Skip to content
Ivy Surrogacy

Privacy Policy

Last updated: September 2026

1. Who We Are

Ivy Surrogacy is a full-service surrogacy and egg donation agency headquartered in Los Angeles, California. We are licensed by the New York State Department of Health and are proud members of SEEDS (Society for Ethics in Egg Donation and Surrogacy).

2. Information We Collect

We collect the following types of information:

  • Contact details: name, email, phone number, mailing address.
  • Application data: age, reproductive history, medical background, photographs, and other information submitted through our surrogate, egg donor, or intended parent applications.
  • Health information: voluntarily provided medical data, which we treat as sensitive information with enhanced protections.
  • Technical data: IP address, browser type and version, device information, and cookies.
  • Usage data: pages visited, time spent on site, referral sources, and marketing engagement metrics.

3. How We Use Your Data

We use your information to:

  • Evaluate applications from surrogates, egg donors, and intended parents.
  • Match intended parents with suitable surrogates and egg donors.
  • Coordinate with IVF clinics, attorneys, and other service providers.
  • Communicate with you about your application status and our services.
  • Improve our website functionality and user experience.
  • Comply with legal and regulatory requirements.
  • Follow up with you after you contact us or apply — by email, including reminders to finish your registration and occasional news about our programs, which you can unsubscribe from at any time; and by text message only with the consent described in Section 6.

4. Health Information Notice

Ivy Surrogacy is not a medical provider and is not classified as a HIPAA "covered entity." However, we recognize the sensitivity of health-related information such as reproductive history and medical background.

We apply industry-standard safeguards guided by HIPAA principles, including:

  • Encrypted data transmission using SSL/TLS protocols
  • Access controls limiting who can view sensitive information
  • Secure storage on trusted cloud infrastructure
  • Regular security assessments and updates

Your health information is shared only with licensed medical professionals, IVF clinics, or legal advisors directly involved in your case, and only through secure channels. It is never sent to advertising or analytics platforms: the measurement tools described in Section 5 receive page views and generic progress events (for example, that a visitor moved to the next question of our surrogate pre-screening questionnaire, passed it, or did not pass it — but never which question or why), and never your answers or your health details. The only personal identifier that reaches an advertising platform is the one-way hashed email address sent to Meta after you accept cookies and submit a form, described in Section 7. Separately, any information you voluntarily type into our website chat assistant is transmitted to third-party AI providers to generate responses (see Section 7); please do not enter sensitive medical details there.

Wherever you live, please also read our Consumer Health Data Privacy Policy, which describes the health-related information we collect, why, whom we share it with, and how to exercise your rights, including the rights given by the Washington and Nevada consumer health data laws.

5. Cookies & Tracking Technologies

What Are Cookies?

Cookies are small text files placed on your device when you visit our website. They help us keep the site working, remember your choices (such as your language and your cookie decision), and understand how the site is used.

Types of Cookies We Use

  • Strictly Necessary Cookies: Essential for basic site operation, including form submissions, session management, and security features. These cannot be disabled.
  • Performance & Analytics Cookies: Help us understand how visitors use our site through tools like Google Analytics. These measure traffic patterns and help us improve our services.
  • Functional Cookies: Remember your preferences such as language settings and cookie consent choices, the country or state we detected in order to apply the right consent rules (kept for 24 hours), and, if you arrived through an ambassador's referral link, that referral code (kept for 30 days) so the referral can be credited.
  • Ad-Measurement Cookies: Used to measure whether an advertisement on Google or Meta (Facebook/Instagram) led to a visit or an application. We do not use them for personalized advertising or remarketing: our Google tag is configured with personalized-advertising signals permanently off, and we do not create remarketing or lookalike audiences from Meta Pixel data. The Meta Pixel loads only after you click Accept.

Managing Your Cookie Preferences

When you first visit our site, you will see a cookie banner with two equal choices: Accept and Decline. Strictly necessary cookies are used either way. For visitors in most of the United States, Google Analytics (with ad-measurement consent) runs from your first page view until you click Decline; Decline stops it and also removes the analytics and ad-measurement cookies already set. For visitors in Washington, Nevada, and Connecticut, in the European Economic Area, the United Kingdom, and Switzerland, and wherever we cannot determine your location, no analytics or ad-measurement tool loads until you click Accept. The Meta Pixel never loads until you click Accept, wherever you are. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a Decline automatically, even if you clicked Accept earlier. You can change your choice at any time by clearing this site's cookies; the banner will then appear again. You can also control cookies through your browser settings:

Please note that disabling certain cookies may affect website functionality.

Third-Party Services

We use the following third-party services that may set cookies:

  • Google Analytics: Website traffic analysis and, when we run Google Ads campaigns, measurement of whether an ad led to a visit or an application. Personalized advertising and remarketing are turned off.
  • Meta Pixel: Measurement of Meta ad conversions. Loads only after you click Accept.
  • Cloudflare: Security and performance optimization
  • Cloudflare Turnstile: Bot protection for forms

These third parties have their own privacy policies, and we encourage you to review them.

6. Text Messages (SMS)

With your consent, we send SMS text messages about your application and appointments — for example booking links, confirmations, and reminders. Message and data rates may apply, and message frequency varies. Reply STOP at any time to opt out, or HELP for help.

No mobile data sharing: mobile phone numbers and SMS opt-in consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes.

7. Sharing of Data

We may share your information with:

  • IVF clinics and healthcare providers: To facilitate medical procedures and coordination.
  • Reproductive attorneys: For legal contract preparation and compliance.
  • Trusted service providers: Including cloud hosting, IT support, and analytics services, all bound by confidentiality agreements.
  • AI assistant providers: If you use our website chat assistant, your messages — including anything you choose to share — are processed by third-party large-language-model providers (Anthropic and Google) solely to generate replies. We do not use these conversations to make decisions about your care.
  • Advertising measurement platforms (Google, Meta): Google Analytics receives page views and generic progress events from your first page unless you decline — or, in the regions listed in Section 5, only after you accept. Meta receives nothing unless you click Accept. If you have accepted and then submit an application, the contact form, or a portal registration, Meta also receives a one-way hashed version of your email address, your IP address and browser type, Meta's cookie and ad-click identifiers, an internal reference number, which program you applied to (surrogate, egg donor, sperm donor, or intended parent), and — for surrogate applications — a hashed version of your state and a hashed "United States / female" indicator, so that we can measure whether an advertisement led to that submission. Google and Meta handle this data under their own privacy policies. Neither platform ever receives your questionnaire answers, health details, name, or phone number, and Google never receives your email address in any form.
  • Referral partners (ambassadors): If you were referred by one of our ambassadors, that ambassador can see your name, the contact details on the referral, and the stage your application has reached (in progress, applied, approved, matched, or closed) so that we can pay their referral reward. They never see your questionnaire answers or medical information.
  • Regulatory authorities: When required by law or legal process.

We do not sell your personal data. The only data that leaves us for advertising purposes is the ad-measurement described above, and you can stop it at any time by turning on Global Privacy Control in your browser, or by clearing this site's cookies so the banner appears again and clicking Decline.

8. Data Security

We implement comprehensive security measures including:

  • 256-bit SSL/TLS encryption for all data transmission
  • Password-protected system access, with multi-factor authentication for staff accounts
  • Secure cloud storage with enterprise-grade security
  • Regular security audits and vulnerability assessments
  • Employee training on data protection best practices

9. Your Privacy Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data (subject to the retention rules in Section 11). Portal account holders can delete their account directly from their account settings page (Settings → Delete Account) — the account is deactivated immediately and, after a 30-day grace period during which you can ask us to restore it, we permanently delete or irreversibly anonymize the personal data associated with it, as described in Section 11. You can also contact us at contact@ivysurrogacy.com.
  • Restriction: Request that we limit how we use your data.
  • Portability: Receive your data in a structured, machine-readable format (GDPR).
  • Objection: Object to certain types of processing.
  • Withdraw consent: Withdraw previously given consent at any time.

To exercise any of these rights, please contact us at contact@ivysurrogacy.com.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You can request details about the personal information we have collected about you in the past 12 months.
  • Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
  • Right to Opt-Out of Sale or Sharing: You can opt out of the sale or sharing of your personal information. We do not sell personal information. The only sharing for advertising purposes is the ad-measurement described in Section 5; to opt out, click Decline on the cookie banner (if you already clicked Accept, clear this site's cookies and the banner will appear again) or turn on Global Privacy Control in your browser — we honor that signal automatically.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, email us at contact@ivysurrogacy.com with "CCPA Request" in the subject line.

11. Data Retention

  • Account deletion: When you delete your account it is deactivated immediately, and you can ask us to restore it within 30 days. After the 30-day grace period we permanently delete your login, profile, application questionnaire, uploaded photos and videos, and your contact details from our systems. Where you were matched into a surrogacy or donation case, the case file (agreements, medical, escrow and financial records) is retained for the legally required period (typically 7+ years) with your identifying details removed wherever the record does not require them. A minimal internal record of the deletion (an internal ID, a one-way hash of your email address, and the dates) is kept so we can honor the deletion and answer later requests. If you had opted out of text messages, we keep your phone number on our do-not-contact list so we never message you again. Encrypted backup copies may persist for up to 13 months and are used only for disaster recovery; if a backup is ever restored, deletions are re-applied. Calendar entries and continuity copies held by our staff are removed on the same schedule.
  • Application data: Retained for the duration of our relationship and as needed for potential future services.
  • Medical and legal documents: Retained as required by applicable laws (typically 7+ years).
  • Analytics data: Google Analytics keeps user- and event-level data for up to 14 months; aggregated statistics that contain no identifiers may be kept longer. Ad-measurement events sent to Meta are kept under Meta's own retention policy. Anonymous daily counts from our pre-screening questionnaire (how many visitors were not eligible at each question, with no identifiers) are kept indefinitely.
  • Chat assistant transcripts: Deleted 180 days after your last message.
  • Marketing data: Retained until you request deletion. Opting out stops messages immediately; the opt-out record itself is kept so we can honor it.

12. International Data Transfers

If you are located outside the United States, please be aware that your data is transferred to and processed in the U.S., where privacy laws may differ from those of your country. By using our services you understand that this is where your data will be handled.

13. Children's Privacy

Our services are intended for individuals 18 years of age and older. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete that information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on this page with a new "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Start Your JourneyContact Us