Thread Surrogacy
Consumer Health Data Privacy Policy
Thread Surrogacy LLC ("Thread," "we," "us," or "our") provides non-medical surrogacy coordination. This Policy explains how we collect, use, and disclose consumer health data through our website, questionnaires, applications, communications, and coordination services.
Consumer health data is personal information linked or reasonably linkable to a person that identifies or reveals health status, reproductive or sexual health, efforts to obtain related services, or health-related inferences. It can include ordinary contact or browsing information when the context reveals such information. This Policy addresses applicable state consumer health privacy laws, including those of Washington and Nevada; statutory rights depend on the law and data involved.
Thread is not a medical provider, and health information given to Thread is not automatically covered by HIPAA. This Policy is separate from our Website Privacy Policy and from any medical-record authorization. If our policies conflict about consumer health data, the more protective provision applies.
1. Categories collected and why we use them
We collect information relevant to the inquiry or service requested, rather than every category from every visitor. Our categories and purposes are:
Service-seeking information. Contact details associated with a health-related inquiry; requests for surrogacy, fertility, pregnancy, or related services; appointment and journey information. We use these to respond, arrange requested services, and communicate about the application or journey.
Reproductive and pregnancy history. Fertility and reproductive information; pregnancy, delivery, and transfer history; prior surrogacy experience; and related records. We use these for intake review, screening coordination, and appropriate next steps.
Health and screening information. Conditions or diagnoses, medications, height and weight, and relevant mental-health or substance-use screening information. We use these to coordinate eligibility and safety review by appropriate professionals.
Records and professional assessments. Medical records, laboratory or screening results, clinical or psychological assessments, and information about care or treatment received through authorized sources. We use these for requested records review, screening, and journey coordination.
Health coverage information. Health insurance coverage, relevant benefit needs, and related review information. We use these to coordinate coverage review and benefit administration.
Health-related activity and inferences. Application answers and progress, communications, browsing or referral information that reveals reproductive or health interests, and eligibility or coordination flags derived from these categories. We use these to operate and secure the intake process, preserve progress, support human review, and assist with the requested service—not for targeted advertising.
We also use information only as legally permitted to meet applicable obligations and protect participants or legal rights. These purposes are not a blanket exception to consent or deletion requirements.
2. Sources and manner of processing
Sources include you; an authorized representative or journey participant; and, with appropriate permission or another lawful basis, fertility clinics, medical providers, laboratories, psychologists, attorneys, insurance specialists, and screening providers involved in your requested services. Website and operational service providers supply technical or application records that can become health data because of their context.
We process information through electronic forms, communications, document and case-management systems, and staff review. Tools help organize responses, preserve progress, and flag items for review; you may ask staff to review an intake outcome. Independent professionals make their own clinical or other professional determinations. Incomplete forms may be saved as you proceed, after the collection notice and any required consent—not only when you select final submission.
3. Collection, sharing, and consent
We collect and share consumer health data with the consent required by applicable law or to the extent necessary to provide a product or service you requested, or under another specific legal authorization. Where consent is required, we obtain it before collection or sharing. Consent to sharing is separate from consent to collection. Our request identifies the data, purpose, relevant recipient categories, and how to withdraw consent.
Reading a policy, accepting general website terms, or consenting to cookies does not itself authorize health-data collection or sharing that requires separate consent. Medical-record releases and other specific authorizations are obtained when needed. You can withdraw consent using the contact details below. Withdrawal applies to future activity and may limit services that require the information; it does not undo completed disclosures.
4. Categories shared and recipients
We share only information relevant to the recipient’s role, with required consent or another lawful basis. Not every recipient receives every category.
Operational processors. Hosting, intake, customer relationship management, communications, scheduling, e-signature, secure document-storage, and security providers can process the categories in Section 1 as needed to operate Thread’s services, under contracts limiting their processing.
Clinical and screening professionals. Clinics, medical providers, laboratories, and psychologists can receive relevant service-seeking information, reproductive history, health and screening information, records, and review results for requested professional evaluation and coordination.
Other journey professionals. Attorneys, insurance specialists, escrow providers, and other screening professionals can receive the service, coverage, milestone, or assessment information necessary for their assigned role. Their involvement does not grant routine access to a complete medical file.
Potential matches. Selected intended parents or prospective surrogates can receive approved profile information for a requested introduction. Information identifying an interest in surrogacy can itself be health data. A surrogate’s approval is required before her profile is shared; private medical records and detailed health history are excluded. Any additional health-related disclosure requires its own lawful basis and any necessary specific authorization.
Affiliates receiving consumer health data. [CONFIRM NONE, OR INSERT THE LEGAL NAME OF EACH AFFILIATE RECEIVING CONSUMER HEALTH DATA AND ITS ROLE.] Common ownership alone does not authorize an affiliate to access your information.
Legally authorized recipients. Relevant information may be disclosed to advisers, authorities, or a successor only where legally authorized and subject to applicable health-data protections. A business transaction does not remove the obligations attached to the data.
5. No health-data sales or advertising disclosures
We do not sell consumer health data for money or other valuable consideration. We do not use it for targeted advertising, retargeting, advertising audience creation, or another organization’s marketing. We prevent advertisers from receiving it through pixels, cookies, analytics integrations, or server-side transmissions.
These protections cover public pages as well as questionnaires and uploads. Health-revealing URLs, page titles, application events, identifiers, and inferred interests are protected even without a medical record or a completed application. Hashing an identifier does not make it anonymous. We do not permit third parties to collect consumer health data through our services for tracking people over time and across other websites or online services. Cookie choices do not waive these restrictions.
6. Retention and safeguards
We retain consumer health data only as reasonably needed for an active inquiry, application, requested journey services, authorized follow-up, or a legally permitted recordkeeping purpose. We consider the service stage, sensitivity, consent status, deletion requests, and specific legal obligations. We delete or appropriately de-identify data when it is no longer needed. A general desire to keep business records does not override a statutory health-data deletion right.
Administrative, technical, and physical safeguards are designed for the sensitivity of the data. Access is limited to personnel and processors who need it for authorized purposes. No system can guarantee absolute security. Use our designated document-submission method for sensitive records.
7. Access, correction, withdrawal, and deletion
Contact us to request review or correction of your health information. Where applicable state consumer health privacy laws provide rights, you can also:
Confirm whether we collect, share, or sell your consumer health data and access it as provided by law.
Obtain the required list of third-party recipients and, where required, affiliates and their active contact information.
Withdraw consent or ask us to stop collecting or sharing your consumer health data, as provided by law.
Request deletion, including required notification to processors and other recipients.
Appeal a refusal and exercise these rights without unlawful discrimination.
How to request. Email contact@threadsurrogacy.com or write to the address below. Describe your request and provide contact information that helps us locate your records. Do not send medical records or identity documents with the initial request. We use reasonable verification measures and request only additional information needed to authenticate and handle the request. You do not need a new account.
Washington timing. For requests under Washington’s My Health My Data Act, we respond without undue delay and within 45 days after receipt; verification does not restart that period. A permitted extension is limited to an additional 45 days, with notice and a reason during the initial period. Required deletion includes notifying recipients; any permitted backup-deletion delay does not exceed six months after authentication.
Nevada timing. For requests under Nevada’s consumer health data law, we respond without undue delay and ordinarily within 45 days after authentication, with a further 45 days only where permitted and with timely notice. Deletion requests are handled within 30 days after authentication, subject to applicable exceptions; any permitted backup-deletion delay does not exceed two years. Where multiple laws apply, we follow the more protective applicable requirement.
Other requests are handled within the applicable legal deadline. Information responses are free at least twice annually where required, subject only to legally permitted treatment of excessive, repetitive, or manifestly unfounded requests. If we cannot authenticate a request or cannot fulfill it in full, we explain the reason and any lawful limitation.
8. Appeals and complaints
To appeal, reply to our decision or email contact@threadsurrogacy.com with “Health privacy appeal” and explain why you want reconsideration. For appeals under Washington or Nevada consumer health privacy law, we provide a written decision and reasons within 45 days after receipt. If the appeal is denied, we provide information about contacting the appropriate attorney general.
You can also contact the Washington Attorney General or the Nevada Attorney General about applicable health-privacy concerns.
9. Changes to this Policy
We post revisions and update the date above. We notify affected consumers of material changes through a prominent website notice or direct communication as appropriate. Before collecting, using, or sharing additional health-data categories, using data for additional purposes, or adding recipients where the law requires it, we make the required disclosures and obtain affirmative consent. Continued website use does not supply that consent.
10. Contact Thread
Thread Surrogacy LLC
Attn: Privacy
Email: contact@threadsurrogacy.com
Mail: 1370 Pitman Ave, Palo Alto, CA 94301