This website uses cookies
Read our Privacy policy and Terms of use for more information.
Effective Date: April 2026 · Last Updated: 2026-04-30
This Privacy Policy ("Policy") describes how Isabelle Feldhaus, the individual operating the Femme Fortified brand ("Femme Fortified," "we," "us," "our"), collects, uses, discloses, and protects information in connection with the Femme Fortified website (femmefortified.com), the Femme Fortified newsletter, and the Lab Results Explainer interactive tool (iron-labs.femmefortified.com) (collectively, the "Services").
This Policy is incorporated into and forms part of the Femme Fortified Terms of Service. By using the Services, you agree to the practices described in this Policy. If you do not agree, do not use the Services.
We apply the protections of the EU General Data Protection Regulation ("GDPR") to all users of the Services, regardless of where they are located, as our baseline standard. Where the laws of your jurisdiction grant you additional or stronger rights — for example, under U.S. state consumer privacy laws, the UK Data Protection Act 2018, or the Australian Privacy Act 1988 (Cth) — those rights also apply.
The data controller for the personal information described in this Policy is:
Isabelle Feldhaus
30 Lieu dit Queric
56470 La Trinité-sur-Mer, France
[email protected]
For privacy-related inquiries, including requests to exercise your rights under applicable law, contact us at: [email protected].
Femme Fortified is operated from France. Isabelle Feldhaus is not a licensed healthcare provider, and Femme Fortified is not a healthcare provider or covered entity under any applicable health-information law.
We collect information in the following categories.
(a) Newsletter subscription. When you subscribe to the Femme Fortified newsletter (hosted on Beehiiv), we collect your email address and, if you provide it, your name.
(b) Lab Results Explainer inputs (processed in your browser only). When you use the Lab Results Explainer, you enter lab values (such as ferritin, hemoglobin, and similar markers) and demographic context (age, life stage, dietary context).
These values are processed entirely in your browser and are never transmitted to our servers or stored by us. If you choose to download a personalized PDF, your values are briefly transmitted to a rendering function that generates the PDF and are discarded immediately after rendering — they are not persisted.
(c) Newsletter subscription via the Lab Results Explainer (with routing context). If, on the Lab Results Explainer results page, you enter your email to receive the PDF and subscribe to the Femme Fortified newsletter, your email address is transmitted to Beehiiv along with a routing-context payload that lets us send you newsletter content matched to your tool result. The full list of fields transmitted to Beehiiv is:
We also transmit standard subscription-attribution fields (utm_source, utm_medium, utm_campaign, and referring_site, where present). These fields never include your raw lab values — those stay in your browser. If you would prefer to subscribe without sending the routing context, you can subscribe via a footer form on a non-results page; those submissions carry no routing fields, only your email.
(d) Correspondence. When you contact us by email or through any other communication channel, we collect the information contained in your message.
(a) Site traffic (Cloudflare Web Analytics). Cloudflare Web Analytics records standard site metrics such as page views, referring sites, country-level geography, and browser and device type. Cloudflare Web Analytics is cookie-free and privacy-first; it does not create a profile that can be linked back to an individual user.
(b) Email engagement. Beehiiv collects information about whether and when you open emails and click on links within them.
(c) Cookies and similar technologies. We do not use cookies for tracking or advertising purposes. See Section 11 for details.
(a) Referrals and social sharing. If someone refers you to Femme Fortified or shares our content with you, we may receive information about that referral.
The lab values you enter into the Lab Results Explainer are health-related information. As stated above, those values are processed in your browser only and are never transmitted to or stored by us.
The routing-context fields described in Section 3.1(c) describe research-anchored patterns and life-stage context derived from your inputs. They are educational classifications, not clinical diagnoses. Some jurisdictions (notably the EU under GDPR Article 9) treat any data that reveals or infers health status as special-category personal data, even when derived from inputs you provided. We treat these fields as sensitive accordingly: they are stored only at Beehiiv, used only for newsletter routing, never sold or shared, and removable on request to [email protected].
By submitting the subscribe form on the Lab Results Explainer results page, you give explicit consent to the routing-context transmission described above. You may withdraw your consent at any time by emailing [email protected] or unsubscribing from the newsletter. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.
We use the information we collect for the following purposes:
(a) To deliver the Services. Including delivering the newsletter, generating personalized outputs from the Lab Results Explainer in your browser, and producing the optional PDF you request.
(b) To personalize the newsletter. Using the routing-context fields described in Section 3.1(c) to match each subscriber to relevant newsletter issues over time, and to route urgent-severity results to a separate email arc.
(c) To communicate with you. Including responding to your inquiries and sending newsletter content you have subscribed to receive.
(d) To improve the Services. Including understanding how visitors engage with our content and tools so we can improve them. Aggregated and de-identified data may be used for this purpose.
(e) To ensure security and prevent abuse. Including detecting and preventing fraud, unauthorized access, and violations of our Terms of Service.
(f) To comply with legal obligations. Including responding to lawful requests from public authorities, complying with tax and accounting obligations, and enforcing our legal rights.
We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. We do not use your information for advertising or behavioral profiling.
For users in the European Economic Area, the United Kingdom, and Switzerland, we process your personal information under the following legal bases:
(a) Consent (GDPR Article 6(1)(a) and, for routing-context fields, Article 9(2)(a)). For newsletter subscription and the routing-context payload transmitted to Beehiiv when you subscribe via the Lab Results Explainer.
(b) Legitimate interests (Article 6(1)(f)). For basic site analytics (Cloudflare Web Analytics), security, fraud prevention, and direct communications with you about Services you have used. We balance these interests against your rights and do not rely on legitimate interests where your rights would override them.
(c) Legal obligation (Article 6(1)(c)). Where processing is required to comply with a legal obligation (for example, tax or accounting laws).
You have the right to withdraw consent at any time (see Section 8).
We do not sell your data. Ever. We do not trade your data for promotional considerations. We do not share your data with advertisers, data brokers, or marketing partners.
We rely on the following third-party service providers, each of which processes a specific piece of data on our behalf under its own privacy terms and an applicable data-processing agreement:
(a) Beehiiv (newsletter platform). Processes your email address and the routing-context fields described in Section 3.1(c). Beehiiv privacy policy.
(b) Cloudflare (hosting and analytics). Hosts our websites and the Lab Results Explainer; processes site traffic data through Cloudflare Web Analytics. Cloudflare may process IPs for security purposes but does not expose them to us in identifiable form. Cloudflare privacy policy.
We share data with these providers only as necessary to deliver the newsletter and operate the Services. We do not share data for any other purpose.
We may disclose personal information if we reasonably believe disclosure is necessary to:
(a) comply with a legal obligation, court order, or lawful request from a governmental authority;
(b) enforce our Terms of Service or this Policy;
(c) protect the rights, property, or safety of Femme Fortified, our users, or others;
(d) detect, prevent, or address fraud, security, or technical issues.
If Femme Fortified is involved in a merger, acquisition, restructuring, financing, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice before personal information is transferred and becomes subject to a different privacy policy.
We may share aggregated or de-identified information that cannot reasonably be used to identify you.
We retain personal information only as long as necessary to fulfill the purposes for which it was collected, as required by law, or as necessary to defend our legal rights.
(a) Lab values entered into the Lab Results Explainer. Not retained at all — never transmitted to any server, never stored.
(b) Email address and routing-context fields in Beehiiv. Retained as long as you remain subscribed, plus a short grace period after unsubscribe for operational reasons (handling re-subscriptions and fraud prevention). On erasure request, both your email and all routing-context fields are removed.
(c) Cloudflare Web Analytics traffic data. Retained for 180 days (Cloudflare default).
(d) Correspondence. Retained for up to three (3) years for customer-service purposes, unless a shorter or longer retention period is legally required.
When we no longer need your personal information, we securely delete or anonymize it.
We extend the following rights to all users of the Services, regardless of your location:
(a) Right of access. You may request a copy of the personal information we hold about you.
(b) Right to rectification. You may request that we correct inaccurate or incomplete personal information.
(c) Right to erasure ("right to be forgotten"). You may request deletion of your personal information.
(d) Right to restrict processing. You may request that we stop processing your personal information in certain circumstances.
(e) Right to data portability. You may request that we provide your personal information in a portable format, or transfer it to another controller where technically feasible.
(f) Right to object. You may object to processing based on our legitimate interests, and you may object to direct marketing at any time.
(g) Right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Unsubscribing from the newsletter (one click at the bottom of any email) constitutes withdrawal of consent for newsletter processing.
(h) Right not to be subject to automated decision-making with legal or significant effects. We do not engage in automated decision-making that produces legal or significant effects on you.
(i) Right to non-discrimination. We will not deny you Services, charge different prices, or provide a different level of quality because you exercised any of these rights.
To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days, or sooner where required by applicable law (for example, GDPR's one-month timeline for EU/EEA, UK, and Swiss residents). We may need to verify your identity before acting on your request.
In addition to the rights in Section 8, the following jurisdiction-specific rights and authorities apply.
If you are located in the EEA, the United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection authority. In France, this is the Commission nationale de l'informatique et des libertés (CNIL) — www.cnil.fr. In the UK, this is the Information Commissioner's Office (ICO) — ico.org.uk.
Under state consumer privacy laws — including the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and similar laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, and Montana — you may have rights to access, delete, correct, and port your personal information, and to opt out of the sale or sharing of your personal information.
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. If our practices change, we will update this Policy and provide the opt-out mechanism required by applicable law.
For California residents specifically, you also have the right to limit the use of your "sensitive personal information" (which, under CCPA, includes health-related information) to purposes necessary to provide the Services. We use sensitive personal information only for the purposes described in Section 4 and only with your consent. You may designate an authorized agent to make a request on your behalf; we will require written authorization and verification of the agent's identity.
Categories of personal information collected (CCPA-specific disclosure). In the twelve (12) months preceding the Last Updated date above, we collected the following categories of personal information, as defined by CCPA:
If you are located in Australia, we handle your personal information in accordance with the Australian Privacy Principles ("APPs") set out in the Privacy Act 1988 (Cth), to the extent that Act applies to our processing of your information. Health information is "sensitive information" under the Privacy Act and is collected only with your consent and used only for the purpose for which it was collected.
In addition to the rights in Section 8, you have the option (where lawful and practicable) not to identify yourself or to use a pseudonym when interacting with us. (This is not practicable for newsletter delivery, which requires a valid email address.) You may make a privacy complaint to us at [email protected]; if you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au.
The Services are not intended for use by individuals under seventeen (17). The Lab Results Explainer prevents under-17 users from proceeding past the age-entry field. We do not knowingly collect personal information from individuals under seventeen (17). If you believe we have collected personal information from a child under seventeen (17), please contact us at [email protected] and we will promptly delete the record.
We do not use cookies for tracking or advertising purposes. We do not use advertising cookies, cross-site tracking cookies, or cookies that share your personal information with third-party advertisers.
Cloudflare Web Analytics, our analytics provider, is cookie-free. The only cookies that may be set are strictly necessary for the Services to function (for example, to maintain session state on the Lab Results Explainer or to remember a cookie-consent choice).
You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Where required by applicable law, we will obtain your consent before setting non-essential cookies and provide a mechanism to withdraw that consent.
We are based in France. Our service providers (Beehiiv and Cloudflare) are headquartered in the United States or operate globally. This means your personal information may be transferred to, stored, or processed in countries outside the EEA, the United Kingdom, Switzerland, Australia, or your country of residence.
Where personal information is transferred outside the EEA, the United Kingdom, or Switzerland, we rely on appropriate safeguards, which may include Standard Contractual Clauses approved by the European Commission, adequacy decisions by the European Commission, or other lawful transfer mechanisms permitted under applicable law. For Australian residents, we take reasonable steps under APP 8 to ensure that overseas recipients of your personal information handle it in a manner consistent with the APPs.
Cloudflare is a signatory to Standard Contractual Clauses for EU-to-U.S. transfers and, where applicable, participates in the EU-U.S. Data Privacy Framework. You may request additional information about the safeguards we use by contacting us at [email protected].
We take reasonable measures to protect your data:
(a) the Services are served over HTTPS (TLS) exclusively;
(b) Beehiiv and Cloudflare implement industry-standard security controls;
(c) administrative interfaces are password-protected, and credentials are not shared or stored insecurely;
(d) lab values are processed in your browser and never persisted on our servers (see Section 3.1(b)).
No method of transmission or storage is completely secure, however. We cannot guarantee absolute security, and you transmit information to us at your own risk.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the applicable supervisory authority (in our case, CNIL in France) without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk, we will also notify you directly without undue delay, as required by GDPR Article 34. We will comply with equivalent notification obligations under the UK GDPR, applicable U.S. state laws, and the Australian Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).
The Services may contain links to third-party websites, platforms, or services (including Beehiiv, Cloudflare, and social-media platforms). We are not responsible for the privacy practices of those third parties. Their use of your information is governed by their own privacy policies, which we encourage you to review.
We may update this Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this Policy. For material changes, we will provide reasonable notice — such as by email to subscribers, by prominent notice on the Femme Fortified website, or by other appropriate means. Your continued use of the Services after the effective date of the revised Policy constitutes your acceptance of the changes.
Some browsers allow you to send a "Do Not Track" signal. Because there is no common standard for interpreting these signals, we do not currently respond to them. We do not engage in the kinds of cross-site tracking that these signals are primarily intended to address.
For questions about this Policy, or to exercise any of the rights described above, please contact:
Isabelle Feldhaus
30 Lieu dit Queric
56470 La Trinité-sur-Mer, France
[email protected]
We will respond to all requests within the timeframes required by applicable law, and within thirty (30) days as a default.
The science behind feeling better. The context to make your own choices.
The weekly newsletter, plus longer essays on Substack. All information provided is educational and should not be interpreted as medical advice nor replace the advice of your health provider.