PRIVACY POLICY
OF THE FEMICODE SERVICE
I. INTRODUCTION
This Privacy Policy (hereinafter: the “Policy”) sets out the rules for the processing of the personal data of Users of the FEMICODE online service (hereinafter: the “Service”), provided by LIFE 3.0 SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Olsztyn, ul. Chabrowa 6, 10-843 Olsztyn, KRS 0001181735, NIP 7394019113, REGON 542137104 (hereinafter: the “Company” or the “Controller”).
II. BASIC INFORMATION
WHO processes your data?
LIFE 3.0 Sp. z o.o. with its registered office in Olsztyn — the data controller. Contact: office@femicode.io
WHAT data do we collect?
Only the data that you provide in the Questionnaire yourself (including information about your cycle, symptoms, lifestyle and age) and — if you purchase a Report — your email address and transaction data.
WHY?
To generate your free initial summary and — at your request — a paid educational Report.
ON WHAT LEGAL BASIS?
Performance of a contract (Art. 6(1)(b) GDPR) and your explicit, separate consent to the processing of health data (Art. 9(2)(a) GDPR).
HOW LONG do we store the data?
Data from the Questionnaire alone — for a maximum of 24 hours if you do not purchase a Report. Questionnaire data related to a purchased Report — for a maximum of 30 days.
DO WE CREATE AN ACCOUNT?
No. FEMICODE does not require registration and does not maintain User accounts or permanent User profiles.
WHO DO WE SHARE THE DATA WITH?
Only with technical service providers acting on our behalf (hosting, AI Engine, email) and the Payment Provider — never with medical partners without your separate consent.
WHAT RIGHTS DO YOU HAVE?
The rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent at any time.
WHERE CAN YOU LODGE A COMPLAINT?
With the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
! Consequence of not providing consent
Consent to the processing of health data is voluntary but necessary to complete the Questionnaire and obtain a summary or Report — without this consent, the Service is unable to provide a service which, by its very nature, requires the processing of the health data you provide.
The full rules governing data processing — including a detailed list of the categories of data, purposes, legal bases, retention periods, recipients and applicable rights — are provided below.
III. DATA CONTROLLER AND CONTACT DETAILS
Data Controller
LIFE 3.0 SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Chabrowa 6, 10-843 Olsztyn, Poland
KRS / NIP / REGON
KRS: 0001181735 / NIP: 7394019113 / REGON: 542137104
General contact
Data Protection Officer (DPO)
Krzysztof Jan Łukaszuk
IV. SOURCE AND CATEGORIES OF PERSONAL DATA
The Service is exclusively an online form (Questionnaire) accessible through a web browser. The Service is not a mobile application, does not require registration or an account, and does not integrate with wearable devices, physical activity monitoring applications or external health databases. You are the sole source of your data — the data that you enter into the Questionnaire yourself and manually, as well as the data provided in connection with a potential purchase of a Report.
Health data (Questionnaire)
Cycle regularity and length, symptoms, subjective stress level, age
Provided directly by you
Contact data
Email address (only when purchasing a Report)
Provided directly by you
Transaction data
Payment status and date, amount, transaction identifier
Provided by the Payment Provider
Technical data
IP address, timestamps, technical event data
Collected automatically in connection with your use of the Service
✘ What we DO NOT collect
The Service does not automatically retrieve data from wearable devices, health applications, social media or other external sources. We also do not collect any special categories of data other than the data you choose to provide in the Questionnaire, and we do not combine such data with any external database that identifies you by name.
V. PURPOSES, LEGAL BASES AND RETENTION PERIODS
Generating a free initial summary
Art. 6(1)(b) GDPR (contract) in conjunction with Art. 9(2)(a) GDPR (consent)
Health data from the Questionnaire
Up to 24 hours after the end of the session if you do not purchase a Report
Generating and delivering a paid Report
Art. 6(1)(b) GDPR (contract) in conjunction with Art. 9(2)(a) GDPR (consent)
Health data, email address
Up to 30 days after delivery of the Report, unless you request earlier erasure
Processing payments and complying with tax obligations
Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR (legal obligation)
Email address, transaction data
5 years (tax regulations)
Service security and prevention of misuse
Art. 6(1)(f) GDPR (legitimate interest)
IP address, technical logs
12 months
Analytical and research purposes (model development and validation)
Art. 9(2)(a) GDPR (separate, voluntary consent)
Pseudonymised health data
For the period specified in the separate consent
Marketing communications
Art. 6(1)(a) GDPR (separate, voluntary consent for each communication channel)
Email address
Until consent is withdrawn
Evidence of consent
Art. 7(1) GDPR (obligation to demonstrate consent)
Consent metadata (checkbox, timestamp)
Up to 6 years (limitation period for claims)
VI. DATA RECIPIENTS AND DATA TRANSFERS
Your data may be disclosed exclusively to the following categories of recipients, on the basis of data processing agreements (processors) or to independent controllers:
- a hosting or cloud infrastructure provider — processing Input Data and generating the Report (processor);
- a provider of the AI Engine or generative model used to analyse the Questionnaire and generate the Report (processor);
- the Payment Provider (e.g. Stripe, PayU) — as an independent controller of transaction data and payment card data, in accordance with its own privacy policy;
- an email service provider — solely for the purpose of delivering the Report and purchase confirmations (processor).
The Service does not disclose your data to medical partners or third parties for marketing purposes without your separate, voluntary and prior consent given individually for each such entity.
Transfers of data outside the European Economic Area (EEA)
If any of the providers referred to above processes data outside the EEA, the transfer is carried out solely on the basis of mechanisms provided for under the GDPR — in particular, a European Commission adequacy decision (Art. 45 GDPR) or Standard Contractual Clauses (Art. 46 GDPR), together with additional technical and organisational safeguards to mitigate risk.
VII. RULES FOR PROCESSING SPECIAL CATEGORIES OF DATA (HEALTH DATA)
The data entered in the Questionnaire (concerning your cycle, symptoms and intimate health) constitute a special category of data within the meaning of Art. 9(1) GDPR. Such data are processed solely on the basis of your explicit, unambiguous consent (Art. 9(2)(a) GDPR), given by means of a dedicated checkbox that is never selected by default.
A separate consent is collected for each distinct processing purpose — in particular, separately for: generating the summary or Report, using data for analytical and research purposes, and marketing communications. Refusal to provide an additional consent (e.g. for analytical and research purposes) does not affect your ability to use the basic function of the Service.
✓ You may withdraw your consent at any time
You may withdraw your consent to the processing of health data at any time, without giving a reason, by writing to the Company's email address. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before its withdrawal. As the Service does not provide accounts, please indicate in your message the email address provided when purchasing the Report (if applicable) so that we can identify your data.
VIII. AUTOMATED DECISION-MAKING AND PROFILING
The Service's AI Engine analyses your Questionnaire responses in order to match them to general, static educational profiles and generate a descriptive summary and Report. This process does not constitute automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR — the Report is provided solely for informational and educational purposes, and you always make your own decision about how to interpret its content and whether to seek medical advice.
§ Basis for the non-application of Art. 22 GDPR
The AI Engine does not generate a diagnosis, assess the probability of disease or provide personalised therapeutic recommendations. It only provides information about the statistical match between the data you declare and a general educational profile, without any decision-making element producing legal effects.
IX. RIGHTS OF DATA SUBJECTS
In connection with the processing of your personal data, you have the following rights:
Right of access (Art. 15 GDPR)
You may request information about whether and which of your data we process and obtain a copy of such data
Right to rectification (Art. 16 GDPR)
You may request the correction of inaccurate data or the completion of incomplete data
Right to erasure (“right to be forgotten”, Art. 17 GDPR)
You may request the erasure of your data, particularly after withdrawing consent
Right to restriction of processing (Art. 18 GDPR)
You may request the temporary restriction of processing in specific circumstances
Right to data portability (Art. 20 GDPR)
You may receive your data in a structured, machine-readable format
Right to object (Art. 21 GDPR)
You may object to processing based on the Controller's legitimate interest
Right to withdraw consent (Art. 7(3) GDPR)
At any time, without affecting the lawfulness of processing carried out before its withdrawal
Right to lodge a complaint (Art. 77 GDPR)
With the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland
! Exercising rights without an account
As the Service does not maintain User accounts, the above rights may be exercised by contacting the Data Protection Officer by email, subject to an appropriate procedure for verifying the identity of the person making the request, in accordance with the Data Subject Rights Procedure. The Controller will respond without undue delay and no later than one month after receiving the request.
X. DATA SECURITY
The Controller applies appropriate technical and organisational measures to protect your data, including in particular:
- encryption of data at rest (AES-256) and in transit (TLS 1.3);
- architectural separation of identification data (e.g. email address) from health data used for analytical purposes;
- pseudonymisation of data used for analytical and research purposes;
- the principle of least privilege and multi-factor authentication (MFA) for administrative access;
- a mechanism for the automatic erasure of data after the applicable retention periods have expired;
- security monitoring and a procedure for responding to personal data breach incidents, including notification to the supervisory authority within 72 hours.
XI. COOKIES AND TRACKING TECHNOLOGIES
The Service uses cookies and similar technologies to ensure that the form functions properly, remember progress made in completing the Questionnaire during a single session and — solely with your separate consent — for analytical and statistical purposes. Detailed rules governing the use of cookies, including their types, purposes and the way in which consent is managed, are set out in the separate Cookie Policy available on the Service.
XII. CHANGES TO THE PRIVACY POLICY
The Controller reserves the right to amend this Policy, in particular in connection with changes in the law, changes to the functional scope of the Service or changes in the categories of data recipients. The current version of the Policy is always available on the Service. A purchase of a Report is governed by the version of the Policy in effect when the order is placed.
XIII. CONTACT
For all matters relating to personal data protection, you may contact us at: office@femicode.io or in writing at: LIFE 3.0 Sp. z o.o., ul. Chabrowa 6, 10-843 Olsztyn, Poland.