Legal

Terms and privacy

Version 2026-09-01. These terms are published in English; the English text governs. Estos términos se publican en inglés y el texto en inglés es el que rige.

Terms of service

What we provide

Carme is software for running a surrogacy programme: enquiries, intended parents, surrogates, journeys, documents, messages, appointments and reporting, with separate portals for the families and surrogates your agency works with. You get an instance of it for your agency, with your own branding, and you decide who has access to it.

What it costs

Creating your instance is free, and there is no time limit on that. Staff accounts — coordinators, viewers, lawyers, administrators — are free and unlimited, always. Charging begins when you enrol your first family: US$45 per month for each active journey, where a journey is active from the day you enrol it until it completes or is cancelled. Everybody on that journey — both intended parents and the surrogate — is included in the one charge. We will tell you if a flat licence becomes cheaper for you than metered usage.

Your data

The records you put into the platform are yours. You are the data controller for them and we are your processor, acting on your instructions — the detail is in the privacy section below. You can export your data at any time, and we will provide it on request in a machine-readable form. We do not sell it, we do not use it to train models, and we do not use it to market to the people in it.

Your responsibilities

You are responsible for the accounts you create and for what your team does with them, for having a lawful basis for the personal data you upload, and for using the platform lawfully. The people whose records you hold — surrogates in particular — are entitled to the access the platform gives them; you should not use it to withhold from someone the record of their own medical care or payments.

If a payment fails

We will tell you, and your instance keeps working for fourteen days while you sort it out. After that your agency console becomes read-only until payment resumes. The portals stay open throughout. An intended parent or a surrogate never loses access to their own records because of a billing problem between us and your agency.

Ending it

You can stop at any time, from your billing settings; you are charged for the journeys active in the period you have started, and nothing after. On closure we make an export available and then apply the retention and deletion policy described below. We can suspend an account that is being used unlawfully, and we will say why.

Availability and liability

We work hard to keep the platform up and we publish what we do about security, but we do not offer a contractual uptime guarantee at this stage, and the platform is provided without warranties beyond those that cannot lawfully be excluded. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.

Changes, and the contract itself

We version these terms and record which version you accepted. If we change them materially we will tell you before the change takes effect. The contracting entity, the governing law and any agreed data-processing terms are set out in your order form or agreement with us; where that document and this page differ, that document governs.

Privacy

Who is who

For the personal data of the people in your programme — intended parents, surrogates, donors, their families — your agency is the controller and we are the processor. We process it to run the service for you and on your instructions. For the data of your own staff accounts, and for our billing records, we are the controller.

What is held

Contact and identity details, journey and case records, screening and medical information you choose to record, documents you upload, messages sent through the platform, appointments and travel, payment milestones and amounts, and an audit trail of who did what. The platform handles special-category data by design, which is why access is enforced in the database itself rather than only in the interface.

Where it lives, and who else touches it

The database, authentication and file storage are hosted with Supabase in Ireland (eu-west-1). The application runs on Vercel. A small number of other services are involved only when you use the feature that needs them — AI assistance, transactional email, electronic signature, illustrative donor portraits, and a one-way import from Monday if you migrate from it. Each of those can be switched off per agency, and the current list, with what each one receives, is published on our security page.

This website

On this public site — not inside the platform — we count page visits with Vercel Web Analytics, so we know which pages people read and which links brought them here. It sets no cookie and stores nothing on your device; Vercel counts a visit using a daily-rotating identifier that it discards, and we see only aggregate figures. Separately, if you accept our cookie banner we use a first-party cookie to measure our own outreach; if you decline, it never runs.

Rights, retention and breaches

Requests from a data subject come to you as the controller; the platform gives you the access, export and correction tools to answer them, and we will help where a request needs something only we can do. Records are retained while the relationship is live and then according to the retention policy — which is deliberately conservative for medical, financial and audit records, because they are the ones people need years later. If we become aware of a personal data breach affecting your data we will tell you without undue delay, with what we know and what we are doing about it.

Contact

For anything on this page, or to ask for an export, a deletion or the current sub-processor list, write to us and we will answer. If you have a signed data-processing agreement with us, its terms apply in addition to this notice.