Privacy Policy
Plain-English. The legal phrasing exists because health data deserves clear handling — not because we want to hide what we do with it.
Last updated · October 8, 2026
1. Who we are
Avafem never sells your personal information, and we ask your permission before we collect any health information. This policy explains what we collect, why, and the choices you have.
Avafem LLC is a Texas limited liability company at 600 Guadalupe St, Austin, TX 78701. We run avafem.com, an evidence-based feminine care and wellness marketplace. Questions about privacy go to privacy@avafem.com.
Avafem is not a healthcare provider, and nothing on Avafem is medical advice or a diagnosis. Because we aren't a healthcare provider or health plan, the federal HIPAA law generally doesn't apply to us. We protect your health information under this policy and the consumer health privacy laws that do apply to us.
Who can use Avafem. You must be 18 or older to create an account. We don't knowingly collect information from anyone under 18. If we learn we have, we delete it.
2. Information we collect
We collect health information only after you tick the health consent box, and you can use most of Avafem without giving any.
| What | Examples | When we collect it |
|---|---|---|
| Account information | Name, email address, sign-in details, and your confirmation that you're 18 or older. If you sign in with Google, we receive your name, email and profile photo from Google. | When you create an account |
| Profile choices | Wellness goals, and an optional public profile (display name, handle, bio, photo) | When you fill in your profile |
| Health information | Intake answers (cycle length, period length, cycle phase, symptoms, allergies, lifestyle, goals), symptom and mood logs, cycle dates, and a life stage of pregnancy, postpartum, perimenopause or menopause | Only after you give health consent |
| Chat messages | Questions you ask the Avafem shopping assistant | When you use chat; see section 4 |
| Shopping information | Saved items, your bag, orders, shipping address, subscriptions, loyalty rewards, gift registries, your Vanity cabinet | When you shop or place an order |
| Reviews and events | Reviews, helpful votes, community posts, comments and upvotes, ritual check-ins, events you sign up for | When you post or register |
| Messages to us | Emails and support tickets | When you contact us |
| Device and usage information | Pages viewed, clicks, browser and device type, approximate location based on your IP address | Analytics only if you accept analytics cookies; basic security logs always |
We don't ask about diagnosed medical conditions.
3. How we use it, and what we never do
We use your information to run Avafem for you and, only with your permission, to personalize it.
- Run your account: sign you in, keep your settings, keep the site secure and prevent fraud.
- Personalize (with health consent): match products to your cycle phase and symptoms, and write your Cycle Summary from Avafem's educational knowledge base.
- Answer chat questions: send your question to our AI provider to write a reply (section 4).
- Process orders: pass your order to our checkout partner and the brand that ships it.
- Email you: account emails (like sign-in codes) through Clerk; marketing only if you ticked the marketing box.
- Improve the site: understand which pages work, using analytics only if you accepted analytics cookies.
- Meet legal duties: keep tax and order records and respond to lawful requests.
What we never do:
- Sell your personal information.
- Share your health information with brands or advertisers, or use it for targeted ads.
- Let our AI providers use your information to train their models.
- Diagnose, treat or give medical advice.
Sponsored placements. Brands may pay to have a product featured. Paid placements are always labeled "Sponsored," and brands don't receive any of your personal information for them.
Public content. Reviews, community posts and comments you publish can be seen by anyone. Your cycle phase, symptoms or life stage appear on them only if you choose to add them, and adding them requires health consent.
4. How we protect health information
Your health information is kept encrypted in its own part of our database, and you can delete it at any time.
- Separate consent. Intake, the symptom log and chat ask for your health consent first. Without it, nothing health-related is saved.
- Encrypted storage. Health information is encrypted with AES-256 before it's stored, in tables kept apart from your account details. Everything travels over encrypted connections (TLS).
- No names sent to AI. When an AI feature uses your information, we remove your name and contact details first.
- Chat is short-lived. We keep your conversation for 2 hours after your last message so the assistant can follow along, with names and contact details removed. If a message raises a safety concern, we keep a short excerpt (up to 400 characters, names removed) until you withdraw consent or delete your account, and no longer than 2 years after your last activity.
- Withdraw anytime. In Settings, "Withdraw consent and delete my health data" deletes your intake answers, cycle and symptom logs, health life stage, the health details on your reviews and posts, and any safety excerpts. Your account stays open.
- Limited access. Only the people who need to run the service can access our systems, our admin tools don't display members' health information, and we keep a record of when you gave or withdrew consent.
5. Who we share it with
We share information only with the companies that help us run Avafem, under contracts that limit how they use it.
| Company | What they do | What they receive |
|---|---|---|
| Vercel | Hosts the website | All site traffic, to deliver pages |
| Neon | Hosts our database | Stored information (health information stays encrypted) |
| Clerk | Sign-in, account security and account emails | Name, email, photo, sign-in details, 18+ confirmation |
| OpenAI | AI for chat, your Cycle Summary, search and product matching | The text needed for each request, with name and contact details removed, sent with a setting that tells OpenAI not to store it |
| PostHog | Website analytics | Usage and device information, only if you accept analytics cookies |
| Google Workspace | Our email inboxes, when you write to us | Your message and email address |
| Tally | Our waitlist sign-up form | First name and email, if you join the waitlist |
| Violet and the brand you buy from | Checkout, payment and shipping | Name, shipping address, order details |
We may also share information when the law requires it, to protect someone's safety, or as part of a merger or sale of Avafem. In a sale, the buyer must keep the promises in this policy, including those about health information.
6. Cookies and analytics
Analytics cookies are off until you say yes.
- Essential cookies keep you signed in, remember your bag and language, remember that you confirmed you're 18 or older, and protect the site. They're always on.
- Analytics cookies (PostHog) help us see how the site is used. They're set only if you accept them in the cookie banner.
- You can change your choice anytime with the Cookie settings link at the bottom of every page.
Our Cookie Policy lists each cookie by name.
7. How long we keep it
Health information is deleted automatically after 2 years without account activity, and immediately if you withdraw consent or delete your account.
| Information | How long we keep it |
|---|---|
| Health information | Until you withdraw consent or delete your account, and no longer than 2 years after your last activity |
| Account information | Until you delete your account; deletion takes effect immediately |
| Order and payment records | As long as tax and accounting laws require, usually up to 7 years |
| Analytics data | As long as PostHog keeps it under our settings, without your name |
| Database backups | Deleted information can remain in encrypted database backups for up to 30 days |
| Chat conversations | 2 hours after your last message |
| Consent records | While your account exists; deleted with your account |
8. Your choices and rights
You can see, download, correct or delete your information, and most of it you can do yourself.
- Download your data: use the "Download my data" button in Account → Privacy, or ask us.
- Correct it: update your profile in Settings, or ask us.
- Delete your account: in Account → Privacy, or by emailing privacy@avafem.com.
- Withdraw health consent: in Settings. This deletes your health information.
- Stop marketing emails: untick the box in Settings or use the unsubscribe link in any email.
- Analytics cookies: turn them off with the Cookie settings link.
Depending on where you live, including Texas, California, Washington and other states, you may have more rights under state law. We honor these requests for everyone, wherever they live. We answer within 45 days and won't treat you differently for using your rights.
To make a request, email privacy@avafem.com from the address on your account. Someone you authorize may also ask on your behalf, and we'll confirm it with you. If we turn down a request, you can appeal by replying with "Appeal" in the subject line. We answer appeals within 60 days. If you disagree with the result, you can contact your state attorney general.
9. Security incidents, changes and contact
If something goes wrong. If a security incident affects your information, we'll tell you and the authorities as the law requires, including under the FTC's Health Breach Notification Rule.
Where your data is stored. Avafem operates in the United States, and your information is stored and processed there.
Changes to this policy. We'll post any update here with a new "Last updated" date. For important changes, we'll show a notice on the site before they take effect. We'll never use your health information in a new way without asking for your consent again.
Contact us. privacy@avafem.com, or Avafem LLC, 600 Guadalupe St, Austin, TX 78701.