Consumer Health Data Privacy Policy

This notice addresses consumer health data handled by Surroget LLC, the company that operates SurroGet (“we,” “us,” or “our”), through our website, mobile apps, applications, and related coordination. Consumer health data can include information linked or reasonably linkable to you that identifies past, present, or future physical or mental health, reproductive health, or attempts to obtain health-related services. Even your interest in a surrogacy service can reveal sensitive health-related information.

SurroGet provides introductions and administrative coordination. We do not provide medical advice, medical analysis, diagnosis, treatment, or clinical determinations of suitability for pregnancy or surrogacy. Collecting health-related information does not make an eligibility check or compatibility score a medical assessment. Independent licensed healthcare professionals make clinical decisions.

This separate notice supplements our Privacy Policy. Where a consumer health privacy law gives your data additional protection, that protection applies. HIPAA coverage depends on the parties and circumstances; information outside HIPAA can still be protected by consumer health privacy laws.

• Reproductive and fertility information: pregnancy, delivery, live-birth and prior surrogacy history; fertility circumstances, embryo-related information, family-building plans, and preferences you provide. Used to record your application and support the coordination and matching services you request.
• Health and lifestyle answers: reported conditions, medications, mental health, family or genetic history, height and weight, and lifestyle answers such as smoking or alcohol use. Used to record your answers and administer participation and document requirements, not to diagnose or medically analyze you.
• Health-related documents and outcomes: records you upload, insurance details, screening documentation or outcomes entered during coordination, and related permissions and signatures. Used to organize requested administrative steps and record their status; an uploaded report remains its author's assessment.
• Health-related communications and preferences: information you include in profiles, messages, attachments, support requests, or preferences about a surrogacy arrangement. Used to deliver that communication or requested feature.
• Participation and derived information: your interest in surrogacy or fertility-related services, questionnaire answers and eligibility results, matching activity, and related account or session identifiers. Used to save progress, apply administrative criteria, and organize matching. An inferred association with a health-related service may itself be consumer health data.

Contact details, IP addresses, device tokens, and other technical records can become consumer health data when linked to the activity above. We use these records to authenticate access, deliver the service, communicate with you, investigate misuse, and resolve technical problems. We do not sell consumer health data, use it for targeted advertising, or use location-based geofencing around healthcare facilities to identify or target people seeking care.

Data comes from your forms, saved drafts, uploads, selections, and communications; your browser or device; other members' interactions or reports; our team's administrative records; and service providers supporting those activities. Records you authorize an independent provider to supply can also be included.

Processing includes collecting and storing answers and documents, retrieving them for authorized service activities, applying participation or matching rules, transmitting requested communications, and responding to privacy requests. A completed mobile eligibility questionnaire is sent to SurroGet before account creation; browser quiz progress stays in that browser. An application draft may be saved before final submission. Administrative automation does not replace a clinician's evaluation.

Our service does not enable third-party advertising trackers to collect consumer health data about activity across unrelated websites or services. Independent providers you choose to visit have their own information practices.

Authorized internal staff of Surroget LLC access health-related records for their application, coordination, support, and privacy responsibilities. We do not sell consumer health data or give it to outside organizations for their own independent marketing or business purposes.

The following describes the categories of health data disclosed and the recipients involved. A recipient does not receive every category merely because it appears here.

• Hosting, database, and storage processors: Google Cloud and Neon process stored application, document, communication, and related account information as part of operating our service.
• Communications processors: Resend, Expo, and the Apple or Google notification infrastructure process contact or delivery identifiers and the service communications they deliver. These can reveal participation in SurroGet. Message bodies and attachment filenames are omitted from push alerts.
• Payment processors, when billing is enabled: Stripe processes customer identifiers, checkout details, and transaction records that may reveal participation in SurroGet. We do not send reproductive histories or application health records to process a membership payment.
• Other members: if you consent to member-profile sharing, matching profiles can show pregnancy, live-birth, and prior-surrogacy summaries and information you write about your circumstances or preferences. Conversation participants receive health information you choose to send in messages or attachments. Application document files are not part of the matching profile displayed to other members.
• Recipients you direct or authorize: a clinic, screening professional, attorney, or other recipient may receive the particular information you request or separately authorize us to disclose for coordination. This notice does not authorize a blanket release of health records.
• Other legally permitted recipients: where applicable law requires disclosure or permits a necessary disclosure for security, a legal claim, or a qualifying business transfer. Applicable health-data restrictions continue to govern the information.

We do not disclose consumer health data to affiliates for their own independent use. If that practice changes, the notice must identify the relevant affiliates and any required consent must be obtained before that disclosure.

We limit collection and use to the requested service or another basis permitted by applicable law. When consent is required, it must describe the relevant information, purpose, and activity. Consent to sharing, where required, is separate from consent to collection. A general privacy-policy acknowledgment is not an authorization to sell health data or disclose records for unrelated purposes.

Our application presents separate choices for collecting health information and sharing your member profile. We record the notice version and your choices. You can change them in Privacy settings. Turning collection off also turns profile sharing off and blocks new intake saves and uploads. Turning sharing off hides your profile from other members, including existing matches. You can also decline optional information, manage device permissions, and request withdrawal by contacting support@surroget.com. We will explain which requested services would be affected. Withdrawal does not undo a completed authorized disclosure, but applies to future consent-based processing as required by law. You may also request deletion of existing data.

Where applicable consumer health privacy law provides these rights, you may request confirmation of collection or sharing, access to your health data, a list of recipients and their contact details, withdrawal of consent, and deletion. You can review or correct available fields in your account and contact us about other inaccuracies. Corrections to a clinician's original report should also be addressed to its author.

Email support@surroget.com with your account or questionnaire email if available, the request, and the state relevant to your rights. You do not need an active account. We may request proportionate identity verification. Do not send passwords, medical records, or identity documents in the initial email. An authorized representative may use the same channel.

Our retention policy applies to consumer health data: while your account is active and for up to two years after account closure; for applications or questionnaires without an account, up to two years after your last interaction with us. A valid earlier deletion request or shorter legal deadline takes priority. Particular records may be held longer only for a specific legal obligation or documented legal hold. Account closure is not complete erasure; our team carries out the required record and provider follow-up.

Our account and data deletion page explains what ordinary account closure removes and what remains. A consumer health deletion request is assessed separately; an active match does not prevent submitting it. Required deletion extends to relevant processors and recipients, subject to applicable exceptions and backup rules. If records must be retained, we explain the basis and period or criteria rather than treating account deactivation as erasure.

Deadlines depend on the applicable law. Washington generally requires a response within 45 days of receipt, with an explained extension when permitted. Nevada generally requires a response within 45 days after authentication, but requires qualifying deletion within 30 days after authentication. We apply the deadline specific to the request and provide any required notice of an extension.

To appeal, email support@surroget.com with the subject “Appeal of SurroGet consumer health privacy decision.” Identify the request and explain your concern. Where Washington or Nevada consumer health law applies, we respond to appeals within 45 days and explain our decision. You may also contact the Washington Attorney General or Nevada Attorney General about a complaint.

The date at the top identifies this notice's revision. We will give appropriate notice of material changes to health-data practices, such as an in-service notice or email, and obtain new consent where required before a new collection or disclosure begins.

Surroget LLC's own team handles consumer health privacy questions, corrections, and rights requests. Contact us at support@surroget.com.

You may also send a written consumer health privacy request to: