Washington Consumer Health Data Privacy Policy

What this policy covers

Femstate LLC publishes this policy under Washington's My Health My Data Act. It applies to you if you are a Washington resident, or if we collected your consumer health data while you were in Washington. It covers consumer health data and nothing else.

"Consumer health data" is Washington's term for personal information that identifies your past, present or future physical or mental health status. Your cycle, your symptoms, your life stage and the formula we recommend for you all fall inside it.

If you are a Nevada resident, your notice is the separate one at Nevada consumer health data privacy notice.

What we collect, and what we use it for

These are all the categories of consumer health data we collect, each with the reason we collect it.

• The date your last period started, and the cycle length you give us. Used to work out where you are in your cycle.
• Your cycle phase and your cycle day, which we calculate from that date. Used to recommend a formula and to draw your cycle timeline in your account.
• The symptoms you pick in the quiz — up to five from a list of twelve: low energy, brain fog, mood swings, stress, anxiety, sleep issues, bloating, cravings, acne, hot flashes, joint discomfort and poor focus. Used to recommend a formula.
• How often those concerns affect your daily life, from rarely to almost every day. Used to recommend a formula, and to score the lead as described below.
• The goals you pick — up to three from a list of ten, such as energy, mood, PMS symptoms, skin, sleep or menopause support. Used to recommend a formula.
• How you usually feel before your period — irritable, tired, bloated, cravings, emotional, or no major changes. Used to recommend a formula.
• Your life stage — regular monthly cycles, teen, perimenopause, menopause, postpartum, or not sure. Used so the recommendation fits that stage.
• Your age range, from a list that includes an "under 18" option. Used so the recommendation fits your age.
• Whether you have tried women's health supplements before. Used to recommend a formula, and to score the lead as described below.
• Your check-ins, if you record them: your mood and your energy on a scale of 1 to 5, any of ten symptoms you tick (cramps, headache, bloating, low energy, anxious, low mood, poor sleep, cravings, focused, energized), and a free-text note of up to 500 characters. Used to show you your own trends over time and to tailor the coach messages inside your account. Check-ins are always optional.
• The formula we recommend and the reasoning behind it — your primary need, your secondary need, what your body may need today, and why that formula fits you. Used to show you your result, to email you your guide if you ask for it, and to keep your result in your account.
• Anything about your health that you write to us in the contact form — a free-text message of up to 4,000 characters. It becomes a support ticket, and when the email address matches an existing record we link the ticket to it.
• Your approximate location — country, state or region, and city — read from your network connection, not from GPS. It is not precise location, but we store it on the same record as the answers above, so we disclose it here.

We also use these answers to score you as a lead. From how often your concerns affect your daily life, how many symptoms and goals you picked, whether you have tried supplements before, and whether you gave us your email, we calculate an internal score and label the lead cold, warm or hot. You are never shown it and it never leaves Femstate, but it is built out of your health answers and it decides who our team follows up with first. We say so here rather than describe this data as being used only to suggest a supplement.

We also read this data in totals — how many people report a given symptom, how the recommendations are distributed — to improve the formulas and the quiz itself. Those totals are counts, not profiles: they name no one.

We do not use consumer health data for advertising and we do not build advertising profiles from it. The categories above are all the categories we collect, and the purposes above are all the purposes we collect them for. Washington law does not let us add a category, or use this data for a purpose that is not listed here, without asking for your consent first.

Where the data comes from

Almost all of it comes from you, typed into one of four forms on our site.

• The quiz, when you answer its questions.
• The check-in form in your account, when you record your mood, your energy, your symptoms or a note for the day.
• The contact form, when what you write to us describes your health.

Two things do not come from a form. Your cycle phase, your cycle day and your recommended formula we work out ourselves from your answers. Your approximate country, state and city come from your network connection, read from the request headers our hosting provider adds — the same coarse signal any website receives.

We do not buy consumer health data, and we do not receive it from data brokers, advertising networks, other apps or any other company. We do not infer anything about your health from the pages you browse.

What we share

Consumer health data leaves our own systems in four situations, and only four.

• All of the categories above sit with the vendors that store our database and run our servers. They hold the data on our behalf so that the service can work at all, and their contracts do not let them use it for their own purposes.
• When you ask us to email you your quiz guide, our email provider receives your first name, your email address, your cycle phase, your recommended formula, your primary need, your secondary need, the list of what your body may need today, and the written reason that formula fits you. The guide is built out of that whole snapshot, so the whole snapshot reaches the provider that sends it.
• When you check out, our payment processor receives the name of the formula you are buying — RESET, LIFT, SHINE and SOOTHE each name a phase of the menstrual cycle, and TEEN and MENO name a life stage — along with the product name on the line item, your email address, and the internal identifier that links your payment to your quiz record. It receives this because it has to know what to charge you for and what you are owed.

That is the whole list. Nothing else about your health goes anywhere else, except where the law forces it on us — a valid court order or an equivalent legal demand. We do not hand it to law enforcement without legal process.

Who receives it

Every third party that receives consumer health data, by category and by name.

• Database and sign-in provider — Supabase, United States. Stores every category listed above and manages your account login.
• Hosting provider — Vercel, United States. Runs our website and our servers, so the data passes through it on the way to and from you.
• Email provider — Resend, United States. Sends your quiz guide, and receives the result snapshot described above.
• Payment processor — Stripe, United States. Processes your payment, and receives the formula you are buying and the identifier that links it to your quiz record.

Affiliates. Femstate LLC has no affiliates that receive consumer health data. If that ever changes, we will name the specific affiliate here before anything is shared with it.

Tools that do not receive it. We use PostHog and Microsoft Clarity for product analytics, Vercel Analytics for page views, and Upstash for rate limiting. None of them receives consumer health data, so none of them is on the list above. Events sent to PostHog have the health fields stripped out — phase, formula, symptoms, goals, mood, energy and the like — before they leave your browser; session recording is switched off entirely on the quiz and on every account page; what you type into a form is masked everywhere on the site; and none of these tools loads at all unless you accept analytics cookies.

We do not sell it

Femstate does not sell consumer health data, and never has. Washington counts it as a sale when data is handed to someone else in exchange for money or anything else of value. None of the sharing described above is that.

Your rights

Washington gives you three rights over your consumer health data.

1. Confirm and access. You can ask us to confirm whether we collect, share or sell your consumer health data, and to give you a copy of what we hold. Our answer will list every third party and affiliate your data was shared with or sold to — taken from our actual sharing records, not from the list printed on this page — and, for each one, an active email address or online contact page you can use to reach them directly. You can also just ask us for those contact details on their own, without making a full access request.

2. Withdraw your consent. You can tell us to stop collecting your consumer health data, to stop sharing it, or both: say which one and we act on it. It takes effect going forward. Because your recommendation and your cycle timeline are calculated from this data, withdrawing consent to collection means we can no longer produce them for you. Withdrawing consent does not by itself erase what we already hold, so if you want that gone too, ask us to delete it as well.

3. Delete. You can ask us to delete your consumer health data. A person on our team does it by hand: we remove it from the systems we use day to day and from every other place it sits, including archived and backup systems, and we notify each third party named above to delete their copy. It is done inside the same deadline as any other request, below. We want to be plain about one thing: we do not delete this data on a timer. There is no automatic expiry. If you want it gone, asking is what makes that happen.

What it costs. Nothing, at least twice in any twelve-month period. If a request is manifestly unfounded, or excessive because it repeats one we have already answered, we may charge a reasonable fee to cover the work or decline to act — and if we do either, we will tell you why and how to appeal. Using these rights never changes the price you pay or the service you get.

How to make a request

Email privacy@femstate.me and tell us which right you want to use. There is no form to fill in and no particular wording you have to use: plain words are enough. If you would rather use a form, write to us from our contact page and put privacy request at the start of the subject line, so it reaches the right people instead of the general support queue.

Checking that it is you. We will ask for enough information to match your request to your data, usually confirming the email address it is attached to. We use what you send only to answer that request. If we cannot confirm who you are, we will tell you what is missing instead of simply refusing.

How long we take. We respond without undue delay, and in all cases within 45 days of receiving your request. When it is reasonably necessary we may take one further 45 days — and if we do, we will tell you inside the first 45 days that we are extending, and why.

If we say no

How to appeal. If we refuse to act on your request, we will tell you why, and we will tell you how to appeal. To appeal, reply to that answer or write to privacy@femstate.me with the word appeal in the subject line. We review the decision again from the start, not just the message that explained it.

Our answer. We respond to an appeal in writing, within 45 days of receiving it, with the outcome and the reasons behind it.

If we deny your appeal. You can complain to the Washington State Attorney General's Office, which enforces this law. Its Consumer Protection Division receives consumer complaints through the complaint form on its website, atg.wa.gov. We will include that route in our appeal decision, so you will not have to go looking for it.