Surrogacy Plus  |  Effective date: 10/1/2026  |  Last updated: 10/1/2026

1. About this Policy

Surrogacy Plus LLC, a Massachusetts limited liability company (“Surrogacy Plus,” “we,” “us,” “our”), manages surrogacy journeys in the United States, including matching, coordination, and related support services (the “Services”) for intended parents and gestational surrogates. We are part of the Tammuz group of companies, together with B.Y.T Tammuz Family Ltd. (“Tammuz”), which manages journeys outside the United States. The two companies are separate legal entities that operate on shared systems (see Section 4). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit www.surrogacy.plus (the “Website”), contact us, book a call, submit a form or questionnaire, or otherwise interact with us.

Please read this Policy carefully. Where the law requires your separate, express consent (for example, health-related information that surrogates give us when applying, or that intended parents give us about their fertility treatment), we will ask for it separately at the time. Using the Website alone is not consent to the collection of sensitive health information.

HIPAA. Surrogacy Plus is not a health care provider, health plan, or health care clearinghouse, and is not a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA). We receive health information from you and, with your written authorization, from your health care providers, and we protect it using safeguards modeled on HIPAA standards. Once your health information is disclosed to us under your authorization, HIPAA may no longer apply to it, but this Policy, your agreements with us, and applicable state law do.

2. Information we collect

Information you provide to us

• Contact and inquiry information — name, email address, phone or WhatsApp number, state/country of residence, and the subject of your inquiry, when you contact us or ask about our Services.
• Scheduling information — name, email address, phone/WhatsApp number, and the topic of your request when you book a call or meeting through Calendly.
• Surrogate application and pre-screening information — if you apply or pre-qualify to become a surrogate, we ask for contact details and answers to screening questions, such as age, residence, marital or relationship status, prior pregnancies and deliveries, pregnancy complications, surgeries, height, weight, and other health-related information, including vaccination status, together with identification documents, background and insurance information.
• Intended parent information — if you inquire or sign up as an intended parent, we collect names and contact details, state or country of residence, family structure and relationship status (and, if you choose to share it, gender identity or sexual orientation), your preferences for a surrogate and journey, fertility history and treatment information (such as diagnoses, clinic and physician details, and embryo or gamete information, including genetic testing results you choose to provide), identification documents, and billing, payment, and escrow information.

Some of this information is “sensitive” under U.S. state privacy laws (see Section 5).

Information collected automatically

When you use the Website, we and our service providers automatically collect device and usage information, including IP address, browser type, operating system, pages viewed, links clicked, referring pages, session duration, approximate location derived from IP address, and cookie or device identifiers, using cookies, pixels, and similar technologies (see Section 6).

Information from other sources

We may receive information from advertising and analytics providers, referral sources, and Tammuz. Information we collect in the course of providing Services offline (for example, medical records, background checks, and contracts) is handled under the separate notices and consents provided at that stage; this Policy describes our general practices and will apply to the extent not inconsistent with them.

3. How we use personal information

• To respond to inquiries, schedule calls, and provide information about our Services.
• To evaluate surrogates’ eligibility and intended parents’ needs, to introduce and match surrogates and intended parents, and to coordinate each journey, as permitted by your consent and any agreement with us.
• To manage contracts, invoicing, payments, and escrow.
• To operate, secure, troubleshoot, and improve the Website and our Services, including analytics and testing.
• To detect and prevent fraud, abuse, and security incidents, and to enforce our terms and policies.
• To send you service communications and, where permitted, marketing communications (see Section 8).
• To measure and deliver advertising about our Services on third-party platforms (see Section 6). We do not use information from surrogate or intended-parent applications, intake forms, or questionnaires, or any health-related information, for advertising or audience matching.
• To comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

4. How we disclose personal information

We do not sell personal information in exchange for money. However, we use online advertising and analytics tools (including cookies and pixels from Google and Meta) and may share online identifiers and contact details with advertising platforms for targeted advertising. Under some state laws this is a “sale” or “sharing” of personal information, and you have the right to opt out (see Sections 6 and 7). We disclose personal information as follows:

• Service providers that help us run the Website and Services, including hosting; our Salesforce customer-relationship-management (CRM) system; Calendly scheduling; WhatsApp, email, and SMS communications; analytics; document and e-signature tools; payment and escrow providers; and professional advisors, under contracts limiting their use of your information.
• Advertising and analytics providers, such as Google and Meta, which receive online identifiers, Website activity data, and (for audience matching) hashed contact details through cookies, pixels, and similar technologies. We do not send them health information or questionnaire answers.
• Tammuz and other affiliates. Surrogacy Plus and Tammuz operate on shared systems, including a shared CRM. Personal information you give us may therefore be accessible to Tammuz personnel, including in Israel, for the purposes described in Section 3 (such as coordinating your journey, operating our systems, and providing support). We limit access to those who need it and bind our affiliates to protections consistent with this Policy through an intercompany data agreement.
• The other side of a potential or confirmed match — intended parents and surrogates (and their representatives), only as you have authorized or as needed to perform an agreement with you. For example, we share a surrogate’s profile with prospective intended parents, and an intended parent’s profile and relevant information with a prospective surrogate.
• Clinics and professionals involved in a journey, such as fertility clinics, physicians, mental health professionals, attorneys, insurance specialists, and escrow and payment providers, only as you have authorized or as needed to perform an agreement with you.
• Partner agencies — if we cannot match you in a timely way and you give your permission, other surrogacy agencies that work with us, so they can consider you for a match.
• Legal and safety purposes — to comply with subpoenas, court orders, or other legal process; to protect the rights, property, or safety of you, us, or others; or to investigate unlawful activity or a security breach.
• Business transfers — in connection with a merger, financing, acquisition, or sale of all or part of our business, subject to this Policy’s protections.

Information we collect may be stored or accessed outside the United States, including in Israel by Tammuz and by service providers. If you access the Website from outside the United States, you understand that your information will be transferred to and processed in the United States and, as described above, elsewhere.

5. Sensitive information and consent

Some information you give us — such as pregnancy and delivery history, fertility history and treatment, medical and surgical history, genetic or embryo-testing information, and information that may reveal sexual orientation or gender identity — is “sensitive personal information” or “consumer health data” under certain state laws. We collect this information only with your separate, affirmative consent (for example, a checkbox on the application or intake form), and only as reasonably necessary to evaluate eligibility (for surrogates), to match and coordinate your journey, and to provide the Services you request. We do not sell it, and we do not use it for targeted advertising. You may withdraw consent at any time by contacting us (Section 7); withdrawal will not affect prior lawful processing but may end your ability to proceed with the application or journey.

Washington and Nevada residents: please see our separate Consumer Health Data Privacy Policy (linked in our Website footer).

6. Cookies, tracking, and online advertising

We and our providers use cookies, pixels, and similar technologies for three purposes: essential (security, site function, remembering your choices); analytics (understanding how the Website is used, for example through Google Analytics); and advertising (measuring and delivering ads about our Services on Google and Meta). You can accept or reject non-essential cookies through our cookie banner and change your choice at any time through the “Cookie Settings” link in the Website footer. You can also block cookies in your browser settings, though some features may not work. Cookies generally last up to 13 months.

Opt-out preference signals. We honor browser-based opt-out preference signals such as Global Privacy Control (GPC) as a valid request to opt out of sharing/targeted advertising for that browser. Do Not Track: our Website does not respond to “Do Not Track” signals except as described in this paragraph.

Targeted advertising. We may use your email address or phone number to show you ads about our Services on platforms such as Google and Meta, where you hold an account under the same contact details. You can opt out at any time through the “Your Privacy Choices” / “Do Not Sell or Share My Personal Information” link in our Website footer, by sending a GPC signal, or by contacting us (Section 7).

7. Your privacy rights

Depending on where you live, you may have some or all of the following rights, which we extend to all U.S. users regardless of state:

• Know / access — the categories and specific pieces of personal information we hold about you, the sources, purposes, and the categories of third parties we disclose it to.
• Correct inaccurate personal information.
• Delete personal information we collected from you, subject to legal exceptions (such as records we must keep by law or need to defend legal claims).
• Portability — receive a copy of your personal information in a portable format.
• Opt out of the sale or sharing of your personal information, targeted advertising, and certain profiling.
• Limit the use of sensitive personal information and withdraw consent previously given.
• Non-discrimination — we will not deny you Services, charge different prices, or provide a different quality of Services because you exercise your rights.

How to submit a request

Email care@surrogacy.plus, call (415) 738-2047, or use the “Your Privacy Choices” link in our Website footer. We must verify your identity before acting on access, correction, deletion, or portability requests, typically by matching information you provide with information we already hold; we will not require more than is reasonably necessary. You may use an authorized agent to submit a request on your behalf; we may ask for proof of authorization.

We will respond within 45 days of receiving a verifiable request. If we need more time, we may extend by an additional 45 days (or as your state’s law allows) and will tell you why. Our disclosures will generally cover the 12 months before your request (and longer where the law requires and it is not impracticable).

Appeals

If we decline your request, you may appeal by replying to our decision or emailing care@surrogacy.plus with “Appeal” in the subject line. We will respond in writing within 45 days of receiving your appeal, explaining our decision. If your appeal is denied, you may contact your state Attorney General. Massachusetts residents may contact the Massachusetts Attorney General’s Office.

8. Email, text, and phone communications

We send marketing emails only in accordance with the CAN-SPAM Act: we do not use false or misleading headers or subject lines, we identify commercial messages as such, we include our physical address (678 NW 7th Ave, Boca Raton, FL 33486), and every marketing email includes a working unsubscribe link, which we honor within 10 business days. You can also unsubscribe by emailing care@surrogacy.plus. Opting out of marketing will not stop service, scheduling, or contract-related messages about a matter you have with us.

We do not send marketing text messages. If you text or message us (including through WhatsApp), we may reply and follow up about your inquiry or application. Reply STOP to opt out of texts. Message and data rates may apply.

9. Notice to California residents

This section supplements the rest of this Policy and applies to California residents under the California Consumer Privacy Act, as amended (“CCPA”). It is also our notice at collection. In the past 12 months we have collected and disclosed the following categories of personal information:

Category (CCPA)	Examples	Disclosed to	Sold / shared*
Identifiers	Name, email, phone/WhatsApp, IP address, cookie/device IDs	Service providers; Tammuz; advertising partners (online IDs and hashed contact details)	Shared
Customer-record information	Contact details; state/country of residence	Service providers; Tammuz; advertising partners (hashed contact details)	Shared
Protected-class characteristics	Age; marital/relationship status; family structure; sexual orientation or gender identity (if you share it)	Service providers; Tammuz	No
Internet / network activity	Pages viewed, clicks, session data, browser and device information	Analytics and advertising providers; service providers	Shared
Geolocation (approximate)	City/region derived from IP address	Analytics and advertising providers	Shared
Commercial / financial information	Billing, payment, and escrow details; contract records	Service providers (payment and escrow); Tammuz	No
Sensitive personal information	Health and reproductive information from surrogates; fertility and medical information from intended parents; government ID copies; financial account details	Service providers; Tammuz (need-to-know access)	No

*“Shared” means disclosed for cross-context behavioral advertising. We do not sell personal information for money and we do not knowingly sell or share the personal information of consumers under 16. To opt out of sharing, use the “Your Privacy Choices” link in our Website footer or send a GPC signal. We use sensitive personal information only to provide the Services you request and for other purposes permitted by the CCPA regulations, so we do not offer a “limit” link; you may still contact us to withdraw consent.

Retention. See Section 12 for how long we keep each category. Sources: you; your devices; our service providers; advertising and analytics partners. Business purposes: as described in Section 3.

Your rights are described in Section 7. California residents also have the right to opt out of sale/sharing, and to correct and delete as described there. California “Shine the Light”: California residents may request information about disclosures of personal information to third parties for their direct marketing purposes by contacting us at care@surrogacy.plus. We do not make such disclosures.

10. Notice to residents of other U.S. states

Residents of states with comprehensive privacy laws (including, as of this Policy’s date, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) may have the rights described in Section 7 and the right to appeal our decisions. We process sensitive data only with your consent. We do not sell personal data or process it for targeted advertising except as described in Sections 4 and 6. Certain laws list specific disclosures: for Texas residents — we do not sell sensitive personal data; for Oregon and Minnesota residents — you may ask for a list of specific third parties to which we have disclosed your personal data

11. Data security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including a written information security program, access limited to personnel with a business need, and encryption of sensitive data in transit. No system is perfectly secure, and we cannot guarantee the security of information transmitted to us. If a breach affects your information, we will notify you and regulators as required by applicable law, including Massachusetts General Laws c. 93H, Florida Statutes § 501.171, and other state breach-notification statutes.

12. Data retention

Category	Retention period
General website inquiries and scheduling records	24 months after last contact, unless you become a client or applicant
Applications and intake forms — surrogate applicants or intended parents who do not proceed	24 months after decision, then deleted or de-identified
Records of matched surrogates and intended-parent clients, including billing and escrow records	Duration of the relationship plus 7 years, or as required by contract or law
Marketing preferences and suppression lists	Until you opt out; opt-out record kept as needed to honor it
Cookie and analytics data	Up to 13 months

We may keep information longer where needed to comply with law, resolve disputes, enforce agreements, or establish, exercise, or defend legal claims.

13. Children

The Website and Services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.

14. Links to other websites

The Website may link to third-party sites we do not own or control. This Policy does not apply to them, and we encourage you to read their privacy policies.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (such as an email or Website banner). Where the law requires consent for a new use of sensitive information, we will obtain it before making that use.

16. Contact us

Surrogacy Plus LLC  |  www.surrogacy.plus

678 NW 7th Ave, Boca Raton, FL 33486

Email: care@surrogacy.plus   |   Phone: (415) 738-2047

Consumer Health Data Privacy Policy

Surrogacy Plus  |  Effective: 10/1/2026

This policy applies to “consumer health data” that Surrogacy Plus LLC (“we”) collects from Washington residents, from people whose consumer health data is collected in Washington, and from Nevada residents.

Categories of consumer health data we collect, and why

• Reproductive and pregnancy-related information (for surrogates: pregnancy and delivery history, complications, and gynecological history; for intended parents: fertility history and treatment, diagnoses, and embryo or gamete information).
• Health conditions, treatments, and surgical history; vaccination status; height, weight, and body mass index (BMI); and genetic or embryo-testing information if you provide it.

We collect this information to evaluate whether a surrogate may qualify, to introduce and match intended parents and surrogates, to coordinate medical screening and treatment logistics, and to provide the Services you ask for. We collect it only with your consent or as necessary to provide the Services you requested.

Sources

Directly from you (applications, questionnaires, and forms), and, with your authorization, from your health care providers and records you direct us to obtain.

Categories we share, and with whom

With your separate consent (or as necessary to provide the Services you requested), we share the above categories with: intended parents, surrogates, and their representatives (only as part of a potential or confirmed match); fertility clinics and physicians conducting medical review or treatment; our attorneys and escrow/insurance vendors; other surrogacy agencies we work with (only if you agree to be matched through them); and service providers acting as processors, including our Salesforce CRM and hosting providers. Affiliates with access: B.Y.T Tammuz Family Ltd. (Israel), with which we operate shared systems.

We do not sell consumer health data. We do not use geofencing around facilities that provide in-person health care services.

Your rights and how to exercise them

• Confirm whether we collect, share, or sell your consumer health data, and access it, including a list of all third parties and affiliates with which we have shared or sold it and their contact information.
• Withdraw consent to our collection or sharing of your consumer health data.
• Delete your consumer health data (we will also notify our affiliates, processors, and third parties to delete it, subject to legal exceptions).

Submit a request to care@surrogacy.plus. You do not need to create an account. We will respond within 45 days, and may extend once by 45 days where reasonably necessary, with notice to you. Appeals: if we deny your request, you may appeal by emailing care@surrogacy.plus with “Appeal” in the subject line; we will respond within 45 days of receipt and explain our decision in writing. If your appeal is denied, you may contact the Washington Attorney General at www.atg.wa.gov/file-complaint.