applicable law, legal process or governmental requests;
• protect the rights, safety or property of FEMSTATE, our customers or others;
• prevent fraud or abuse;
• investigate security incidents; or
• establish, exercise or defend legal claims.
• Business transactions If Femstate LLC is involved in a merger, acquisition, financing, reorganization, sale of assets or similar transaction, personal information may be transferred as part of that transaction subject to applicable law. Where required, we will provide notice or obtain consent before materially changing the purposes for which consumer health data is processed.

Two companies are not on that list because they are not our service providers: Meta and FrontrowMD decide for themselves how they use what they receive, so they are third parties, and they receive data only if you choose “Accept all” in the cookie banner. Sections 3 and 7 say exactly what each one receives.

7. We do not sell consumer health data

Femstate does not sell consumer health data. We do not disclose consumer health data for targeted or cross-context behavioral advertising.

We disclose consumer health data only as described in this Privacy Policy and our Consumer Health Data Privacy Notice, with your authorization or consent where required, or as otherwise permitted or required by applicable law.

With respect to other personal information, Femstate does not currently sell personal information for monetary consideration.

If you choose “Accept all” in our cookie banner, we share limited browsing and purchase information with Meta, for advertising measurement, and with FrontrowMD, for measuring its “Clinicians' Choice” badge, as described in section 3. Some state privacy laws treat that as “sharing” for cross-context behavioral advertising. You can stop it at any time by choosing “Analytics only” or “Reject all” in the cookie banner, from our Your Privacy Choices page, or by enabling Global Privacy Control, which we honor automatically and which overrides any earlier acceptance.

Some privacy laws define "sale" or "sharing" more broadly and may include certain advertising or analytics activities even when no money changes hands. Where applicable, we provide legally required opt-out mechanisms through our privacy controls.

8. How long we keep personal information

• We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing services, maintaining records, fulfilling transactions, complying with legal obligations, resolving disputes and enforcing agreements. Retention periods may vary depending on the type of information and the reason we collected it.
• Account and wellness information We generally retain account information and information associated with an active account while the account remains open. If you close an account, we may retain limited information for a reasonable period for security, fraud prevention, backup integrity, legal compliance and dispute-resolution purposes. A request to close an account is not necessarily the same as exercising a statutory right to delete personal information or consumer health data. Where you exercise an applicable deletion right, we process the request in accordance with applicable law and our Consumer Health Data Privacy Notice.
• Orders and transaction records We may retain order, payment, tax and accounting records for the period reasonably necessary to comply with legal, tax, accounting, fraud-prevention and recordkeeping obligations.
• Quiz information without an account We retain quiz information collected without an account only for as long as reasonably necessary for the purpose for which it was collected and according to our applicable retention schedule.
• Marketing information We retain marketing contact information while you remain subscribed. If you unsubscribe, we may retain a limited suppression record for as long as necessary to ensure that we honor your opt-out request.
• Analytics information Analytics information is retained according to our configuration with the applicable analytics provider and our internal retention practices. We may retain aggregated or de-identified information for longer periods where it can no longer reasonably be linked to you.

9. Your privacy rights

Depending on where you live and whether the applicable privacy law applies to Femstate, you may have rights regarding your personal information.

Femstate also voluntarily provides certain privacy choices to users even where a particular legal right may not apply.

You may request that we:

1) provide access to personal information we maintain about you;

2) correct inaccurate personal information; delete certain personal information;

3) provide certain information in a portable format;

4) withdraw consent where processing is based on consent; or

5) honor other rights available under applicable law.

To submit a privacy request, contact us through our contact page or email support@femstate.me.

We may need to verify your identity before completing certain requests.

We will respond within the timeframe required by applicable law and generally aim to respond within 45 days.

Where applicable law provides an appeal right, you may appeal a decision we make regarding your privacy request by contacting us and stating that you wish to appeal our decision. We will not unlawfully discriminate against you for exercising an applicable privacy right.

Residents of certain states, including Washington and Nevada, may have additional rights relating specifically to consumer health data. Please review our Consumer Health Data Privacy Notice.

10. Age limitations

FEMSTATE accounts, personalized features and products offered through this website are intended for adults age 18 and older unless we expressly state otherwise for a particular service or product.

We do not knowingly collect personal information through these services from individuals under 18.

If we learn that personal information has been submitted by an individual who is not eligible to use the relevant service, we may take reasonable steps to delete or restrict that information as appropriate.

If you believe an individual under 18 has provided personal information to FEMSTATE, please contact support@femstate.me.

11. Where personal information is processed

Femstate LLC is based in the United States, and our service providers may process personal information in the United States and other locations where they operate.

If you access FEMSTATE from outside the United States, your personal information may be transferred to and processed in jurisdictions whose privacy laws differ from those in your country of residence.

Where required by applicable law, we take appropriate measures relating to international transfers of personal information.

12. Security

We use administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss or misuse.

These safeguards may include encryption in transit, access controls, authentication protections, role-based permissions, monitoring and security measures intended to limit unauthorized access to our systems.

We also seek to limit access to consumer health data to systems, personnel and service providers that require access for legitimate business purposes.

No method of transmission, storage or security is completely secure, and we cannot guarantee absolute security.

If we become aware of a security incident involving personal information, we will investigate and provide notifications where required by applicable law.

13. Health and wellness information

FEMSTATE's collection and use of health- and wellness-related information does not make Femstate LLC a healthcare provider and does not create a physician-patient or other healthcare-provider relationship.

For information about the limitations of FEMSTATE's educational content, quiz, cycle insights and product recommendations, please review Section 4 of our Terms of Service.

For information specifically regarding how FEMSTATE collects, uses, discloses and protects consumer health data, please review our Consumer Health Data Privacy Notice.

Warning. As with any dietary supplement, consult your healthcare practitioner before using our products — especially if you are pregnant, nursing, anticipate surgery, take medication on a regular basis, or are otherwise under medical supervision.

14. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, privacy practices or legal requirements.

If we make a material change that affects your privacy rights or materially changes how we use personal information, we will provide notice as required by applicable law.

If we materially change how we collect, use or disclose consumer health data, we will provide any additional notice and obtain any additional consent required by applicable law before applying the new practice to that information.

The "Last updated" date at the top of this Privacy Policy identifies the most recent revision.

15. Contact

Femstate LLC, 1221 Brickell Ave, Suite 900, Miami, FL 33131, USA. Questions about your privacy: support@femstate.me, or through the contact page.