# Customer FAQs

## General Contractual Framework and Data Model

1) **Which types of contracts does Carrot enter into with customers?**  
Carrot enters into a framework service agreement with customers, sometimes referred to as a “Master Services Agreement (MSA).” This agreement governs the relationship between Carrot (as the vendor) and the employer (as the customer) regarding the provision of services.  
We may also enter into a [Data Processing Agreement (DPA)](/content/trust-center/data-processing/index.html) that governs the processing of personal information on behalf of a [data controller](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-fee/glossary/) (the customer) and addresses international data transfers.

2) **What data does Carrot collect from customers?**  
“Customer Data” is collected in the form of an “Employee Eligibility File (EE File).” The EE File includes:  
- Eligible employee first name, last name, and work email address  
- Unique employee identification number  
- Eligibility start date  
- Date of birth  
- Sex  
- Zip code (US members only)

3) **How does Carrot use data it collects from customers?**  
Carrot uses Customer Data to provide and improve services, including:  
- Confirming employee eligibility for the Service  
- Performing contractual obligations (e.g., sending launch and communications emails where agreed)

4) **Does Carrot share data with its customers?**  
Yes, Carrot shares limited data as set forth in the MSA, including:  
- “Metric Reports” showing how customers' employees are using the Carrot benefit (e.g., response times, engagement times, employee feedback). This data is aggregated and de-identified.  
- “Utilisation Reports” to assist customers with obligations (e.g., tax and payroll), which may include identifiable data elements.

5) **Which terms govern Carrot's relationship with individual employees?**  
We contract separately (via our [Terms of Service](/content/trust-center/terms-conditions/index.html) and [Privacy Notice](/content/trust-center/privacy-notice/index.html)) with a customer’s employees who sign up for Carrot (i.e., “Members”). This establishes a separate set of responsibilities regarding ownership and use of data.

## Key Regulatory Considerations

6) **Is Carrot considered a “Service Provider” under the California Privacy Rights Act (CPRA)?**  
Yes, if the customer is considered a “[Business](https://iapp.org/resources/topics/ccpa-and-cpra/)” as defined by the [CPRA](https://iapp.org/resources/topics/ccpa-and-cpra/). The MSA includes language that defines Carrot’s obligations as a [Service Provider](https://iapp.org/resources/topics/ccpa-and-cpra/).

7) **How does FISA 702 impact Carrot?**  
Carrot could fall within the scope of FISA Sec. 702, although it is not a traditional target of a FISA warrant, per our ["Warrant Canary" page](/content/warrant-canary/index.html), we have never received one.

8) **Does Carrot process Protected Health Information (PHI)?**  
Carrot collects a very small subset of data that constitutes PHI under the Health Insurance Portability and Accountability Act of 1996 ([HIPAA](https://www.hhs.gov/hipaa/index.html)). This includes information related to an identified individual's health that is processed through an infertility HRA established by Carrot as its Business Associate.

9) **What does the Business Associate Agreement (BAA) cover?**  
The BAA applies only to the infertility HRA and pertains to sensitive information that is not HIPAA-protected PHI, due to it not being received from a Covered Entity.