top of page
Pink Poppy Flowers
femm

Privacy Policy

At femm, we value your trust and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, and safeguard your data when you use our app.

OUR COMMITMENT

Mustardseed Life Sciences Limited ("femm", "we", "us") is committed to protecting your personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 619) of Hong Kong ("PDPO") and its six Data Protection Principles.

WHAT DATA WE COLLECT

  • Account data: Name, email address, date of birth, and health goals provided at registration.

  • Cycle data: Menstrual cycle dates, symptoms, moods, and tags you log in the app.

  • Health metrics: When you connect Apple Health, we access read-only data including HRV, resting heart rate, sleep duration, step count, active energy, SpO2, and respiratory rate. This data is processed on-device to generate health scores and is not stored on our servers in raw form.

  • Usage data: App interactions and feature usage, collected in aggregate to improve our service.

  • Device data: Device type and operating system version for technical support purposes.

​

We do not collect payment information — all transactions occur directly with iHerb.

HOW WE USE YOUR DATA

We use your data to:

  • Generate personalised supplement and wellness recommendations

  • Track your cycle and health trends within the app

  • Send service-related notifications (account updates, app news)

  • Improve our recommendation algorithms using anonymised, aggregated data

  • Comply with legal obligations under Hong Kong law

​

We do not use your health or cycle data for advertising or share it with advertisers.

DATA-SHARING & SUB-PROCESSORS

We do not sell your personal data. We share data only with the following sub-processors:

  • Firebase (Google LLC, USA) — Authentication, database hosting, and analytics. Data may be processed on Google's servers outside Hong Kong. firebase.google.com/terms

  • Apple Inc. (USA) — HealthKit integration (read-only, on-device processing). apple.com/privacy

  • Impact (Impact Tech, Inc., USA) — Affiliate referral tracking. When you click through to iHerb, Impact records the referral click to attribute purchases. impact.com/privacy

  • iHerb, Inc. (USA) — When you click through to purchase, your order and purchase data is processed by iHerb under their own privacy policy. iherb.com/info/privacy-policy

  • Expo (Expo Inc., USA) — App build, distribution infrastructure, and push notification token management. expo.dev/privacy

  • Qonversion Inc. (USA) — In-app subscription management and entitlement verification. qonversion.io/privacy

​

All sub-processors are contractually required to process personal data only as instructed and to maintain appropriate security standards. Cross-border data transfers to the USA are made under appropriate safeguards.

APPLE HEALTH INTEGRATIONS

femm requests read-only access to Apple Health. We access only the metrics needed for your health scores. You can revoke access at any time via iOS Settings → Privacy & Security → Health → femm.

DATA RETENTION

We retain your account and cycle data for as long as your account is active, plus 12 months after deletion. Health score data is retained for 24 months and then anonymised. You may request earlier deletion at any time by contacting info@femm.health.

YOUR RIGHTS UNDER THE PDPO

Under the PDPO, you have the right to:

  • Request access to personal data we hold about you (Data Access Request)

  • Request correction of inaccurate personal data (Data Correction Request)

  • Be informed of the kinds of data held and how it is used

​

To make a Data Access or Correction Request, contact our Privacy Officer at info@femm.health. We will respond within 40 days as required by the PDPO. A reasonable fee may be charged for data access requests.

SECURITY

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest. Access to personal data is restricted to authorised personnel only.

CROSS-BORDER DATA TRANSFER

Your data may be processed outside Hong Kong (e.g. on Google Firebase servers in the USA). We ensure appropriate safeguards are in place for any cross-border transfers in accordance with the PDPO.

CHILDREN

femm is not intended for users under 16 years of age. We do not knowingly collect data from minors.

CHANGES

We may update this Privacy Policy periodically. Material changes will be notified via email or in-app notification. The current version is always available within the app.

CONTACT

Privacy Officer
Mustardseed Life Sciences Limited
info@femm.health

bottom of page