Privacy Policy

1. Introduction

FEM Rebalance ("FEM", "we", "us") respects the privacy of all participants in the FEM Rebalance program. This privacy policy describes what personal data we collect, how we process it and what rights you have.

This policy applies to the platform femrebalance.nl and all associated services.

2. Data Controller

FEM Business Club is the data controller within the meaning of the General Data Protection Regulation (GDPR). For questions about this privacy policy, please contact us via our contact form.

3. What Data We Collect

We collect the following categories of personal data:

3.1 Account Data

• Name (first and last name)
• Email address
• Profile photo (optional)
• Language preference

3.2 Health Data (Special Category Data)

When participating in the program, you may voluntarily enter the following health data:

• Body weight and body composition measurements
• Menstrual cycle and hormone data
• Sleep, stress and energy levels
• Nutrition and exercise records
• Intake questionnaire (health questions, goals, lifestyle)

3.3 Connected Device Data

If you connect an Oura Ring or other wearable device to your account, we receive:

• Sleep data (duration, bedtime, wake time)
• Activity data (steps)
• Stress scores

This connection is entirely optional. You can disconnect at any time via your profile page.

3.4 Community Data

• Posts and comments in the group feed
• Private messages to coaches and fellow participants

3.5 Technical Data

• IP address and browser information (session security)
• Login timestamps

4. Legal Basis for Processing

We process your data on the following legal bases:

• Performance of contract: account data and program-related data are necessary to deliver the program.
• Explicit consent: health data is only processed with your explicit consent. You can withdraw this consent at any time.
• Legitimate interest: technical data for security and fraud prevention.

5. Purpose of Processing

We use your data exclusively for:

• Providing and personalizing the program
• Tracking your progress and generating insights
• Communication about the program (email notifications, coach messages)
• Group functionality and community interaction
• Improving our services
• Platform security

6. Sharing with Third Parties

We do not share your personal data with third parties, except:

• Hosting: our hosting provider processes data on our behalf on servers within the EU.
• Oura Health Oy: if you connect your Oura Ring, data is exchanged via the Oura API.
• Legal obligation: if we are legally required to do so.

We never sell your data to third parties.

7. Security

We take appropriate technical and organizational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS)
• Hashed passwords (bcrypt)
• Secured OAuth2 connection for external devices
• Session security and automatic timeouts
• Role-based access control

8. Retention Periods

• Account data: retained as long as you have an active account.
• Health and tracking data: retained during your participation and up to 12 months after the program ends, unless you request deletion sooner.
• Community messages: retained as long as the program is active.

9. Your Rights

Under the GDPR, you have the following rights:

• Access: you can request which data we process about you.
• Rectification: you can have incorrect data corrected.
• Erasure: you can request deletion of your data.
• Restriction: you can request restriction of processing.
• Portability: you can receive your data in a common format.
• Objection: you can object to processing.
• Withdrawal of consent: you can withdraw your consent for the processing of health data at any time.

To exercise your rights, please contact us via our contact form. We will respond to your request within 30 days.

10. Cookies

The platform only uses functional session cookies that are necessary for the operation of the platform (login, language preference). We do not use tracking or marketing cookies.

11. Complaints

If you have a complaint about the processing of your personal data, you can contact us or file a complaint with the Dutch Data Protection Authority.

12. Changes

We reserve the right to modify this privacy policy. In case of substantial changes, you will be notified via email or a notification in the platform.