Privacy policy

FeFe, currently operated as a sole trader in the United Kingdom, is the data controller for your FeFe account. When you take part in a study, the researcher running that study is the controller for the answers you give inside their survey, and their own privacy information applies there. Contact us at marianatmatthews@gmail.com with any privacy question or request.

FeFe is for adults. You must be 18 or over to hold an account. We do not knowingly collect data from children, and we delete any account we find belongs to someone under 18.

• Account details: name, email address, country, language and account type.
• Participant screening data: date of birth, cycle status, pregnancy status, diagnosed conditions, treatments and lived experiences. This is health data, a special category under UK GDPR.
• Health profile answers: the detail you give about your cycle, conditions, treatments, care and medication. These are health data, a special category under UK GDPR. You can edit or remove your answers at any time.
• Eligibility data: sex recorded at birth, and gender identity if you choose to give it. Sex at birth decides whether you can join the panel, because FeFe research covers health and product experiences of women with a female reproductive system. Gender identity is recorded for research context only and is never used to exclude anyone. Researchers never see either as identity, only as anonymised eligibility.
• Study activity: studies you take, time spent, completion codes, approval and rejection outcomes and your quality record.
• Payment data: your FeFe balance, transactions, and the payout details you enter for a cash out. Card payments from researchers are processed by Stripe. FeFe never sees or stores full card numbers.
• Researcher details: organisation name and type, studies, balance and transactions.

• To run your account and match you to studies: performance of our contract with you.
• To use your health answers for eligibility matching: your explicit consent, which you give when you complete screening and can withdraw at any time by editing your profile or closing your account.
• To keep the pool genuine, prevent bots, AI misuse and fraud, and to protect research quality: our legitimate interests.
• To pay you and keep financial records: contract and legal obligation.
• To send service emails about payments, submissions and payouts: contract.

Researchers never see your name, email address or contact details on FeFe. They see anonymous submission records, your completion code, time taken, quality flags and the eligibility criteria you matched. Your identity stays with FeFe unless you choose to give it to a researcher inside their own study.

• The providers listed on our subprocessors page, who host the platform, process card payments and send our emails.
• Authorities or advisers where we are legally required to, or to investigate fraud.

We never sell your data or use it to train AI models.

Account and screening data is kept while your account is open and deleted when you close it, except financial records which we keep for six years to meet UK tax and accounting rules, and a minimal record of suspended accounts so removed accounts cannot simply sign up again.

• Account details: while your account is open, then deleted on closure.
• Screening and profile answers, including your chosen topics: while your account is open, or until you withdraw consent, then deleted.
• Study activity and quality records: while your account is open, then deleted, except where needed for an open dispute.
• Financial records including transactions and payouts: six years from the end of the relevant tax year.
• Suspension record: a minimal record kept indefinitely so a removed account cannot simply sign up again.
• Support and complaint emails: two years from the last message.

You can access, correct, delete or export your data, withdraw consent for health data processing, object to processing, and ask us to restrict it. Use Settings in your account or email marianatmatthews@gmail.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Access to your data is controlled per account by database level security rules, financial balances can only be changed by our validated server processes, and traffic is encrypted in transit. Some of our providers process data outside the UK under appropriate safeguards such as the UK international data transfer addendum.

Our controls and how to report a vulnerability are on the security page. Every FeFe policy is listed on the legal page, including our AI policy and complaints process.