Customer FAQs

General Contractual Framework and Data Model

1. Which types of contracts does Carrot enter into with customers?
   Carrot enters into a framework service agreement with customers, sometimes referred to as a “Master Services Agreement (MSA).” This agreement governs the relationship between Carrot (as the vendor) and the employer (as the customer) regarding the provision of services.
   We may also enter into a Data Processing Agreement (DPA) that governs the processing of personal information on behalf of a data controller (the customer) and addresses international data transfers.

2. What data does Carrot collect from customers?
   “Customer Data” is collected in the form of an “Employee Eligibility File (EE File).” The EE File includes:

• Eligible employee first name, last name, and work email address
• Unique employee identification number
• Eligibility start date
• Date of birth
• Sex
• Zip code (US members only)

3. How does Carrot use data it collects from customers?
   Carrot uses Customer Data to provide and improve services, including:

• Confirming employee eligibility for the Service
• Performing contractual obligations (e.g., sending launch and communications emails where agreed)

4. Does Carrot share data with its customers?
   Yes, Carrot shares limited data as set forth in the MSA, including:

• “Metric Reports” showing how customers' employees are using the Carrot benefit (e.g., response times, engagement times, employee feedback). This data is aggregated and de-identified.
• “Utilisation Reports” to assist customers with obligations (e.g., tax and payroll), which may include identifiable data elements.

5. Which terms govern Carrot's relationship with individual employees?
   We contract separately (via our Terms of Service and Privacy Notice) with a customer’s employees who sign up for Carrot (i.e., “Members”). This establishes a separate set of responsibilities regarding ownership and use of data.

Key Regulatory Considerations

6. Is Carrot considered a “Service Provider” under the California Privacy Rights Act (CPRA)?
   Yes, if the customer is considered a “Business” as defined by the CPRA. The MSA includes language that defines Carrot’s obligations as a Service Provider.

7. How does FISA 702 impact Carrot?
   Carrot could fall within the scope of FISA Sec. 702, although it is not a traditional target of a FISA warrant, per our "Warrant Canary" page, we have never received one.

8. Does Carrot process Protected Health Information (PHI)?
   Carrot collects a very small subset of data that constitutes PHI under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This includes information related to an identified individual's health that is processed through an infertility HRA established by Carrot as its Business Associate.

9. What does the Business Associate Agreement (BAA) cover?
   The BAA applies only to the infertility HRA and pertains to sensitive information that is not HIPAA-protected PHI, due to it not being received from a Covered Entity.