Privacy policy

Summary

We collect only what we need to answer your enquiry and run this website. Health, fertility and relationship details you share are treated as sensitive data and processed only with your explicit consent. We do not sell your personal data, you can reject non-essential cookies at any time, and you can ask us to access or delete your data at any time.

• We never sell personal data or consumer health data.
• We only share enquiry details with a clinic, agency or lawyer if you ask us to introduce you, and we tell you who first.
• Analytics and advertising-measurement cookies are on by default. You can reject or change them at any time through Cookie settings, and we honour a browser Global Privacy Control signal when you have not made a choice.
• You can withdraw consent at any time through our contact form (write "Privacy request" in your message), or at any time through Cookie settings for cookies and analytics.

Who is responsible for your data

The data controller for this website and our enquiry service is Surrogacy Beyond Borders. If we appoint a data protection officer or a representative in the EU or UK, their details will appear here. Use our contact form for any question about this policy.

• Controller: Surrogacy Beyond Borders
• Privacy contact: our contact form, with "Privacy request" in your message
• Data protection officer: none appointed. Our privacy lead handles privacy questions and can be reached through the same contact form.

What we collect

We collect contact details and enquiry information you give us, technical data your browser sends when you visit, and analytics data, which you can switch off. Some enquiry fields, such as fertility history or relationship status, can reveal information about your health or sex life, which the law treats as especially sensitive.

Please do not send medical records, passport scans or other documents unless we ask for them for a specific, explained purpose.

Health data and explicit consent

Information about fertility, health or sexual orientation is "special category" data under the EU and UK GDPR (Article 9) and "consumer health data" under some US state laws. We process it only with your explicit, separate consent, given by ticking an unticked box on the enquiry form, and you can withdraw that consent at any time.

• The consent box is never pre-ticked and is separate from accepting this policy.
• You can still contact us without giving health information; we may just be able to say less about which options fit you.
• Withdrawing consent does not affect processing already carried out, but we will stop further processing and delete the sensitive data unless we must keep it by law.
• We do not use health information for advertising, and we do not use geofencing around healthcare facilities.

Why we use your data and our lawful bases

Under the EU and UK GDPR we must have a lawful basis for each use of personal data. We rely on steps you ask us to take before a contract, our legitimate interests in running a secure website, legal obligations, and your consent: explicit consent for health-related information, and consent you can withdraw at any time for non-essential cookies.

US state privacy and health data laws

Several US states give residents rights over their personal data, and some have specific consumer health data laws. Washington's My Health My Data Act and Nevada's SB 370 require consent before collecting or sharing consumer health data. We apply these consent and no-sale standards to all US visitors, whether or not a particular law covers us.

Comprehensive state privacy laws. As of October 2026, around 20 states have comprehensive consumer privacy laws, including California (the CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, and — from 1 January 2026 — Indiana, Kentucky and Rhode Island. Each law has its own thresholds, and some may not apply to us. We apply the rights described below to residents of every US state, regardless of thresholds.

Consumer health data laws.

• Washington — My Health My Data Act (RCW 19.373). Signed in April 2023; its main obligations applied from 31 March 2024 (30 June 2024 for small businesses). It requires consent to collect and share consumer health data, separate written authorization to sell it, a dedicated consumer health data privacy policy, and gives consumers a private right of action. Our consumer health data section is written to meet it.
• Nevada — SB 370 (2023). In effect since 31 March 2024, with similar consent requirements; enforced by the Nevada Attorney General.
• Connecticut. Connecticut's Data Privacy Act was amended in 2023 to add protections for consumer health data.
• New York. The New York Health Information Privacy Act passed the legislature in January 2025 but was vetoed in December 2025; a revised bill was introduced in 2026. It is not law as of the date of this policy.

We do not sell personal information or consumer health data, and we do not use your data for personalised or cross-context behavioral advertising. Our advertising-measurement cookies are used only to measure our own campaigns. We honor Global Privacy Control (GPC) browser signals as an opt-out.

Consumer health data privacy policy

This section is our consumer health data privacy policy for Washington, Nevada and similar laws. We collect health-related information only from you, only with consent, only to respond to your enquiry and provide services you request, and we share it only with providers you ask us to introduce you to and our contracted processors.

• Categories collected: relationship status and family structure, fertility and medical history you choose to share, need for donor eggs or sperm, and inferences about pregnancy plans.
• Purposes: answering your enquiry, assessing which destinations may be open to you, and introductions you request.
• Sources: you directly.
• Shared with: processors listed in Who we share data with, and clinics, agencies or lawyers you have asked us to introduce you to.
• Your rights: to confirm whether we hold your consumer health data, access it, see a list of the third parties and affiliates we shared it with, delete it, and withdraw consent. Use the contact details in Your rights.

Cookies

We set strictly necessary cookies, such as those that remember your cookie choice and protect our forms from spam. Analytics and advertising-measurement cookies are on by default. You can reject them in our cookie banner and change your choice at any time from the "Cookie settings" link in the footer. If your browser sends a Global Privacy Control signal and you have not made a choice, we treat it as a rejection.

In the UK, the Data (Use and Access) Act 2025 amended the cookie rules from 5 February 2026 so that some low-risk cookies, including certain statistical cookies, may be used without prior consent if users are given a clear way to opt out. That exemption may cover purely statistical analytics in the UK. Advertising measurement, and visitors in the EU, are not treated that way: the same reject-anytime control in Cookie settings applies to every visitor, and we honour Global Privacy Control. We never place cookies or pixels on pages that would transmit the content of your enquiry or health information to advertising platforms.

How enquiry form data is handled

The multi-step enquiry form sends your answers over an encrypted connection to our own lead management system, hosted in India, where only authorised team members can see them. We use your answers to prepare for your consultation. We do not pass them to any clinic or agency unless you ask us to.

• Fields marked optional are optional; the health-related fields require your explicit consent tick.
• Partially completed forms are not stored: nothing is sent until you submit the final step.
• Access is limited to client consultants and their team leads, protected by multi-factor authentication.

Who we share data with

We use a small number of service providers (processors) to run our website, forms, email and scheduling. They may use your data only on our instructions under a written contract. We share data with clinics, agencies or lawyers only with your consent, and with authorities only where the law requires it.

International transfers

Because surrogacy journeys cross borders, your data may be processed outside the UK or European Economic Area. When we transfer data, we rely on an adequacy decision, the EU Standard Contractual Clauses or UK International Data Transfer Agreement or Addendum, or — for introductions you ask for — your explicit consent after we explain the risks.

Where a US provider is certified under the EU-US Data Privacy Framework (or its UK Extension), we may rely on that certification. The EU General Court upheld the Framework in September 2025; an appeal to the Court of Justice is pending, so we keep Standard Contractual Clauses available as a fallback.

Some destination countries do not have data protection laws equivalent to the GDPR. Before introducing you to a provider there, we will tell you and ask for your explicit consent to the transfer.

How long we keep data

We keep enquiry data only as long as needed to help you and meet legal obligations. If you do not go ahead, we delete enquiry and health data after a set period. Records of any future paid service would be kept for the period tax and limitation laws require. Exact periods are listed below.

How we protect your data

We use encryption in transit, access controls with multi-factor authentication, processor contracts with security obligations, and staff training on handling sensitive data. No system is perfectly secure; if a breach affects your rights, we will notify you and regulators as the law requires.

Our measures include TLS encryption in transit, encryption at rest, role-based access, multi-factor authentication on admin accounts and periodic access reviews.

Your rights

Depending on where you live, you can ask to access, correct, delete or port your data, object to or restrict processing, withdraw consent, opt out of sale, sharing or targeted advertising, and appeal our decision. We respond within one month under the GDPR and 45 days under US state laws, and never charge or discriminate against you for asking.

• How to ask: use our contact form and write "Privacy request" in your message, saying what you want us to do. The form currently asks for a name, an email address and a phone or WhatsApp number so that we can reply; you do not need to share any health details to make a request. US residents may use the same form as our web form for requests.
• Verification: we will ask for enough information to confirm your identity, usually by replying from the email address you used.
• Authorised agents: US residents may use an authorised agent with signed permission.
• Appeals (US): if we decline a request, you can appeal by replying to our decision; if you remain unhappy you can contact your state attorney general.
• Complaints (EU/UK): you can complain to your local data protection authority — in the UK, the Information Commissioner's Office (opens in new tab). We would appreciate the chance to resolve your concern first.

Children

This website is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us information, contact us and we will delete it. We do not collect information about children born through surrogacy unless a client provides it for a service they have requested.

Changes to this policy

We review this policy at least once a year and whenever the law or our practices change. The "last updated" date at the top shows the current version. If we make a material change to how we use health data, we will ask for your consent again before applying it to data we already hold.

Last updated: 2026-10-05. For questions, use our contact page. See also our terms of use.