Privacy Notice | Carrot

Privacy notice

Introduction

Purpose and scope

Carrot Fertility, Inc. (“Carrot Fertility”) and Carrot Medical, LLC (“Carrot Medical”) are committed to protecting your privacy. This Privacy Notice explains how your Personal Information is collected, used, stored, processed, transferred, and disclosed by Carrot Fertility and Carrot Medical (collectively, “Carrot,” “we,” “our,” or “us”).

This Privacy Notice applies to our website https://get-carrot.com (our "Website") and any other website, mobile application, or online service that links to this Privacy Notice (collectively, our "Service").

The Service may contain links to and from third party websites of our business partners, advertisers, and social media sites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. We may also share a user ID with third-party websites allowing us and the third-party website provider to jointly track specified activities across both websites. We strongly recommend that you read their privacy policies and terms and conditions of use to understand how they collect, use, and share information. We are not responsible for the privacy practices or the content on the websites of third party sites.

Before accessing or using our Service, please ensure that you have read and understood our collection, storage, use, and disclosure of your Personal Information as described in this Privacy Notice.

HIPAA Applicability

This Privacy Policy does not apply to Carrot’s use and disclosure of Protected Health Information.

Carrot Medical uses and discloses Protected Health Information about Carrot Medical patients in accordance with its Notice of Privacy Practices. Carrot Medical uses and discloses Protected Health Information about Carrot Medical patients in accordance with its obligations as a HIPAA Covered Entity.

In addition, to the extent that you are subject to United States benefit and taxation laws, and that your employer has established a health reimbursement arrangement plan (“HRA”), Carrot uses and discloses Protected Health Information that it receives from or on behalf of the HRA as a Business Associate under a Business Associate Agreement with the HRA. Please review the HRA’s Notice of Privacy Practices for an explanation of how the HRA uses and discloses your Protected Health Information.

Important Terminology

Carrot is the “Data Controller” responsible for protecting your Personal Information, which means we determine and are responsible for how your Personal Information is handled. If your access to Carrot is sponsored by an employer, health plan, or other benefit sponsor (collectively, a "Plan Sponsor"), the Plan Sponsor will initially send us your name and eligibility information ("Eligibility File"). If you have queries regarding the information contained in the Eligibility File, please contact your Plan Sponsor.

"Personal information" encompasses all “Personal Data” as defined in Art. 4 (1) of the General Data Protection Regulation ("GDPR"), meaning any information that relates to an identified or identifiable individual; provided, that in such circumstance(s) that applicable data protection laws require otherwise, “Personal information” has the meaning ascribed to it in such law(s).

Geographic considerations

Supplemental information for certain states

If your state of residence has specific privacy requirements that go beyond the general scope of this Privacy Notice, it is listed below:

Please click here to see more detailed information.

If you are a resident of Washington, you can also click here.

If you are resident of Nevada, you can also click here.

Also, please note that we will update this list as necessary to address evolving operations and regulations.

If you are a resident of a state that is not listed above, please contact us at legal@get-carrot.com if you have any questions about this Privacy Notice.

Supplemental Information for certain countries

If your country of residence has specific privacy requirements that go beyond the general scope of this Privacy Notice, it is listed below:

Please click here to see more detailed information.

Also, please note that we will update this list as necessary to address evolving operations and regulations.

If you are a resident of a jurisdiction that is not listed above, please contact us at legal@get-carrot.com if you have any questions about this Privacy Notice.

International data transfers

In order to provide services, Carrot will store and process your Personal Information in the United States. To the extent that your local jurisdiction considers this an “international data transfer,” we will comply with that jurisdiction’s requirements for transferring Personal Information to other countries.

For Residents of the EEA, Switzerland, and the United Kingdom: When your employer sends us your name and eligibility information ("Employee Eligibility File"), we will store and process that information in the United States. To comply with applicable regulatory requirements (e.g., the GPDR) on “international data transfers,” we will sign appropriate contractual mechanisms with the “data exporter” (i.e, your employer). For instance, if you are an EEA resident, Carrot and your employer will sign Module 2 of the EU Standard Contractual Clauses (SCCs).

Use of Artificial Intelligence (AI) and Machine Learning (ML)

Overview and legal bases

We use Artificial Intelligence (AI) and Machine Learning (ML) technology in different ways across the Service. Our uses fall under two broad categories:

AI uses for which we rely on your consent. For certain AI uses, we will only process your Personal Information with your consent. You may withdraw consent at any time, and the withdrawal will not affect the lawfulness of processing carried out before withdrawal.

AI uses for which we rely on performance of contract and/or our legitimate interests. For other AI uses (for instance, those that support the operation of the Service or our internal business purposes), we rely on performance of contract and/or our legitimate interests.

Carrot Sprints

If you participate in Carrot Sprints, our fertility and metabolic health coaching program, AI technology — overseen by human moderators and configured to operate on de-identified inputs — supports personalized guidance based on the medical history, lifestyle data, and engagement patterns you provide. Direct identifiers (such as name, date of birth, address, or medical diagnoses) are not sent to the AI system used for personalization.

Human oversight and automated decision-making

We do not rely on AI alone to make decisions that have a legal or similarly significant effect on you without meaningful human review. For consumers in Colorado and Texas, we comply with applicable state laws governing the use of automated decision-making in consequential decisions, including the Colorado AI Act and the Texas Responsible AI Governance Act. If you are a Colorado resident and a decision about your services has been influenced by an automated system, you have the right to request human review of that decision and to correct inaccurate information used in that decision.

Collection, use, and disclosure of personal information

Collection

How we collect Personal Information

We collect Personal Information about you when you voluntarily submit information to us when you use our Service. This can include information you provide to us when you register for an account, send us messages, subscribe to our mailing lists, newsletters or other forms of marketing communications related to the Service, participate in a survey, or use some other feature of our Service.

We may also collect information about you from our third party partners, as further described here.

Your Choices and Preferences Regarding How we Collect your Information

For further information on your rights and choices regarding your information, see here.

We will indicate to you where the provision of certain Personal Information is mandatory and where it is optional. If you choose not to provide Personal Information marked as mandatory, we may not be able to provide you with requested products, services, or information.

Categories of Personal Information we Collect

The categories of Personal Information we collect may include, without limitation:

Linking and Combining Personal Information from Different Sources

We also link or combine your activities and information collected from you on our websites with information we collect automatically through tracking technologies. This allows us to provide you with a personalized experience regardless of how you interact with us.

A Note on Children’s Privacy
Carrot does not knowingly collect or solicit any information from anyone under the age of 18 on this Service. In the event that we learn that we have inadvertently collected Personal Information from a child under age 18, we will delete that information as quickly as possible. If you believe that we might have any information from a child under 18, please contact us using the contact details set out at the end of this Privacy Notice.

Personal information we collect through automated means

How we Collect this Information

When you use our Service, read our emails, or otherwise engage with us through a computer or mobile device, we and our third-party partners automatically collect information about how you access and use the Service and information about the device you use to access the Service.

We typically collect this information through a variety of tracking technologies, including cookies, location-identifying technologies, and similar technology (collectively, “tracking technologies”).

See here for more detail on the tracking technologies we use.

Use

Overview of how and why we use personal information

This section sets out the categories of Personal Information we collect about you and explains how and why we use that information. It also lists the legal bases on which we rely to process personal Information.

To create your account and to communicate with you directly about the Service.

To set up and send you a Carrot Card, or any other product offered through the Service as requested by you.

To communicate with you, including to answer any questions, issues, or concerns you have.

To send you marketing or promotional communications.

To verify eligibility for services offered by third party partners and service providers.

Sensitive data

This category includes sensitive information, such as your and your partner's gender identities, interest in various fertility health and family-forming options, any relevant diagnoses you may have received, Social Determinants of Health, biometric data, and any related health information.

To validate requests for reimbursement related to fertility treatments and other services, and to determine any taxes owed.

To send periodic emails to members who have Pregnancy Carrot Plans and whose expected due dates fall within a certain range, based on self-reported information. The purpose of these emails is to explain key features of Parenting Carrot Plans and remind individuals to refresh their Carrot Plans.

To provide information to channel partners regarding actions taken on the Carrot platform to facilitate participation in rewards programs.

To provide medical records and survey data to medical experts to improve member outcomes. This allows medical experts to access pertinent medical data.

Comments, chats, and opinions

When you contact us directly, by email, phone, mail, or by completing an online form, we will record your comments and opinions.

To address your questions, issues, and concerns and improve our products and services.

We may use your comments and opinions to determine products and services that may be of interest to you.

Disclosure

How and why we may disclose your information

Employers

If your employer offers Carrot as a benefit, we share information with your employer to support the operation and administration of that benefit.

Third Party Partners and Service Providers

We will share certain Personal Information with third party partners and service providers, as necessary to achieve the purpose for which we have shared it.

Any such service providers and partners will be given limited access to Personal Information.

Your choices and control over your information

Your profile

You may update your profile information, such as your name, address, or bank account information.

Cookies and tracking preferences

When you visit any website, it may store or retrieve information on your browser in the form of cookies, pixels, and other tracking technologies. You can choose not to allow some types of cookies.

Your rights with respect to your information

Your rights under applicable data protection laws

You have the right to understand how your personal and health information is collected, used, shared, and protected. The sections below describe how Carrot does this, the entities that may have access to your information.

If you wish to exercise one of these rights, contact us at data-requests@get-carrot.com.

How we store and protect your information

Data storage and transfer

Your information collected through the Service will be stored and processed in the United States and may be processed in any other country in which Carrot or its affiliates or service providers maintain or have access to facilities.

Keeping your information safe

We care about the security of your information and employ physical, administrative, and technological safeguards designed to preserve the integrity and security of all information collected through our Service.

Retention of your information

Unless applicable law requires a longer retention period, we will retain your information only as long as necessary for the purposes outlined in this Privacy Notice.

Questions about and changes to this privacy notice

If you have any questions about this Privacy Notice or the website, please contact us at legal@get-carrot.com.

Effective Date: June 2026