Carrot Fertility, Inc. (“Carrot Fertility”) and Carrot Medical, LLC (“Carrot Medical”) are committed to protecting your privacy. This Privacy Notice explains how your Personal Information is collected, used, stored, processed, transferred, and disclosed by Carrot Fertility and Carrot Medical (collectively, “Carrot,” “we,” “our,” or “us”).
This Privacy Notice applies to our website https://get-carrot.com (our "Website") and any other website, mobile application, or online service that links to this Privacy Notice (collectively, our "Service").
The Service may contain links to and from third party websites of our business partners, advertisers, and social media sites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. We may also share a user ID with third-party websites allowing us and the third-party website provider to jointly track specified activities across both websites. We strongly recommend that you read their privacy policies and terms and conditions of use to understand how they collect, use, and share information. We are not responsible for the privacy practices or the content on the websites of third party sites.
Before accessing or using our Service, please ensure that you have read and understood our collection, storage, use, and disclosure of your Personal Information as described in this Privacy Notice.
This Privacy Policy does not apply to Carrot’s use and disclosure of Protected Health Information.
Carrot Medical uses and discloses Protected Health Information about Carrot Medical patients in accordance with its Notice of Privacy Practices. Carrot Medical uses and discloses Protected Health Information about Carrot Medical patients in accordance with its obligations as a HIPAA Covered Entity.
In addition, to the extent that you are subject to United States benefit and taxation laws, and that your employer has established a health reimbursement arrangement plan (“HRA”), Carrot uses and discloses Protected Health Information that it receives from or on behalf of the HRA as a Business Associate under a Business Associate Agreement with the HRA . Please review the HRA’s Notice of Privacy Practices for an explanation of how the HRA uses and discloses your Protected Health Information.
Carrot is the “Data Controller” responsible for protecting your Personal Information, which means we determine and are responsible for how your Personal Information is handled. If your access to Carrot is sponsored by an employer, health plan, or other benefit sponsor (collectively, a "Plan Sponsor"), the Plan Sponsor will initially send us your name and eligibility information ("Eligibility File"). If you have queries regarding the information contained in the Eligibility File, please contact your Plan Sponsor.
"Personal information" encompasses all “Personal Data” as defined in Art. 4 (1) of the General Data Protection Regulation ("GDPR"), meaning any information that relates to an identified or identifiable individual; provided, that in such circumstance(s) that applicable data protection laws require otherwise, “Personal information” has the meaning ascribed to it in such law(s).
If your state of residence has specific privacy requirements that go beyond the general scope of this Privacy Notice, it is listed below:
Please click here to see more detailed information.
If you are a resident of Washington, you can also click here.
If you are resident of Nevada, you can also click here.
Also, please note that we will update this list as necessary to address evolving operations and regulations.
If you are a resident of a state that is not listed above, please contact us at legal@get-carrot.com if you have any questions about this Privacy Notice.
If your country of residence has specific privacy requirements that go beyond the general scope of this Privacy Notice, it is listed below:
Please click here to see more detailed information.
Also, please note that we will update this list as necessary to address evolving operations and regulations.
If you are a resident of a jurisdiction that is not listed above, please contact us at legal@get-carrot.com if you have any questions about this Privacy Notice.
In order to provide services, Carrot will store and process your Personal Information in the United States. To the extent that your local jurisdiction considers this an “international data transfer,” we will comply with that jurisdiction’s requirements for transferring Personal Information to other countries.
For Residents of the EEA, Switzerland, and the United Kingdom
When your employer sends us your name and eligibility information ("Employee Eligibility File"), we will store and process that information in the United States. To comply with applicable regulatory requirements (e.g., the GPDR) on “international data transfers,” we will sign appropriate contractual mechanisms with the “data exporter” (i.e, your employer). For instance, if you are an EEA resident, Carrot and your employer will sign Module 2 of the EU Standard Contractual Clauses (SCCs).
We use Artificial Intelligence (AI) and Machine Learning (ML) technology in different ways across the Service. Our uses fall under two broad categories:
AI uses for which we rely on your consent. For certain AI uses, we will only process your Personal Information with your consent. You may withdraw consent at any time, and the withdrawal will not affect the lawfulness of processing carried out before withdrawal. For specific examples, please see the tables in the Sensitive Data section below.
AI uses for which we rely on performance of contract and/or our legitimate interests. For other AI uses (for instance, those that support the operation of the Service or our internal business purposes), we rely on performance of contract and/or our legitimate interests. For specific examples, please see the tables in the use section under fraud and payment.
If you participate in Carrot Sprints, our fertility and metabolic health coaching program, AI technology — overseen by human moderators and configured to operate on de-identified inputs — supports personalized guidance based on the medical history, lifestyle data, and engagement patterns you provide. Direct identifiers (such as name, date of birth, address, or medical diagnoses) are not sent to the AI system used for personalization.
If you use Good Answers, our AI-powered feature that provides educational information about pregnancy and postpartum topics, we leverage generative artificial intelligence, including large language models provided by third-party service providers, to generate responses to our questions. To do so, we may process personal information you provide through Good Answers to interact with you and provide educational support.
For more information about the types of service providers with whom we share information, see How and why we may disclose your information.
We do not rely on AI alone to make decisions that have a legal or similarly significant effect on you without meaningful human review. For consumers in Colorado and Texas, we comply with applicable state laws governing the use of automated decision-making in consequential decisions, including the Colorado AI Act and the Texas Responsible AI Governance Act. If you are a Colorado resident and a decision about your services has been influenced by an automated system, you have the right to request human review of that decision and to correct inaccurate information used in that decision.
How we collect Personal Information
We collect Personal Information about you when you voluntarily submit information to us when you use our Service. This can include information you provide to us when you register for an account, send us messages, subscribe to our mailing lists, newsletters or other forms of marketing communications related to the Service, participate in a survey, or use some other feature of our Service.
We may also collect information about you from our third party partners, as further described here.
Your Choices and Preferences Regarding How we Collect your Information
For further information on your rights and choices regarding your information, see here.
We will indicate to you where the provision of certain Personal Information is mandatory and where it is optional. If you choose not to provide Personal Information marked as mandatory, we may not be able to provide you with requested products, services, or information.
Categories of Personal Information we Collect
The categories of Personal Information we collect may include, without limitation:
Linking and Combining Personal Information from Different Sources
We also link or combine your activities and information collected from you on our websites with information we collect automatically through tracking technologies. This allows us to provide you with a personalized experience regardless of how you interact with us.
A Note on Children’s Privacy
Carrot does not knowingly collect or solicit any information from anyone under the age of 18 on this Service. In the event that we learn that we have inadvertently collected Personal Information from a child under age 18, we will delete that information as quickly as possible. If you believe that we might have any information from a child under 18, please contact us using the contact details set out at the end of this Privacy Notice.
How we Collect this Information
When you use our Service, read our emails, or otherwise engage with us through a computer or mobile device, we and our third-party partners automatically collect information about how you access and use the Service and information about the device you use to access the Service.
We typically collect this information through a variety of tracking technologies, including cookies, location-identifying technologies, and similar technology (collectively, “tracking technologies”).
See here for more detail on the tracking technologies we use.
Third Party Data Collection of User Experience Information
When you use the Service, we may use third party tools to monitor user experience information. These tools automatically collect usage information, including mouse clicks and movements, page scrolling and any text keyed into website forms. We use this information for site analytics, optimization, and to improve website usability.
Health Data From Linked Sources
In connection with certain wellness and coaching programs, including our Carrot Sprints metabolic health initiative, you may choose to link third-party sources, such as a Withings scale or platforms like Apple HealthKit and Android Health Connect, to your Carrot experience. These third-party providers operate as independent data controllers, meaning they are responsible for collecting and processing your health data (e.g., weight, activity levels) in compliance with their own privacy policies and applicable regulations. Some of this data — for example, weight, body composition, or activity-derived measurements — may constitute biometric data under applicable laws, such as the Illinois Biometric Information Privacy Act and similar state laws. Because these third-party providers operate as independent data controllers, they are responsible for their own compliance with such laws. We support their compliance through appropriate contractual mechanisms.
Third-party benefit storefront and enrollment integrations
Some employers and benefit sponsors offer Carrot through third-party benefit storefronts and enrollment platforms — for example, Amazon Health, the UHC Store, and similar offerings. If you check your eligibility for, or enroll in, Carrot's Service through one of these integrations, we may receive limited personal information about you from the platform to confirm your eligibility and facilitate enrollment. We may also share back status updates so your dashboard or account on that platform reflects real-time information about your benefits.
Where required by law, we will obtain your explicit consent for collecting, processing, or disclosing sensitive data involved in any such integration. From time to time, we may add, change, or end integrations as our partnerships evolve.
Linking and Combining Personal Information from Different Sources
Information we collect automatically about you may be combined with other Personal Information we collect directly. For example, we may combine your location based on your IP address that we have collected automatically with your email address that you have provided.
This section sets out the categories of Personal Information we collect about you, and explains how and why we use that information. It also lists the legal bases on which we rely to process personal Information. You hereby expressly acknowledge and agree that the collection and processing described in this Privacy Notice are necessary for our performance of our obligations under the Terms & Conditions.
For further information on your rights and choices regarding your information, see here.
This category includes Personal Information we collect--such as your name, phone number, address, date of birth, and e-mail address, and your partner’s name, phone number, address, date of birth, and e-mail address--when you register for our Service, request a Carrot Card or any other product offered through the Service, or otherwise communicate or interact with us.
This category includes sensitive information, such as your and your partner's gender identities, interest in various fertility health and family-forming options, any relevant diagnoses you may have received, Social Determinants of Health, biometric data, and any related health information.
When you contact us directly, e.g., by email, phone, mail, or by completing an online form or participating in online chat, we will record your comments and opinions. We will also record comments and opinions you express when responding to surveys we run.
This category includes Information such as your Employee ID, your receipts for fertility care and other services, whether you or your partner received the care, the date of your or your partner’s treatments, and your payment information, such as your credit card or bank account details.
This category includes Information about your location. We may approximate your location based on your IP address.
When you interact with our Service through various social media networks, such as when you Like us on Facebook or when you follow Carrot or share Carrot content on Facebook, Twitter, Snapchat, LinkedIn, Instagram or other sites, we may receive information from those social networks including your profile information, picture, user ID associated with your social media account, friends list, and any other information you permit the social network to share with third parties. Records are kept until you delete your social media account.
You may select your preferences for notifications, marketing communications, and site display, as further detailed here. Records of your selections are deleted upon deactivation.
We may receive information from third parties. This information may include sensitive information, such as health care claims history and health information. We may also use data received from connected sources (e.g., Withings scales, Apple HealthKit, and Android HealthKit) to support personalized coaching and to help you and your care team monitor progress toward health goals. This information may be shared with your care providers as needed to deliver services.
If your employer offers Carrot as a benefit, we share information with your employer to support the operation and administration of that benefit. We share only what is reasonably needed for these purposes. The processing described in this section is necessary for the performance of our contract with your employer and for our and your employer's legitimate interests in operating the benefit. What we share with your employer may include: reimbursement information (e.g., your name, Employee ID, the amount of your reimbursement request, and whether the reimbursement was related to an infertility diagnosis or other category); aggregated and de-identified reporting on benefit utilization; information needed to meet administrative obligations and investigate suspected fraud or misuse; and information needed to verify benefit eligibility and reconcile records with the Eligibility File your employer provides.
Some employers engage intermediaries — including benefits consultants, brokers, and data warehouse vendors — to support their administration of the Carrot benefit. The processing described in this section is necessary for the performance of our contract with your employer and for our and your employer's legitimate interests in operating the benefit. When your employer directs us to share information with one of these intermediaries, we share only what is reasonably needed for the same purposes described above.
Some Carrot members access the Service because their care is sponsored by a benefit plan, including a health plan, a multi-employer health fund, a union health fund, or a similar plan-sponsor entity (collectively, "Benefit Plans"). Where you access Carrot through a Benefit Plan, we share information with that Benefit Plan to support the operation and administration of your benefit. The processing is necessary for the performance of our contract with the Benefit Plan and for our and the Benefit Plan's legitimate interests. We share with your Benefit Plan information needed to: verify and maintain your eligibility for benefits; support deductible tracking, claims coordination, and reimbursement processing; investigate and resolve issues; meet the Benefit Plan's administrative and legal obligations; and support high-level fertility and maternity outcomes reporting where contracted. Benefit Plans may have their own obligations under HIPAA, state insurance laws, or similar regulations. Where Carrot acts as a Business Associate to a Benefit Plan that is a HIPAA Covered Entity, that relationship is governed by a separate Business Associate Agreement.
Benefit Plans frequently engage intermediaries — including third-party administrators, benefits consultants, and data warehouse vendors. The processing described in this section is necessary for the performance of our contract with the Benefit Plan and for our and the Benefit Plan's legitimate interests in operating the benefit. When a Benefit Plan directs us to share information with one of these intermediaries, we share only what is reasonably needed.
We will share certain Personal Information with third party partners and service providers, as necessary to achieve the purpose for which we have shared it, which may include (but is not limited to) fulfilling your orders for products available through our Service as requested by you, confirming your eligibility for services provided by third party partners and service providers, as described, improving our Service and business, providing mailing services, web hosting, or providing analytic services.
Any such service providers and partners will be given limited access to Personal Information as reasonably necessary to achieve such purpose and will, by appropriate data processing agreements or analogous contractual provisions, be bound to only process Personal Information on our behalf and for specifically enumerated purposes; if you would like to more specifically understand the services our third party partners render, please contact us at legal@get-carrot.com.
We may disclose Personal Information to service providers that provide artificial intelligence, machine learning, large language models, and related technologies that we use to support, operate, and improve our Service, including AI-powered features such as Good Answers. Depending on the feature or purpose, this may include information you provide when interacting with AI-powered features, such as questions, prompts, and related information.
We take reasonable steps to put contractual protections in place with these service providers that address the handling, use, protection, and retention of Personal Information.
We may share your Personal Information with third party providers and advisors where this is necessary to achieve our legitimate interests, such as conducting security audits, consulting tax consultants and lawyers, or engaging payment processors to process payment transactions.
Personal Information may be disclosed to third parties in connection with a Carrot-related transaction, such as a merger, sale of Carrot assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business by a third party, or in the event of a bankruptcy or related or similar proceedings.
In the event that we receive a request for Personal Information from law enforcement, we will follow three basic principles to protect your privacy:
We may use third-party payment services to process payments made through the Service. If you wish to make a payment through the Service, for example by using the Carrot Card, your payment information may be collected by a third-party payment service provider, such as Stripe Inc., and not by us, and thus will be subject to the third-party’s privacy notice (Privacy Policy) rather than this Privacy notice.
We share information with fertility clinics, physicians, third-party assisted reproduction agencies, assisted reproduction attorneys, and other care providers involved in your care. The processing described in this section is necessary for the performance of our contract with you and for our legitimate interests in coordinating and supporting the delivery of your care. This may include, for instance: self-referrals (when you request a referral, we share information as indicated at the time of the request); Preferred Provider Network billing (e.g., your name, date of birth, eligibility status, and benefit details — shared through a secure portal to support eligibility checks, service eligibility checks, and direct billing); care coordination among providers involved in your care; issue resolution when discrepancies or questions arise; and clinic-level reconciliation when reimbursement records and member records show discrepancies. In reconciliation contexts, we limit the information we share to what is needed for the reconciliation.
Some Carrot services are delivered with the help of specialist care partners — for example, doula agencies, pharmacy partners, or specialized program providers. The processing described in this section is necessary for the performance of our contract with you and for our legitimate interests in coordinating and supporting the delivery of your care. When your care involves one of these partners, we share the information they need to deliver services, validate eligibility, and coordinate with Carrot and your clinic.
If your employer has chosen to participate in a channel partner rewards program, we may send information about specific activities or “events” (e.g., account activation, content review, benefit guide review, intake completion) that you take on Carrot’s platform to channel partners to enable your participation in these rewards programs.
You may grant account access to your partner. If you do so, your partner will be able to see your sensitive health information, including detailed information related to your Carrot Plan.
We will share your information with export screening providers to ensure compliance with applicable laws and regulations. This process helps us verify that our services are not being used in violation of export control laws.
We will share personal information, which may include (among other data fields) Medicare ID, with the Centers for Medicare & Medicaid Services (CMS) for Section 111 reporting purposes. This reporting is mandatory to ensure compliance with CMS regulations.
You may update your profile information, such as your name, address, or bank account information.
Carrot Fertility does not currently honor the Do Not Track (DNT) browser signal.
If you are a resident of California, see here for more information about your rights.
To the extent provided in applicable data protection laws, we will only send you promotional and marketing emails, or contact you for promotional or marketing purposes by phone or SMS, if you have given us your explicit consent. For US-based members, we will only contact you for promotional or marketing purposes by phone or SMS if you have given us your explicit consent. You can stop receiving promotional email communications from us by clicking on the “unsubscribe” link provided in such communications. You may opt-out of receiving promotional calls, SMS/texts and direct mail communications from Carrot at any time with future effect as set forth in our Terms of Service. You may not opt out of service-related communications (e.g., account verification, transactional communications, changes/updates to features of the Service, technical and security notices).
Post-membership communications about continuing your care. If your access to Carrot's services ends — for example, because your employer no longer offers Carrot or you change employers — we may use the email address you provided to us during registration to send you information about Carrot products or services that you can access directly, without employer sponsorship. We do this only for a limited period following the end of your access, and only to email addresses you provided to us directly. We do not use your clinical or health record information to personalize these communications. You can opt out at any time. If you were already opted out of Carrot marketing before your access ended, we will not send these messages.
In some cases, we may send information about Carrot’s programs or services via postal mail, including updates about benefits you may be eligible for or tips on how to use your benefit. If you no longer want to receive postal mail from Carrot, please visit Carrot Postal Opt Out Form.
When you visit any website, it may store or retrieve information on your browser in the form of cookies, pixels, and other tracking technologies. This may include information about you, your preferences, or your device. You can choose not to allow some types of cookies, but blocking some types of cookies may impact your experience of the site and the services we are able to offer.
Most browsers allow you to adjust your browser settings to: (i) notify you when you receive a cookie, which lets you choose whether or not to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies. Blocking or deleting cookies may negatively impact your experience using the Service, as some features and services may not work properly.
You may set your email options to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you viewed or engaged with our emails.
Deleting cookies does not delete Local Storage Objects (LSOs) such as Flash objects and HTML5. To manage Flash cookie settings and preferences, you must use the settings manager on Adobe’s website or by clicking here. If you choose to delete Flash objects from our Service, then you may not be able to access and use all or part of the Service or benefit from the information and services offered.
Some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt-out again.
You have the right to understand how your personal and health information is collected, used, shared, and protected. The sections below describe how Carrot does this, the entities that may have access to your information, and the procedures we use to protect it.
In addition to the ways in which you can manage the use of your information as outlined in the previous section (“Your Choices and Control Over Your Information”), you may also exercise the rights granted to you under applicable data protection laws.
At a minimum, you have and may exercise the rights listed below.
If you are a resident of a state or country listed in this section, please see State Addenda to Privacy Notice and Country Addenda to Privacy Notice, respectively, to learn more about your jurisdiction-specific rights.
If you wish to exercise one of these rights, contact us at data-requests@get-carrot.com.
In addition to the rights listed above, you may have the right to lodge a complaint with the applicable data protection authority in your jurisdiction, if you consider that a processing of your Personal Information infringes the applicable data protection laws. If you are an EU resident, further information about how to contact your local data protection authority is available at JUSTICE AND CONSUMERS ARTICLE 29 - National Data Protection Authorities. However, we encourage you to first reach out to us by using the contact details available here so that we have an opportunity to address your concerns directly and find a solution together before you lodge a complaint.
Your information collected through the Service will be stored and processed in the United States and may be processed in any other country in which Carrot or its affiliates or service providers maintain or have access to facilities. Please note that these internal and external international transfers of your Personal Information are made pursuant to appropriate safeguards, as further discussed here.
If you wish to inquire further about these appropriate safeguards, please contact us at legal@get-carrot.com.
We care about the security of your information and employ physical, administrative, and technological safeguards designed to preserve the integrity and security of all information collected through our Service. When you enter sensitive information (such as a credit card number) on our order forms or login credentials (such as username and password) on our platform login, we encrypt the transmission of that information. However, no security system is impenetrable, and we cannot guarantee the security of our systems 100%. In the event that any information under our control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and, where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with any applicable laws and regulations.
Unless applicable law requires a longer retention period, we will retain your information only as long as necessary for the purposes outlined in this Privacy Notice and for a commercially reasonable time thereafter for backup, archival, fraud prevention or detection, or audit purposes.
To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information, and applicable legal requirements.
After your access to Carrot ends. Following the end of your access, we retain your registration contact information — including the email address you provided — for a limited period to enable us to contact you about continuing your care. After this period, your contact information is no longer used for marketing purposes and is subject to our standard retention and deletion practices. Your health and clinical information is retained separately and for different periods in accordance with applicable legal requirements.
If you have any questions about this Privacy Notice or the website, please contact us at legal@get-carrot.com.
As a general practice, we plan to update this Privacy Notice once every six months. We may, however, update it more or less frequently, depending on operational and regulatory circumstances. Either way, if we have your email address, we will notify you of any material changes. We will update the “Effective Date” at the bottom of this page when we post changes to this Privacy Notice. If you object to any changes, you may close your account. Continuing to use our Service after we publish changes to this Privacy Notice means that you have read and understood the changes.
Effective Date: June 2026