FertyLink Privacy Policy
Effective date: [09-21-26] Last updated: [09-21-26]
FertyLink (“FertyLink,” “we,” “us,” “our”) operates the FertyLink mobile applications for donors and intended parents and the FertyLink web platform for participating clinics, cryobanks, and agencies. Our platform helps intended parents connect with eligible donors and donor specimens through participating organizations. This Privacy Policy explains what information we collect, how we use and share it, how we protect it, and the choices and rights you have.
FertyLink handles sensitive reproductive, medical, and genetic information, and we treat it with heightened care. Where we process health information on behalf of a participating clinic, cryobank, or agency, we act as a HIPAA Business Associate under a Business Associate Agreement (BAA) with that organization (the HIPAA Covered Entity). Compliance with a BAA does not by itself satisfy every applicable privacy law, and this Policy describes our broader commitments.
1. Information we collect
a. Information you provide directly
- Account and identity: name, email address, phone number, postal address or ZIP code, and account credentials.
- Donor profile and eligibility information: date of birth, height and weight, citizenship/work-eligibility status, reproductive and medical history, screening and laboratory results, genetic screening information, psychological-evaluation status, identity-disclosure preference, family-limit preferences, and any profile content you choose to share.
- Intended-parent intake information: the service you are seeking, budget range, timeline, and any notes you provide.
- Photographs: a profile photo, and — if you use the photo-match feature — a reference photo you upload (see Section 2).
- Voice recordings: if you choose to answer application questions by voice, the audio you record (see Section 2).
- Documents and communications: files you upload, and messages and support requests you send through the platform.
- Payment information: the billing details you enter to reserve or purchase. We do not store full payment-card or bank-account numbers on our servers. Card and payment processing is performed by Stripe, and transaction funds are held in escrow by PNC Bank until release conditions are met (see Section 4).
b. Information collected automatically
- Technical and device data: IP address, device identifiers, operating system, and app version, collected by our servers when your app or browser communicates with us.
- Approximate location: derived from your IP address and from the ZIP code you provide, which we use to match you regionally. The mobile apps do not request precise GPS or device location.
- Security and audit logs: our servers keep audit records of key actions (such as logins and record changes) to protect the integrity and security of health data. These records are used for security, compliance, and troubleshooting — never for advertising.
c. What we do not do
- The FertyLink mobile apps do not contain third-party advertising, analytics, or crash-reporting software, and do not track you across other apps or websites.
- We do not sell your personal or health information, and we do not use health information for advertising.
- We do not send your information to any external AI service. All AI processing runs inside our own cloud environment under a Business Associate Agreement (see Section 7).
2. How we use information
We use the information we collect to:
- create and manage your account;
- evaluate donor eligibility and present eligible donors and specimens to intended parents through participating organizations;
- facilitate reservations, matching, payment, and cryogenic logistics;
- enable coordinator-mediated communication between parties;
- provide AI-assisted features, including conversational donor search, photo-match, and voice-to-text for application answers (see Section 7);
- send you service and transactional notifications;
- maintain security, prevent fraud, and comply with our legal and FDA obligations.
Sensitive processing detail.
- Voice recordings are transmitted securely and converted to text within our own cloud environment. The audio and any temporary copies are deleted after transcription and are not retained as audio.
- Conversational search converts your typed question into a numeric vector and compares it against vectors representing donor profiles, using a similarity search inside our own database.
- Photo-match works by generating a written description of the facial features in the reference photo you upload, converting that description into a numeric vector, and comparing it against vectors representing donor profile photos. The comparison runs inside our own database. We do not generate or store a scan of face geometry, a faceprint, or any other biometric identifier or biometric template. [CONFIRM: how long the uploaded reference photo itself is retained, and whether it is deleted after the match runs.]
3. Consent and legal bases
Where required, we rely on your consent — for example, to access your microphone, camera, and photos; to process health information; and, for donors, to distribute your profile across the network. We also rely on the performance of our services to you, our legitimate interests in operating and securing the platform, and compliance with law. You may withdraw consent at any time (see Section 9); some features will not work without the related permission.
4. How we share information
We share information only as described here:
- Participating organizations (clinics, cryobanks, and agencies) involved in your care or in a donor’s eligibility and distribution, consistent with the applicable BAA.
- CryoGenesis, our FDA-registered distribution affiliate, for specimen distribution.
- Service providers (sub-processors) that process information on our behalf under contract and may use it only to provide their service to us (see the table below).
- Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect rights and safety.
- Business transfers: in connection with a merger, acquisition, or asset sale, subject to this Policy.
Donor profiles are made available to intended parents across the network only where the donor’s written consent expressly authorizes network distribution. Even then, the platform is coordinator-mediated and designed to prevent direct contact (see Section 8).
Sub-processors:
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Card and payment processing (reservations, purchases) | Billing and payment details; card data handled by Stripe, not stored by us |
| PNC Bank | Escrow — holding and releasing transaction funds | Transaction and settlement data |
| Amazon Web Services | Platform hosting, database, document storage, transactional email, and AI model hosting (Amazon Bedrock) for search, photo-match, and voice-to-text | Account, health, document, image, and audio data — under a Business Associate Agreement, within our own AWS account |
| Google (Maps/Geocoding; Firebase Cloud Messaging) | Regional matching from ZIP; push notifications | Approximate location; device push token |
| DocuSign | Electronic signature of consents and agreements | Identity and document data |
| Cryoport | Cryogenic shipping and logistics | Shipping-related data |
Payment and escrow processing takes place in the United States.
5. Data security
We use administrative, physical, and technical safeguards designed to meet HIPAA requirements, including encryption in transit (TLS 1.2 or higher) and encryption at rest for sensitive fields, including donor profile records and clinical and coordinator notes. Access is role-restricted and audited. AI model access is authenticated through scoped cloud roles rather than shared API keys. No system is completely secure, and we cannot guarantee absolute security.
6. Data retention
We keep information only as long as necessary for the purposes described above or as the law requires:
- Account and profile information: for the life of your account, then deleted or de-identified [within 60 days of account deletion, subject to legal holds].
- Donor eligibility and specimen records: for the periods FDA regulation requires.
- Transaction and tax records: for the periods applicable financial and tax law requires.
- Voice audio: deleted after transcription (not retained as audio).
- Search and photo-match vectors: stored with the associated donor profile and deleted when that profile is removed.
- Security and audit logs: retained on a rolling basis for security and compliance, then deleted.
7. AI and automated processing
Some features use artificial intelligence, including conversational donor search, photo-match, semantic matching, and voice-to-text.
These models run inside our own cloud environment through Amazon Bedrock, under our Business Associate Agreement with Amazon Web Services. Your information is not sent to any external AI provider, and we hold no external AI API keys. The similarity matching itself is performed by our own database, not by any outside service.
AI tools assist FertyLink staff and users; they do not make final eligibility or medical decisions about you on their own. We do not use your information to train any AI model, and no model provider uses your information to train theirs.
8. De-identification and no direct contact
FertyLink is designed to keep counterparty identities separate and to prevent direct contact between intended parents and donors. Intended parents do not see the organization holding a donor or the donor’s identifying details, and all cross-party communication is coordinator-mediated. Donor information shown to intended parents is limited to what the donor has consented to share.
9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your information, to opt out of promotional communications, and to withdraw consent.
- California (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. We do not sell your personal or health information.
- Consumer health-data laws (such as Washington’s “My Health My Data” Act and similar laws in other states): additional consent requirements and rights may apply to consumer health data.
- Device permissions: You can grant or revoke camera, photo, and microphone access at any time in your device settings.
To exercise your rights, contact us using the details in Section 17. We will not discriminate against you for exercising your rights.
10. How to delete your account and data
You can request deletion of your FertyLink account and associated personal data:
- In the app: [Settings → Account → Delete Account]. Donors may also withdraw their application at [Settings → Withdraw].
- By web request: email privacy@fertylink.com or use https://fertylink.com/delete-account/.
After we verify your request, we delete or de-identify your personal data within 60 days, except information we are required to retain by law (such as FDA eligibility records and financial and tax records) or that we need to resolve disputes and enforce our agreements. We will tell you what is retained and why (see Section 6). Deactivating or suspending an account is not the same as deleting it, and we do not treat it as deletion.
11. Children’s privacy
The platform is intended for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.
12. Cookies and similar technologies
The FertyLink web platform uses only strictly necessary and functional technologies (such as authentication and session storage) and loads Google Maps for mapping features. We do not use advertising or cross-site tracking cookies. The mobile apps store only sign-in tokens and app settings on your device.
13. Data-breach notification
If a breach affecting your personal or health information occurs, we will notify affected users, the relevant participating organizations, and regulators as required by HIPAA and applicable state law, within the timeframes those laws require.
14. International data transfers
We process and store data primarily in the United States. If you access the platform from outside the United States, you consent to the processing of your information in the United States.
15. Not medical advice
FertyLink is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Information provided through the platform, including AI-assisted matching and search results, does not replace professional medical advice, diagnosis, or treatment. Consult a qualified healthcare professional about your care and treatment decisions.
16. Changes to this Policy
We may update this Policy from time to time. We will post the new effective date at the top of this page and, for material changes, provide notice within the app or by email. Your continued use of the platform after the effective date means you accept the updated Policy.
17. Contact us
FertyLink LLC – 5741 Cleveland St., Suite 300, Virginia Beach, VA 23462
Email: privacy@fertylink.com
Phone: 757-734-5026