Consumer Health Data Privacy Policy

Template — requires legal review. This document is a starting template prepared from how the store software actually works. It has not been reviewed by a lawyer. Check every statement against your actual practices and have it reviewed before launch.

This Consumer Health Data Privacy Policy is provided by femmeelixir ("we", "us") for https://femmeelixir.com under the Washington My Health My Data Act, Nevada law (SB 370) and similar state laws. It applies to consumer health data about residents of those states and about anyone whose data is collected in those states.

1. Consumer health data we collect

• Skin profile (only if you choose to save one): skin type, skin concerns, sensitivity, ingredients you are allergic to or avoid and, if you choose to tell us, pregnancy or breastfeeding.
• Match quiz answers and results: answers to our match quizzes (for example "What's your skin type?") about your skin type, concerns, sensitivity, ingredients you avoid and similar, the result calculated from them (for example a skin type or a recommended routine) and, for questions we mark as sensitive, answers about pregnancy, breastfeeding, medication or similar health matters. Knowledge quizzes (for example about SPF) ask what you know, not about you, and are not consumer health data.
• What you tell the AI consultant: descriptions of your skin, allergies, sensitivities, pregnancy or other health-related details you choose to type into the chat.
• Reaction reports: information about a reaction to a product that you send us through the contact form.
• Inferences: product suggestions based on the above.

2. Sources

We collect consumer health data only from you, when you fill in the skin profile, take a match quiz, write to the consultant or send us a message.

3. How we use it

• to give you the product and routine suggestions you ask for, including filtering out products with ingredients you avoid;
• to keep a saved skin profile in your account, if you consented;
• to calculate and show the result of a match quiz you take, keep it in your quiz history if you are signed in, and add it to your skin profile if you ask and consent;
• to respond to reaction reports and meet our product safety obligations;
• to keep de-identified records of consultant quality and safety (personal details masked, not linked to you) for up to 12 months.

4. Match quizzes

• Sensitive questions (for example pregnancy, breastfeeding or medication) are marked in the quiz and are optional where possible. Your answers to them are sent to our server only to calculate your result and are never stored with a quiz attempt; they stay only in your browser tab (fe-quiz in sessionStorage) until you close it. We keep only aggregated counts of how often each answer was chosen, which contain no personal information.
• Other answers and the result are processed because you ask us for a result. Without an account they are stored for at most 30 days, linked only to a random link in your browser tab, and then deleted. If you are signed in, they are kept in "My quizzes" until you delete them there or delete your account.
• Saving to your skin profile happens only if you are signed in, choose "Save to my skin profile" and give the separate consent described in section 5 — the same consent text and version as the skin profile form in your account. Only then are your answers to sensitive questions sent again from your browser and stored, encrypted, in the profile.
• You can delete any result in "My quizzes", and withdraw consent or delete your skin profile at any time in your account. Quiz results are general cosmetic information, not a diagnosis or medical advice.

5. Your consent

We save a skin profile — including a profile saved from a match quiz — only after you give separate, explicit consent with its own checkbox (or confirmation in the consultant), which is never pre-checked and is not part of any other terms. Without that consent, details you type into the consultant are used only to answer you during the consultant session (24 hours by default) and are then deleted, unless you separately chose to save your chat history. You can withdraw consent at any time in your account; withdrawing consent for the skin profile deletes it.

6. Categories of data we share and with whom

We share consumer health data only with processors that act on our behalf under contracts:

• Anthropic, PBC (AI model provider) — consultant conversations, a quiz result you ask the consultant to use (without answers to sensitive questions) and, with your consent, your skin profile — to generate the consultant's replies;
• Voyage AI (search provider) — short search phrases the consultant writes from the conversation — to find matching products;
• our hosting and infrastructure providers — all of the above as stored data;
• our email delivery provider — only the content of emails we send in reply to a reaction report.

We do not share consumer health data with third parties or affiliates for their own purposes, and we never sell consumer health data. We do not use geofencing around healthcare facilities.

7. Your rights

You have the right to confirm whether we collect, share or sell your consumer health data; to access it, including a list of all third parties and affiliates with whom we shared it and their contact information; to withdraw consent; and to have it deleted. To use these rights:

• in your account ("Download my data" — including your quiz history —, skin profile, "My quizzes", consents, "Delete my account");
• with the privacy request form, without an account;
• by email to [email protected].

We respond within 45 days (extendable by 45 more days where necessary, with notice). Deletion also covers our processors, and data in backups is deleted when the backups expire (up to 30 days). If we decline your request, you may appeal by replying to our decision or emailing [email protected] with the subject "Health data appeal"; we will respond in writing within 45 days. If your appeal is denied, you may contact the Attorney General of your state (for Washington: atg.wa.gov).

8. Contact

femmeelixir

Email: [email protected]