Nevada Consumer Health Data Privacy Policy

Who we are and who this page is for

Femstate LLC is a company based in Miami, Florida, in the United States. We sell phase-aligned nutritional supplements at femstate.me. This page is written for people who live in Nevada, and it covers only what Nevada law calls consumer health data: information linked to you that identifies something about your past, present or future physical or mental health. If anything here conflicts with our general privacy policy, this page governs for the health data of Nevada residents.

This is the Nevada notice. Washington State has its own consumer health data law with different rules and different deadlines, so we keep a separate notice for it. If you live in Washington, use the Washington consumer health data privacy policy; if you live anywhere else, our general Privacy Policy is the one that applies to you.

We are not a clinic, a pharmacy or a health plan. Femstate is not a HIPAA covered entity and not a business associate of one. What we sell are food supplements, not drugs and not medical devices, and nothing we show or send you is a diagnosis, a treatment or medical advice.

What consumer health data we collect

The list below is meant to be exhaustive, and that matters legally: Nevada forbids us from collecting or using a category of consumer health data that is not disclosed here without asking you first. If you ever find something we hold that is not on this list, tell us and we will either delete it or add it to this page.

• The date your last period started — or the answer "I don't get periods" — and the cycle length you set in your account
• Your cycle phase, your day of cycle, the timeline of the four phases and the predicted date of your next period, all of which we calculate from that date
• Your life stage: regular monthly cycles, teen, perimenopause, menopause, postpartum, or not sure
• Your age range, chosen from six options, one of which is Under 18
• The symptoms you check off, from a fixed list of twelve, and up to three goals from a list of ten
• How often these concerns affect your daily life, and how you usually feel before your period — irritable, tired, bloated, cravings, emotional, or no major changes
• What you say you want more of, what matters most to you in a supplement, and whether you have tried women's health supplements before
• What you tell us feels most valuable to you about Femstate
• What we work out from all of the above: your primary need, your secondary need, a short list of what your body may need today, the formula we recommend, and the written explanation of why
• A lead score and a "temperature" — cold, warm or hot — that we calculate from those same answers. This is an internal signal and we explain it honestly further down
• Your daily check-ins, if you do them: mood from 1 to 5, energy from 1 to 5, the symptoms you tick from a list, and a free-text note of up to 500 characters
• Anything about your health that you choose to write in the free-text message box of the contact form, which accepts up to 4,000 characters and is filed against your email address as a support ticket
• Your first name and your email address, which are what tie everything above to you as a person
• Approximate country, state and city, read from your network connection at the moment you finish the quiz and saved on that record — never a street address, never a precise location, never your IP address

About minors. Buying from us and holding an account require you to be 18 or over. Even so, the quiz offers an Under 18 age option and a Teen life stage, so we can end up holding cycle and symptom answers from someone under 18. When that happens, that data gets exactly the protection described on this page, and a parent or guardian can ask us to show it, correct it or delete it using the same routes. If we learn that we hold information from a child under 13, we delete it.

Where this data comes from

There is one category of source: you. Every piece of consumer health data we hold was typed into one of four forms by the person it belongs to:

• The quiz — the eleven questions and the email step at the end
• The cycle form inside your account, where you set your last period date and your cycle length
• The optional daily check-in inside your account, including its free-text note
• The contact form, if what you write to us happens to describe your health

Two things are not typed by you and we want to be precise about them. Derived data — your phase, your day of cycle, your needs, your recommended formula and your lead score — we generate ourselves by calculating from what you typed; we do not receive it from anywhere. And your approximate country, state and city are read from your network connection when you submit the quiz, not from a question we ask.

We do not buy health data and we do not receive it from anyone else. There is no data broker, no enrichment service, no purchased list, no import from another app or from your phone's health tracker, and no social network feeding us anything about you.

Why we collect it and what we use it for

The main reason is the one you came for: a recommendation that fits where you actually are in your cycle. But that is not the only use, and a policy that listed only the flattering ones would be worth nothing. Here is the full list:

• Work out which phase of your cycle you are in and which of our formulas matches it
• Show you your result on screen and, if you ask for it, email you your personalized guide
• Run your account: your cycle timeline, your check-in history, and the rule-based coach that turns your own answers into suggestions
• Prepare and send the order or subscription you decide to buy, and support you afterwards
• Answer the message you send us through the contact form, and keep a record of that conversation
• Count answers in aggregate — how many people report a given symptom or goal — so we can improve the formulas and explain them better
• Prioritise our own follow-up. Your answers feed a score, and that score becomes a label: cold, warm or hot. It draws on how often your concerns affect you, how many goals and symptoms you picked, whether you have tried supplements before, and whether you gave us your email. We use it to decide who to follow up with and which people to include when we send a marketing email

About that last one, plainly. It is a use of your health answers beyond suggesting a supplement, so we are not going to hide it behind a nicer word. It stays inside the company: it is never sold, never shared with anyone outside the providers listed below, never shown to you as a verdict about you, and it never changes your price, your access, or what we are willing to sell you. If you would rather it did not exist for you, ask us to delete your data or withdraw your consent and it goes with everything else.

What we never do with it: we do not use your health data to advertise to you on other websites or apps, we do not build a profile of you that follows you around the internet, we do not sell it, and we do not use it to make any decision about you that has a legal effect or a similarly significant one.

How the data is actually processed

Nevada asks us to describe not just why we use this data but the manner in which it is processed, so here is the machinery in plain terms.

Your phase, your day of cycle and your recommended formula come out of a deterministic rule-based calculation, not a guess and not a model. We count the days since the date you gave us, place that day inside a cycle of the length you set, map the day to one of the four phases, and map that phase to the formula built for it. Two life stages override the result on purpose: a teen stage always returns the teen formula, and perimenopause or menopause always returns the menopause formula. If you tell us you do not get periods, there is no phase to calculate and you get the daily foundation formula instead. The same answers always produce the same result, which means anyone can check our work — including you.

The coach inside your account works the same way: a fixed set of rules that reads your phase, your formula, your symptoms and your check-in averages and picks which cards to show. No external artificial intelligence service is involved anywhere in this. Your answers are never sent to a language model, never used to train one, and never handed to an AI vendor.

Where it physically sits: your answers are written to our Postgres database at Supabase and read back from it only by our own server code. The site itself runs on Vercel. Requests are rate-limited through Upstash, which sees only a technical key and never any of this data. Nothing on this list is stored in your browser, and none of it is readable by the website's front-end code.

There is no automated decision here that produces a legal effect on you, or anything similarly significant. A recommendation is a suggestion you are free to ignore. Nothing in this calculation affects a price, an eligibility, an insurance outcome, a credit decision or your access to any part of the service.

How we ask for your permission

A right to withdraw consent means nothing unless we say what consent we took and how. So, honestly, and describing the site as it is today rather than as a diagram:

Your cycle data is collected because you asked for the service. You open the quiz, you read what it is for, and you type your answers into it — the same way you would tell a shop assistant what you are looking for. Nothing is collected in the background, and if you close the quiz without submitting it we keep nothing. The same is true of the cycle form, the check-in and the contact form: each one collects only what you type into it and only when you press the button.

The two places where you actively press "accept" are the cookie banner and the terms you accept when you create an account or check out. The cookie banner is what governs measurement tools: until you accept it, none of them load at all. We are telling you this because we would rather you knew exactly which interfaces exist than believe there is a consent screen for each item on this page. There is not, and inventing one in a privacy policy would be the violation.

Consent to collect and consent to share are two different things, and Nevada requires them to be separate and distinct. We have never asked you for a sharing consent, and the reason is simple: we do not share your consumer health data with any third party. The companies listed in the next section process it for us, on our instructions, which is not the same thing under this law. If we ever wanted to give your health data to a genuine third party, we would have to come back and ask you for that specifically. Your consent to give us your answers is not, and could never be treated as, consent to pass them on.

You can withdraw at any time, free, and without giving a reason — write to privacy@femstate.me. Withdrawal stops future collection and use; it does not undo what already happened before you asked, and it switches off the parts of the service that depend on that data. If you also want what we already hold to be erased, ask for deletion in the same message and we will do both.

Who else receives it: third parties, affiliates and processors

Nevada uses three words with precise meanings, and mixing them up is how a policy ends up saying nothing. A processor handles data on our behalf and only on our instructions. An affiliate is a company that controls us, that we control, or that shares common control with us. A third party is anyone who is none of those and is not you. We will answer for all three.

Affiliates: Femstate LLC has none. There is no parent company, no subsidiary and no sister company. Zero affiliates receive your consumer health data, because none exist to receive it.

Third parties: none. No third party, as Nevada defines the word, receives your consumer health data. We do not disclose it to advertisers, data brokers, insurers, employers, researchers, other brands or anyone else acting for their own purposes. Every company named below is a processor working under contract for us.

These are our processors, and this is exactly what each one receives. We list the contents rather than a reassuring summary, because a summary is where these documents usually stop being true:

• Supabase — our database and sign-in provider. Holds everything listed in the categories section: your cycle data, symptoms, goals, check-ins with their free-text notes, contact messages, derived recommendation and lead score.
• Vercel — our hosting provider. Every page you load and every form you submit passes through it, so all of the same categories travel through it in transit.
• Resend — our email provider, used to send your personalized guide. It receives a full snapshot of your result: your first name, your email address, your current cycle phase, the formula we recommend, your primary need, your secondary need, the list of what your body may need today, and the written explanation of why that formula fits you.
• Stripe — our payment provider. It receives your email address, the amount, and the product or plan name. For a purchase of a single formula it also receives the formula code (RESET, LIFT, SHINE, SOOTHE, CORE, TEEN or MENO — TEEN indicates adolescence and MENO indicates menopause) and our internal customer and lead identifiers. That formula code says which phase we placed you in, so this is health data and we are not going to pretend otherwise — it travels because we have to know what to charge you for and what to ship.
• Upstash — rate limiting, to stop abuse of our forms. It sees only a technical key derived from your connection and the name of the form. No health data.
• Vercel Blob — file storage for the images on the site. No health data.
• PostHog, Microsoft Clarity and Vercel Web Analytics — measurement. They receive no consumer health data; the next section explains exactly how that is enforced.

These are all United States companies. We are not going to promise you that every server holding a copy sits inside one country — cloud infrastructure is global and that promise would be unverifiable. What we do commit to is the boundary: this data is not sold, not rented and not handed to anyone outside the list above.

We may also disclose data if the law genuinely requires it — a valid court order, for example — or if it is needed to protect someone from serious harm. If that ever happens we will tell you, unless we are legally forbidden from doing so.

No sale, no cross-site tracking, no geofencing

We do not sell your consumer health data. Under Nevada law, a company can only sell it with your prior written authorization, signed by you, spelling out exactly what would be sold and to whom, and telling you that you may revoke it. We have never asked anyone for such an authorization, we hold none, and we do not intend to seek any. If that ever changed, we would have to ask you first, you would be free to say no, and you could change your mind afterwards.

No third party tracks you across other websites or apps because of Femstate. There is no advertising pixel on our site — no Meta or Facebook pixel, no TikTok pixel, no Google Ads tag — and no advertising SDK of any kind. Nobody is building an advertising audience out of the fact that you visited us.

What we do use to measure the site is PostHog, Microsoft Clarity, Vercel Web Analytics and our own first-party event log. None of them load until you accept analytics cookies, and if you decline the site works exactly the same. Alongside them we set a first-party cookie that remembers how you arrived — campaign tags, referring site, landing page — for 90 days, and a visitor identifier stored in your browser. Neither of those contains health data.

Health data does not reach those measurement tools, and here is how that is enforced rather than merely intended. Three separate mechanisms: a filter in our code strips out phase, formula, symptoms, goals, mood, energy, needs and similar fields from every event before it is ever mirrored to PostHog; session recording is switched off entirely on the quiz and on the account pages, so nothing is recorded where you type about your body; and every form field on the whole site is masked, so no recording anywhere captures what you type.

One honest detail so the sentence above is not doing quiet work. Our own event log — the one that lives in our own database, with our processors and nowhere else — does still record some of these fields, for example which formula you were looking at when you started a checkout. That is first-party data, covered by everything else on this page, and it is not what the tracking question is about. What the filter guarantees is that it does not leave for an outside analytics tool.

We use no geofences. We do not draw any virtual boundary within 1,750 feet — about 533 metres — of a medical facility, a health care provider or a provider of health care services: not to identify you, not to track you, not to send you an ad or a message, and not to collect anything about you. There is no code in our site that does this and no vendor doing it for us.

Your rights over this data

If you are in Nevada, you have the following rights over your consumer health data. Using them is free, and we will not treat you differently for having used them:

• Confirm and access. Ask whether we are collecting, sharing or selling your consumer health data, and get a copy of what we hold about you.
• Know who has it. Ask for the list of everyone your health data has gone to. Today the honest answer is that no third party has received it, so what we will give you is the list of processors above, what each one received, and a live way to reach each of them. If a third party ever did receive it, that list would name them too.
• Delete. Ask us to delete your consumer health data from our systems. We pass the deletion on to the processors holding a copy for us, and we tell you when it is done.
• Withdraw consent. Take back, at any time and without giving a reason, your permission for us to collect and use your health data.

Two consequences worth saying out loud. Withdrawing consent or deleting your data does not undo what already happened before the request, and it will switch off the parts of the service that depend on that data — your cycle timeline, your check-in history and your recommendation. And if you have placed an order, the record of that purchase is kept for accounting and tax reasons; for a single-formula purchase that record does include the formula name, which is why we called it out in the sharing section instead of burying it.

Reviewing and correcting your data

Most of this data is yours to look at whenever you like. Sign in and open your account: the date of your last period, your cycle length, your current phase and day of cycle, your check-in history and your recommended formula are all there on screen.

What you can change yourself, right now: the date your last period started and your cycle length. Change either one in your account and everything derived from them — your phase, your day of cycle, your timeline and your predicted next period — is recalculated immediately. You can also save today's check-in again; doing so replaces the one you saved earlier the same day.

What you cannot change on screen, and we would rather tell you than let you find out: a check-in from a previous day, your original quiz answers, the recommendation derived from them, and anything at all if you took the quiz without creating an account. There is no button for those. Email privacy@femstate.me telling us what is wrong and what it should say, and a person on our team makes the correction by hand within the deadline below. When a correction affects data a processor holds for us, we pass it on to them too.

If you took the quiz without an account there is no login for you to use. Write to us from the address you gave in the quiz and we will find your answers and show them to you, correct them, or delete them — whichever you ask for.

If we cannot make a correction, we will tell you in writing why, what we did instead, and how to appeal that decision. We will never ask you for more personal information than we need to find your record, and we will never ask you to create an account in order to exercise a right.

How to make a request, and how to appeal

To use any of the rights above, email privacy@femstate.me or write to us through the contact form. Tell us which right you want to use and the email address you used with Femstate, so we can find you. If you are asking on behalf of someone else — as a parent or guardian, or with a power of attorney — say so and we will tell you what we need.

• We confirm that your request arrived.
• We check that it is really you, using only information we already hold. We do not make you open an account or send us documents.
• We answer you within 45 days of authenticating your request, and sooner when we can.
• If your request is genuinely complex, we may take one extension of up to 45 more days — and we will tell you inside the original 45 days that we are taking it, and why.
• We do not charge you for any of this.

If we refuse a request, you can appeal, and it costs you nothing. Our refusal will always be in writing, will say why, and will include instructions for appealing. To appeal, reply to that message or write to privacy@femstate.me with the word Appeal in the subject line. Someone looks at the decision again from the beginning rather than re-reading our first answer, and we give you our written decision, with the reasons for it, within 45 days.

If we still say no after the appeal, that written decision will also tell you how to take it further, and we are telling you here as well: you can submit a complaint to the Office of the Nevada Attorney General, which enforces this law. You can reach that Office at ag.nv.gov, by post at 100 North Carson Street, Carson City, NV 89701, or by phone at (775) 684-1100; its Bureau of Consumer Protection takes these complaints. You do not need our permission or our involvement to use it.

How long we keep it, and how we protect it

We are going to describe this the way it actually works, because a retention promise we do not keep would itself be the violation. There is no automatic timer. We do not run a job that deletes health data after a set period, and we are not going to claim one exists. What is true is this: while you have an account, your cycle data and your check-ins are kept for as long as the account is open. If you took the quiz without an account, those answers stay until you ask us to remove them. Deletion is something we do when you ask for it — by hand, by a person on our team, within the 45-day deadline described above, and passed on to the processors holding a copy.

Two things survive a deletion request, and you should know which. Order and payment records are kept for seven years because tax and accounting law requires it; for a single-formula purchase that record includes the formula name. And a record of your request itself is kept, because that is the only way we can prove we honoured it and make sure we do not undo it later.

How this data is protected while we hold it:

• It lives in a Postgres database with row-level security turned on, so a row can only be read by someone entitled to read it.
• The tables that hold health data have no public access policy at all: they are readable only by our own server code, using a private key that never reaches anyone's browser.
• Traffic between your device and the site is encrypted, and the site sends strict security headers that stop other websites from embedding it or borrowing your session.
• Access inside the company is limited by role: only the people who need this data to run the service can reach it, the marketing roles can see the interested-people list, including email addresses, because that is where campaigns are drawn from; your order history, by contrast, is open only to administration and support.
• Our forms are rate-limited so nobody can grind through them to fish out records.

No company can promise that a system is impossible to breach, and we are not going to pretend otherwise. What we can promise is that we collect as little health data as the product needs, hand it to as few companies as we can, and delete it when you ask.

Effective date and how we tell you this policy changed

This policy takes effect on the date shown at the top of this page, and that date always reflects the version you are reading. If the date has moved since you last looked, something on this page changed.

A change is material when it would alter what you agreed to: a new category of health data, a new purpose, a new way of processing it, a new recipient, or any change in whether we share or sell. When we make one, all of the following happen — this is the notification process, not a description of good intentions:

• We update the effective date at the top of this page.
• We post a dated notice at the top of this page saying plainly what changed and what it means for you, and we leave it up for at least 30 days before the change takes effect, so you have time to object or to delete your data first.
• We email everyone who has an account, at the address on that account, and everyone who gave us an email address through the quiz and has not asked us to stop writing to them.
• Where Nevada law requires your consent for the new collection, use or sharing, we ask you again and wait for your answer before doing it. Continuing to use the site is never treated as your consent, silence is never treated as your consent, and a material change is never applied backwards to the data we already hold. If you do not agree, we carry on under the terms you did agree to, or we stop and delete — your choice.

For small changes that do not affect your rights — fixing a typo, saying something more clearly, updating an address or the name of a provider that has not changed what it receives — we simply make the change and update the effective date.

Contact us

Femstate LLC · Miami, Florida, United States. For anything on this page — a question, a request, a correction, a withdrawal of consent or an appeal — email privacy@femstate.me or use the contact form. Write to us in English or in Spanish; we reply in whichever one you use.

If you are not satisfied with how we handled your request, you can file a complaint with the Office of the Nevada Attorney General, which enforces Nevada's consumer health data law. You can reach it at ag.nv.gov or by phone at (775) 684-1100, and you can use it whether or not you appealed to us first.