Washington Consumer Health Data Privacy Policy

What this policy covers

Femstate LLC publishes this policy under Washington's My Health My Data Act. This Policy applies to consumers protected by Washington's My Health My Data Act, including Washington residents and individuals whose consumer health data is collected in Washington, when acting in an individual or household context.

"Consumer health data" is Washington's term for personal information that identifies your past, present or future physical or mental health status. Depending on how information is linked to you and how Femstate processes it, consumer health data may include your menstrual-cycle information, symptoms, life stage, wellness information, and health-related inferences derived from that information, including an estimated cycle phase or related recommendation.

If you are a Nevada resident, your notice is the separate one at Nevada consumer health data privacy notice.

What we collect, and what we use it for

These are all the categories of consumer health data we collect, each with the reason we collect it.

• The date your last period started, and the cycle length you give us. Used to work out where you are in your cycle.
• Your cycle phase and your cycle day, which we calculate from that date. Used to recommend a formula and to draw your cycle timeline in your account.
• The symptoms you pick in the quiz — up to five from a list of twelve: low energy, brain fog, mood swings, stress, anxiety, sleep issues, bloating, cravings, acne, hot flashes, joint discomfort and poor focus. Used to recommend a formula.
• How often those concerns affect your daily life, from rarely to almost every day. Used to recommend a formula, and to score the lead as described below.
• The goals you pick — up to three from a list of ten, such as energy, mood, PMS symptoms, skin, sleep or menopause support. Used to recommend a formula.
• How you usually feel before your period — irritable, tired, bloated, cravings, emotional, or no major changes. Used to recommend a formula.
• Your life stage — regular monthly cycles, teen, perimenopause, menopause, postpartum, or not sure. Used so the recommendation fits that stage.
• Your age range, from a list that includes an "under 18" option. Used so the recommendation fits your age.
• Whether you have tried women's health supplements before. Used to recommend a formula, and to score the lead as described below.
• Your check-ins, if you record them: your mood and your energy on a scale of 1 to 5, any of ten symptoms you tick (cramps, headache, bloating, low energy, anxious, low mood, poor sleep, cravings, focused, energized), and a free-text note of up to 500 characters. Used to show you your own trends over time and to tailor the coach messages inside your account. Check-ins are always optional.
• The formula we recommend and the reasoning behind it — your primary need, your secondary need, what your body may need today, and why that formula fits you. Used to show you your result, to email you your guide if you ask for it, and to keep your result in your account.
• Anything about your health that you write to us in the contact form — a free-text message of up to 4,000 characters. It becomes a support ticket, and when the email address matches an existing record we link the ticket to it.
• Your approximate location — country, state or region, and city — read from your network connection, not from GPS. It is not precise location, but we store it on the same record as the answers above, so we disclose it here.

We do not use consumer health data to prioritize individuals for sales or marketing follow-up unless we first provide the disclosure and obtain the affirmative consent required by applicable law. We may use non-health information, such as whether you requested information from us or opted in to communications, to organize customer-service and marketing workflows as permitted by law.

We also read this data in totals — how many people report a given symptom, how the recommendations are distributed — to improve the formulas and the quiz itself. Those totals are counts, not profiles: they name no one.

We do not use consumer health data for advertising and we do not build advertising profiles from it. The categories above are all the categories we collect, and the purposes above are all the purposes we collect them for. If we want to collect, use or share additional categories of consumer health data, or use consumer health data for an additional purpose not disclosed in this Policy, we will provide the required disclosure and obtain the affirmative consent required by Washington law before doing so.

Where the data comes from

Almost all of it comes from you, typed into one of four forms on our site.

• The quiz, when you answer its questions.
• The check-in form in your account, when you record your mood, your energy, your symptoms or a note for the day.
• The contact form, when what you write to us describes your health.

Two things do not come from a form. Your cycle phase, your cycle day and your recommended formula we work out ourselves from your answers. Your approximate country, state and city come from your network connection, read from the request headers our hosting provider adds — the same coarse signal any website receives.

We do not buy consumer health data, and we do not receive it from data brokers, advertising networks, other apps or any other company. We do not infer anything about your health from the pages you browse.

What we share

We share consumer health data only as described below, with your authorization or consent where required, or as otherwise permitted or required by applicable law. The categories of consumer health data we may share, depending on the service you request, include estimated cycle-phase information, product recommendations that may reveal or imply a cycle phase or life stage, recommendation reasoning, and other health-related information necessary to provide a service you specifically request. We seek to limit each disclosure to the information reasonably necessary for that purpose.

• All of the categories above sit with the vendors that store our database and run our servers. They hold the data on our behalf so that the service can work at all, and their contracts do not let them use it for their own purposes.
• When you ask us to email you your quiz guide, our email provider receives your first name, your email address, your cycle phase, your recommended formula, your primary need, your secondary need, the list of what your body may need today, and the written reason that formula fits you. The guide is built out of that whole snapshot, so the whole snapshot reaches the provider that sends it.
• When you check out, our payment processor receives the name of the formula you are buying — RESET, LIFT, SHINE and SOOTHE each name a phase of the menstrual cycle, and TEEN and MENO name a life stage — along with the product name on the line item, your email address, and the internal identifier that links your payment to your quiz record. It receives this because it has to know what to charge you for and what you are owed.

Nothing else about your health goes anywhere else, except where the law forces it on us — a valid court order or an equivalent legal demand. We do not hand it to law enforcement without legal process.

Who receives it

Every third party that receives consumer health data, by category and by name.

• Database and sign-in provider — Supabase, United States. Stores every category listed above and manages your account login.
• Hosting provider — Vercel, United States. Runs our website and our servers, so the data passes through it on the way to and from you.
• Email provider — Resend, United States. Sends your quiz guide, and receives the result snapshot described above.
• Payment processor — Stripe, United States. Processes your payment, and receives the formula you are buying and the identifier that links it to your quiz record.

Affiliates. Femstate LLC has no affiliates that receive consumer health data. If that ever changes, we will name the specific affiliate here before anything is shared with it.

Tools that do not receive it. We configure PostHog, Microsoft Clarity, Vercel Analytics and similar analytics tools so that they are not intended to receive consumer health data. We seek to exclude health-related fields from analytics events, disable or restrict session recording on pages where consumer health data is collected, and mask sensitive form inputs where those technologies are used. Advertising and badge measurement. If you choose “Accept all” in our cookie banner, we also load the Meta advertising pixel and FrontrowMD's measurement script for its “Clinicians' Choice” badge. Neither is loaded on the quiz, on any account page or on the contact page, and neither receives consumer health data: purchase events sent to Meta carry the amount, the currency, an order reference and the commercial plan name, never a formula name, and FrontrowMD receives the page address on our home and plans pages, whether its badge was seen or clicked, and clicks on buy buttons with their text. The badge itself is displayed to all visitors, without that measurement.

We do not sell it

Femstate does not sell consumer health data. If this practice were ever to change, we would not sell consumer health data without first obtaining the separate, valid authorization required by Washington law.

Your rights

Washington gives you three rights over your consumer health data.

1. Confirm and access. You can ask us to confirm whether we collect, share or sell your consumer health data, and to give you a copy of what we hold. Our answer will list every third party and affiliate your data was shared with or sold to — taken from our actual sharing records, not from the list printed on this page — and, for each one, an active email address or online contact page you can use to reach them directly. You can also just ask us for those contact details on their own, without making a full access request.

2. Withdraw your consent. You can tell us to stop collecting your consumer health data, to stop sharing it, or both: say which one and we act on it. It takes effect going forward. Because your recommendation and your cycle timeline are calculated from this data, withdrawing consent to collection means we can no longer produce them for you. Withdrawing consent does not by itself erase what we already hold, so if you want that gone too, ask us to delete it as well.

3. Delete. You can ask us to delete your consumer health data. A person on our team does it by hand: we will delete the consumer health data from our active records and notify applicable processors, contractors, affiliates and other third parties with whom the data was shared of your deletion request, where required by law. If the data is stored in archived or backup systems, deletion from those systems may be delayed as permitted by Washington law, but no longer than six months after authentication of your deletion request.

What it costs. We provide information in response to consumer health data requests free of charge up to twice annually per consumer. For manifestly unfounded, excessive or repetitive requests, we may charge a reasonable administrative fee or decline to act where permitted by law, and we will explain our decision and how to appeal. Using these rights never changes the price you pay or the service you get.

How to make a request

Email support@femstate.me and tell us which right you want to use. There is no form to fill in and no particular wording you have to use: plain words are enough. If you would rather use a form, write to us from our contact page and put privacy request at the start of the subject line, so it reaches the right people instead of the general support queue.

Checking that it is you. We will ask for enough information to match your request to your data, usually confirming the email address it is attached to. We use what you send only to answer that request. If we cannot confirm who you are, we will tell you what is missing instead of simply refusing. You do not need to create a new FEMSTATE account to exercise these rights. If you already have an account, we may ask you to use it where appropriate to help authenticate your request.

How long we take. We respond without undue delay, and in all cases within 45 days of receiving your request. When it is reasonably necessary we may take one further 45 days — and if we do, we will tell you inside the first 45 days that we are extending, and why.

How we protect consumer health data

We restrict access to consumer health data to employees, processors and contractors who require access for purposes consistent with this Policy, your consent, or the products and services you requested. We maintain administrative, technical and physical safeguards designed to protect consumer health data and appropriate to the nature and volume of the information we process.

If we say no

How to appeal. If we refuse to act on your request, we will tell you why, and we will tell you how to appeal. To appeal, reply to that answer or write to support@femstate.me with the word appeal in the subject line. We review the decision again from the start, not just the message that explained it.

Our answer. We respond to an appeal in writing, within 45 days of receiving it, with the outcome and the reasons behind it.

If we deny your appeal. You can complain to the Washington State Attorney General's Office, which enforces this law. Its Consumer Protection Division receives consumer complaints through the complaint form on its website, atg.wa.gov. We will include that route in our appeal decision, so you will not have to go looking for it.