Privacy policy · Poppy Surrogacy

Draft prepared for attorney review.

Effective date: November 5, 2026

Poppy Surrogacy ([[PLACEHOLDER: legal entity name]]) is an egg donation and surrogacy agency based in Pacific Palisades, California. In this policy, "Poppy," "we" and "us" mean Poppy Surrogacy. "You" means anyone who visits our website, completes a pre-screen or application, or contacts us.

This policy explains what information we collect, why we collect it, who we share it with, how long we keep it and the choices you have. It applies to our website at [[PLACEHOLDER: website domain]], our pre-screens and applications, and our emails and text messages.

We ask for some of the most personal information a person can share. We take that seriously. We collect only what we need, we protect it carefully and we never sell it.

Information we collect

On a pre-screen

Our pre-screen is short. It helps you and us see whether a program may be a fit. It may ask for:

Your name, email address and phone number.
Your age or date of birth.
Your city, state and ZIP code.
How you heard about us.
Basic eligibility answers, such as height and weight, and for surrogates, whether you have had a healthy, full-term pregnancy.

Questions about your health or reproductive history appear only after you opt in, as described below.

On a full application

If you continue to a full application, we may ask for:

Contact and identity details, such as your full name, address, date of birth and emergency contact.
Household and background details, such as marital status, partner or spouse information, children in your household, education and occupation.
Health and reproductive information, such as your medical history, pregnancy and delivery history, menstrual and contraceptive history, medications, mental health history, height and weight, and lifestyle factors such as smoking or substance use.
Family medical and genetic history, for egg donors in particular.
Ethnicity, ancestry and similar profile details, for egg donors, if you choose to include them in a profile intended parents will see.
Photos of you, including childhood photos for egg donor profiles.
Personal statements you write about yourself and your reasons for applying.
Insurance information, for surrogates, so your health plan can be reviewed.

Later in the process

If you move forward, we may later collect:

A government-issued ID, to verify your identity and to support background checks, legal agreements and escrow setup.
Medical records, only with your signed authorization.
Background check results, only after we give you the required disclosures and you give separate written authorization.
Screening results shared with us by clinics or mental health professionals, only as you authorize.

Payment details for surrogates and egg donors are collected by the independent escrow company, not by us [[PLACEHOLDER: confirm escrow process]].

Automatically, when you use our website

When you visit our website, we and our service providers collect some information automatically. This includes your IP address, browser and device type, the pages you visit, the site that referred you and the date and time of your visit. See "Cookies and analytics" below.

From other people

We may receive information about you from your partner or spouse, fertility clinics, mental health professionals, lawyers, background check providers, insurance professionals or the person who referred you. When we receive information from these sources, we handle it under this policy.

Health information is collected only after you opt in

Before we ask any question about your health or reproductive history, including on the pre-screen, we ask you to check a consent box. The text above that box explains what we will collect and why. If you do not check it, we do not ask those questions.

You can stop at any time. You can also withdraw your consent later by contacting us. If you withdraw, we stop collecting health information from you and delete what we hold, unless we must keep it for a reason listed in "How long we keep information." Without health information, we cannot assess whether you are eligible to be a surrogate or egg donor.

We are not a health care provider. [[PLACEHOLDER: attorney to confirm which health privacy laws apply, such as HIPAA, the California Confidentiality of Medical Information Act and other state consumer health data laws.]] Whatever laws apply, we protect health information as this policy describes.

How we use information

We use information to:

Review your pre-screen and application and decide whether a program may be a fit.
Contact you about your application and next steps.
Prepare a profile and, with your permission, share it with intended parents for matching.
Coordinate with clinics, mental health professionals, lawyers, escrow companies and insurance professionals involved in a match.
Send you the emails and text messages you have agreed to receive.
Keep records of matches, agreements and payments.
Protect the safety and security of our applicants, clients, staff and website.
Understand how our website is used and improve it.
Comply with the law and respond to lawful requests.

A person on our team reviews every application. We do not make eligibility decisions by automated means alone.

Sensitive personal information

Some of what we collect is "sensitive personal information" under California law. This includes government ID numbers, health information, genetic information, information about sex life or sexual orientation, racial or ethnic origin and the contents of messages you send us.

We use sensitive personal information only to provide the services you ask for, to keep our services safe and secure, to comply with the law and for other purposes California law permits. We do not use it to infer characteristics about you. We do not sell it or share it for advertising.

We limit access to sensitive personal information to staff who need it to do their jobs. We share it outside Poppy only as described in the next section.

How we share information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have not done either in the past 12 months.

We share information only in these situations:

With intended parents, for matching. We share your profile only with your permission. Egg donor profiles do not include your name or contact details unless you agree to a known or open arrangement.
With professionals involved in a match. This includes fertility clinics, mental health professionals, lawyers, escrow companies, insurance professionals and background check providers. We share what they need, as you authorize.
With our service providers. These companies help us run our business, such as website hosting, database storage, email delivery, text message delivery and analytics. They may use your information only to provide services to us, under written agreements. They are listed below.
For legal reasons. We may share information to comply with a law, court order or legal process, or to protect the rights, safety or property of you, us or others.
In a business transfer. If Poppy is involved in a merger, sale or similar transaction, information may transfer to the new owner, who must protect it as this policy describes.

Our current service providers are:

Website hosting: [[PLACEHOLDER: hosting provider]]
Database and file storage: Supabase
Email delivery: [[PLACEHOLDER: email delivery provider]]
Text message delivery: [[PLACEHOLDER: SMS provider]]
Website analytics: [[PLACEHOLDER: analytics provider]]
Other: [[PLACEHOLDER: any other service providers]]

How we store and protect information

We store application information in a Supabase database. It is encrypted at rest and in transit. Photos and documents are stored in [[PLACEHOLDER: file storage location]], which is also encrypted at rest. Our systems are hosted in the United States [[PLACEHOLDER: confirm hosting region]].

Access is limited to Poppy staff who need it to do their jobs. Each staff member uses their own account [[PLACEHOLDER: describe added safeguards, such as two-factor sign-in and access logs]].

No system is perfectly secure. If a security incident affects your personal information, we will notify you as the law requires.

How long we keep information

We keep information only as long as we need it. Our current schedule is:

Unfinished drafts of pre-screens and applications are deleted after 12 months of inactivity.
Declined applications are deleted 24 months after the decision.
Withdrawn applications are deleted [[PLACEHOLDER: retention period]].
Active applications and available profiles are kept while you remain active, then handled under [[PLACEHOLDER: retention period after you become inactive]].
Records of matches, agreements and payments are kept for [[PLACEHOLDER: period required by law or for legal claims]].
Egg donor records that may be needed for future medical updates or an agreed identity release are kept for [[PLACEHOLDER: retention period]].
Text message consent and opt-out records are kept for [[PLACEHOLDER: retention period]].
Website analytics data is kept for [[PLACEHOLDER: retention period]].
Emails and other messages are kept for [[PLACEHOLDER: retention period]].

We may keep information longer if the law requires it or if it is needed for a legal claim. When information is no longer needed, we delete it or de-identify it.

Text messages

If you agree, we may send text messages to the number you give us. These are about your pre-screen or application, appointments, next steps and replies to your questions.

Message frequency varies.
Message and data rates may apply.
Reply STOP to opt out at any time. Reply HELP for help, or contact us.
Agreeing to texts is not required to apply.

We do not sell or share your mobile number or text message consent with third parties for their marketing. Mobile carriers are not responsible for delayed or undelivered messages.

Email

We send emails about your pre-screen, application and next steps. If you sign up for updates, we may also send news about Poppy. Every update email includes a link to unsubscribe. We may still send messages you need about an active application.

Cookies and analytics

Cookies are small files a website stores in your browser. We use:

Essential cookies that keep the website secure and save your progress on a form.
Analytics through [[PLACEHOLDER: analytics provider]], so we can see which pages are useful. [[PLACEHOLDER: describe analytics settings, such as IP truncation or cookieless mode.]]

We do not use advertising cookies [[PLACEHOLDER: confirm]]. You can block or delete cookies in your browser settings. Some parts of the site, such as saving a draft, may not work without essential cookies.

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information, no further action is needed.

Your California privacy rights

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. [[PLACEHOLDER: attorney to confirm whether the CCPA applies to Poppy. We intend to honor these rights for California residents either way.]]

You have the right to:

Know and access the personal information we have collected about you, the sources, the purposes and who we have disclosed it to, and to get a copy.
Delete personal information we have collected from you, subject to legal exceptions.
Correct inaccurate personal information.
Opt out of the sale or sharing of your personal information. We do not sell or share personal information.
Limit the use of sensitive personal information. We use it only for purposes California law permits, as described above.
Not be discriminated against for using any of these rights.

Categories of personal information

In the past 12 months, we have collected these categories of personal information. We collected them from the sources and for the purposes described above, and disclosed them only to the recipients described in "How we share information."

Identifiers, such as name, email address, phone number, IP address and government ID number.
Personal records, such as contact details, insurance information and medical information.
Characteristics protected by law, such as age, sex, marital status, race or ethnicity and medical conditions.
Internet activity, such as pages viewed on our website.
Approximate location, based on ZIP code or IP address.
Photos.
Education and professional information.
Sensitive personal information, as described above.

How to make a request

You can make a request by:

Emailing [[PLACEHOLDER: privacy email address]].
Calling [[PLACEHOLDER: toll-free number, if required]].

We will confirm that we received your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why and may take up to 45 more days.

We need to verify your identity before we act on a request. We will ask you to confirm details we already hold. For requests involving health or other sensitive information, we may ask for more.

You may use an authorized agent. We may ask the agent for proof of your signed permission and ask you to verify your identity directly.

California Shine the Light

We do not share personal information with third parties for their own direct marketing.

If you live outside California

We follow this policy for everyone. If you live in another state, you may have rights under that state's laws. Contact us and we will respond as your state's law requires. [[PLACEHOLDER: attorney to review other state privacy and consumer health data laws.]]

Children

Our website and services are for adults 18 and older. Our programs have higher minimum ages: egg donors must be at least 21, and surrogates must be at least 21. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

Applications may ask about children in your household. We use that information only to review your application.

Changes to this policy

We may update this policy. If we make a material change, we will post the new version here with a new effective date and, where appropriate, tell you by email.

Contact us

If you have questions about this policy, contact us:

Company: Poppy Surrogacy, [[PLACEHOLDER: legal entity name]]
Mail: [[PLACEHOLDER: mailing address, Pacific Palisades, California]]
Email: [[PLACEHOLDER: privacy email address]]
Phone: [[PLACEHOLDER: phone number]]