Privacy Policy

femPAQ Inc. (“femPAQ,” “we,” “us,” or “our”) operates the femPAQ Health application (“App”). We are committed to protecting your personal health information. This Privacy Policy explains how we collect, use, share, and protect information when you use femPAQ Health.

By creating an account or using the App, you agree to this Privacy Policy. If you do not agree, please do not use femPAQ Health.

We use your information to:

• Provide and improve the femPAQ Health App and its features
• Generate your personalized Pre-Visit Health Report
• Send health reminders, alerts, and notifications (with your consent)
• Respond to support requests and inquiries
• Comply with legal obligations, including COPPA for users under 13
• Conduct anonymized, aggregate research on women’s health outcomes (only with your explicit consent, via the Equity Data program)
• Operate the Lafayette County femPAQ Health Study (LAF participants only)

We do not sell your personal health data to third parties. We do not use your health data for targeted advertising.

We may share your information in the following limited circumstances:

• With your provider (share link): When you generate a share link for your Pre-Visit Report, you control who receives it. Share links expire after 7 days and can be revoked at any time.
• Service providers: We use Supabase for secure data storage, Stripe for subscription billing, and Vercel for App hosting. These providers process data only on our behalf under strict data processing agreements.
• Research partners: Anonymized, de-identified data may be shared with research partners for women’s health research only if you have opted into the Equity Data program.
• Lafayette County Health Unit: Aggregate, de-identified study data is shared with the grant-funding health unit for the LAF study.
• Legal requirements: We may disclose information if required by law, court order, or to protect the safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

femPAQ Health is not directed to children under 13. For users who identify as under 13, we require verifiable parental consent before collecting any health data. Parental consent is obtained via a magic-link email sent to the parent’s verified email address. We do not knowingly collect personal information from children under 13 without verified parental consent.

Parents may review, request deletion of, or refuse further collection of their child’s information by contacting privacy@fempaq.com.

We implement industry-standard security measures to protect your health information:

• All data is encrypted in transit using TLS and at rest in Supabase
• Row-level security (RLS) policies ensure you can only access your own data
• Service-role keys are never exposed to client-side code
• Share links use cryptographically random tokens and expire after 7 days
• We do not store passwords — authentication is managed by Supabase Auth

No system is 100% secure. If you believe your account has been compromised, contact privacy@fempaq.com immediately.

Depending on where you live, you may have the right to:

• Access: Request a copy of the data we hold about you (available via Account → Export My Data in the App)
• Correction: Update inaccurate information in your profile
• Deletion: Delete your account and all associated health data (available via Account → Delete Account in the App)
• Portability: Export your data in a machine-readable format
• Opt-out: Withdraw consent for the Equity Data program at any time via Privacy Center

To exercise any right not available in the App, contact privacy@fempaq.com.

We retain your health data for as long as your account is active. If you delete your account, we permanently erase all associated health data within 30 days, except where retention is required by law. Anonymized, aggregate data used for research is not subject to deletion.

femPAQ Health uses session cookies to maintain your authentication state. We do not use third-party tracking cookies or advertising pixels. Push notification tokens are stored only if you grant notification permission and are deleted when you disable notifications or delete your account.

The App may contain links to external websites or resources. We are not responsible for the privacy practices of those third parties. Please review their privacy policies independently.

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email before the changes take effect. Continued use of the App after changes constitutes acceptance of the updated policy.

For privacy questions, data requests, or concerns: