Privacy Policy
Last Updated
August 20, 2026
Introduction
This policy explains what we collect, why, who sees it, how long we keep it and what you can do about it. It applies to qenhealth.com, the Qen customer portal, and everything we do through them.
We are Qen Health USA, Inc., a Delaware corporation, 131 Continental Dr, Suite 305, City of Newark, County of New Castle, Delaware 19713.
1. The short version
You tell us about your health so a practitioner can personalize a treatment for you. That is the only reason we ask.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We place no advertising or analytics trackers on our intake pages or in the customer portal.
We never use what you tell us in your intake for marketing unless you have separately authorized it. That authorization is its own form, it is optional, and you can withdraw it at any time.
Our practitioners are based in various locations, so your intake information is accessed from outside the United States. Section 5 explains how that works.
You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, at privacy@qenhealth.com.
2. What we collect, why, and for how long
This is the notice California law requires us to give you at or before the point we collect anything.
2.1 Identifiers
Examples: Name, email, postal address, phone, IP address, device information, account ID.
Why: Create and run your account, deliver your order, contact you, prevent fraud.
How long we keep it: Life of your account, then 3 years.
2.2 Health information (sensitive)
Examples: Your intake answers: cycle, energy, sleep, mood, digestion, life stage. Messages you send a practitioner in the portal, photographs you upload, bloodwork you choose to upload.
Why: Personalize your treatment and check our formulas are a good fit for you. Nothing else.
How long we keep it: Life of your account, then 6 years.
2.3 Partial intake answers (sensitive)
Examples: Answers you entered but did not submit.
Why: So you can pick up where you left off.
How long we keep it: 90 days, then deleted, unless you create an account.
2.4 Commercial Information
Examples: Orders, subscription status, refunds, delivery records.
Why: Fulfill and support your orders, keep tax and accounting records.
How long we keep it: 7 years
2.5 Payment Information
Examples: Card type, last four digits only, expiry, billing address, payment token.
Why: Take payment and process refunds.
How long we keep it: Life of your account, then 7 years.
2.6 Internet and device activity
Examples: Pages viewed, referring page, browser, device type, approximate location from IP.
Why: Keep the site working and secure.
How long we keep it: 24 months
2.7 Communications
Examples: Emails, portal messages, support tickets.
Why: Support you, keep a record of what was said.
How long we keep it: Life of your account, then 3 years.
2.8 Inferences
Examples: Which formula pattern fits you best.
Why: Personalize your treatment.
How long we keep it: Life of your account, then 6 years.
We never see or store your full card number. Our payment processor, Stripe, collects and holds your card details directly. We receive only the last four digits and a token we can use to charge you. Stripe also collects technical information such as your IP address and device data to prevent fraud, under its own privacy policy.
Sensitive personal information. Your health information and your partial intake answers are sensitive personal information under California law. We use and disclose them only for the purposes listed above, which are the purposes California law permits without a separate right to limit. We do not use them to infer characteristics about you, and we do not use or disclose them for any other purpose. If we ever want to, we will ask you first.
3. Abandoned and partial intakes
If you start the intake and do not finish, we keep what you have entered so you can pick up where you left off rather than starting over.
You accept our Terms and this policy before the first health question, so nothing about your health is collected before you have agreed to it.
If you do not create an account, we delete a partial intake after 90 days.
You can ask us to delete it sooner, at any time, at privacy@qenhealth.com, and we will.
We do not use partial intakes for marketing unless you have given the separate marketing authorisation described in section 8.
4. Cookies and tracking
We use cookies and similar technologies that are strictly necessary to run the site and keep it secure, plus a limited set of analytics to understand what is working.
We place no advertising or analytics trackers on the intake pages or in the customer portal. Those are the pages where you tell us about your health, and we keep third parties out of them.
We honour Global Privacy Control. If your browser sends a GPC signal we treat it as a request to opt out of any sale or sharing, as California law requires.
You can control cookies in your browser and through our cookie banner. Turning off strictly necessary cookies will break parts of the site.
5. Who sees your information
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have not done either in the last 12 months.
We disclose personal information to the following, only as needed, and each is contractually restricted to using it on our instructions and for that purpose alone:
5.1 Our practitioners
What they receive: Your intake and your portal messages.
Why: To review whether our formulas are a good fit and to personalize your treatment.
5.2 Stripe, our payment processor
What they receive: Your payment and billing details.
Why: To take payment and process refunds.
5.3 Our fulfillment and dispensing partner
What they receive: Name, address, phone, and what to send.
Why: To prepare and dispatch your order.
5.4 Our shipping carriers
What they receive: Name, address, phone.
Why: To deliver your order.
5.5 Our hosting and infrastructure providers
What they receive: Data stored on our systems.
Why: To host and secure the Service.
5.6 Our email and messaging providers
What they receive: Name, email, phone.
Why: To send you messages about your order and your account.
5.7 Our customer support tools
What they receive: What you write to support.
Why: To answer your questions.
5.8 Professional advisers
What they receive: Only what is relevant.
Why: Legal, accounting and audit.
5.9 Government and regulatory authorities
What they receive: Only what is required.
Why: Where the law requires it, or to protect someone's safety
5.10 A buyer of the business
What they receive: Your information, on a merger or sale.
Why: We will tell you before your information becomes subject to a different policy.
5.11 Our group companies
What they receive: what their role requires, for example practitioner engagement or running the platform.
Why: companies in the Qen group help operate the Service, under the same confidentiality obligations as Qen itself.
About our use of artificial intelligence. We use software to help organise and summarise intake information for our practitioners. This runs on our own systems and your information is not sent to an outside AI company. A practitioner, not software, decides whether our formulas are a good fit for you.
6. Your information and Hong Kong
Our practitioners are based in Hong Kong. Your intake information and your portal messages are accessed by them from Hong Kong so they can review your intake and personalise your treatment. This is a core part of how the Service works and we want you to know it rather than find it in a footnote.
Access is limited to the practitioner working on your treatment and the small team supporting her.
Each practitioner is under a written confidentiality agreement applying United States confidentiality standards to your information.
Access is logged, and takes place over encrypted connections to systems we control.
7. California Confidentiality of Medical Information Act
Because Qen offers a reproductive and sexual health digital service, California treats us as a provider of health care for the purposes of the Confidentiality of Medical Information Act (Civil Code Part 2.6). That is a privacy classification. It does not mean we provide medical care, and California law says expressly that it does not make us a provider of health care for the purposes of any other law.
What it means for you:
Your medical information is confidential. We will not disclose it without your written authorization, except where the law specifically permits or requires it.
We will not use it for marketing without your separate written authorization. See section 8.
You have rights of access and correction under that Act, in addition to the rights in section 9.
8. Marketing
Marketing is always optional and never a condition of buying anything.
Email and text messages are separate. Saying yes to one does not sign you up to the other.
Using your health information to personalize marketing needs its own written authorization, on its own form, signed and dated by you, valid for one year unless you renew it.
You can withdraw at any time: unsubscribe in any email, reply STOP to any text, or change it at Account then Communications. Withdrawing takes effect promptly and we honor it across every channel.
We will still send you messages about your order and your account, such as your treatment decision, your charge, delivery updates and changes to these documents. Those are not marketing and you cannot opt out of them while you have an account.
9. Your rights and how to use them
If you are a California resident you have the following rights. We extend them to everyone we serve, because we would rather run one standard than two.
Know: Ask what we have collected about you, where it came from, why, and who we disclosed it to.
Access: Get a copy, in a portable format.
Correct: Have inaccurate information about you corrected.
Delete: Have your information deleted, subject to narrow exceptions such as records we must keep for tax or safety reasons.
Limited use of sensitive information: We already limit it to the purposes in section 2, so there is nothing further to restrict, but you can ask us to confirm this.
Opt out of sale or sharing: We do not sell or share. You can still register the preference, and we honor Global Privacy Control.
No retaliation: We will not deny you service, charge you differently or give you a worse experience for exercising any of these rights.
How to ask: email privacy@qenhealth.com, or use Account then Privacy in the portal. We confirm within 10 business days and respond within 45 days, extendable once by a further 45 days if we tell you why. We verify who you are before acting, usually by asking you to confirm details from your account. An authorised agent may act for you with written permission, and we may still verify with you directly.
Shine the Light. California Civil Code section 1798.83 lets California residents ask about disclosure of personal information to third parties for those parties' own direct marketing. We do not make such disclosures. You may confirm this by writing to privacy@qenhealth.com.
10. Security
We use encryption in transit and at rest, role-based access so people see only what their job requires, access logging, multi-factor authentication for staff, and a vendor review process. No system is perfectly secure. If a breach affects your information we will notify you as required by law, including under the New York SHIELD Act, California Civil Code sections 1798.29 and 1798.82, and the Federal Trade Commission Health Breach Notification Rule.
11. Children
The Service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact privacy@qenhealth.com and we will delete it.
12. Changes to this policy
We will post any change here with a new date at the top. If a change is material we will tell you in advance, at least 5 and no more than 30 days before it takes effect, by the method you normally hear from us. If a change would mean using your health information in a new way, we will ask for your consent rather than assume it.
13. Contact
Privacy questions and requests: privacy@qenhealth.com
General support: support@qenhealth.com
Post: Qen Health USA, Inc., 169 Madison Ave, Suite 79841, New York, NY 10016, United States Attention: Privacy
If you are not satisfied with our response you may contact the California Privacy Protection Agency, the California Attorney General, or the New York Attorney General.