Legal
Terms and privacy
Version 2026-10-28. These terms are published in English; the English text governs. Estos términos se publican en inglés y el texto en inglés es el que rige.
Terms of service
What we provide
Carme is software for running a surrogacy programme: enquiries, intended parents, surrogates, journeys, documents, messages, appointments and reporting, with separate portals for the families and surrogates your agency works with. You get a workspace of your own for your agency, with your own branding, and you decide who has access to it.
What it costs
Creating your workspace is free, and there is no time limit on that. Staff accounts — coordinators, viewers, lawyers, administrators — are free and unlimited, always. Charging begins when you open your first family’s journey. On-demand is US$45 per active journey per month, with a minimum of US$150 a month while any journey is active (so up to three active journeys cost US$150). A journey is active from the day you open it until it reaches its final phase (post-birth and handover), completes, or is cancelled; billing for it stops then. A journey on hold remains active. Your first journey is charged the day it starts, for the rest of that month; after that there is one invoice a month, on the 1st, in advance for that month, and a journey started mid-month is charged only for the part of the month that is left. A journey that ends mid-month is billed to the end of that month; we do not issue part-month credits. Everybody on a journey — both intended parents and the surrogate — is included in the one charge. The alternative is a flat licence of US$1,800 a month for up to 60 active journeys, billed monthly; your billing page shows when it becomes cheaper for you than paying per journey, and we will point it out too.
Your data
The records you put into the platform are yours. You are the data controller for them and we are your processor, acting on your instructions — the detail is in the privacy section below. You can export your data at any time, and we will provide it on request in a machine-readable form. We do not sell it, we do not use it to train models, and we do not use it to market to the people in it.
Your responsibilities
You are responsible for the accounts you create and for what your team does with them, for having a lawful basis for the personal data you upload, and for using the platform lawfully. The people whose records you hold — surrogates in particular — are entitled to the access the platform gives them; you should not use it to withhold from someone the record of their own medical care or payments.
If a payment fails
We will tell you, and your workspace keeps working for fourteen days while you sort it out. After that your agency console becomes read-only until payment resumes. The portals stay open throughout. An intended parent or a surrogate never loses access to their own records because of a billing problem between us and your agency.
Ending it
You can stop at any time, from your billing settings; you are charged for the journeys active in the period you have started, and nothing after. On closure we make an export available and then apply the retention and deletion policy described below. We can suspend an account that is being used unlawfully, and we will say why.
Availability and liability
We work hard to keep the platform up and we publish what we do about security, but we do not offer a contractual uptime guarantee at this stage, and the platform is provided without warranties beyond those that cannot lawfully be excluded. Nothing here limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
Changes, and the contract itself
We version these terms and record which version you accepted. If we change them materially we will tell you before the change takes effect. How we process your agency’s data is set out in our data processing agreement, which forms part of these terms. Where an order or agreement you have signed with us differs from this page, that document governs.
Privacy
Who is who
For the personal data of the people in your programme — intended parents, surrogates, donors, their families — your agency is the controller and we are the processor. We process it to run the service for you and on your instructions. For the data of your own staff accounts, and for our billing records, we are the controller.
What is held
Contact and identity details, journey and case records, screening and medical information you choose to record, documents you upload, messages sent through the platform, appointments and travel, payment milestones and amounts, and an audit trail of who did what. The platform handles special-category data by design, which is why access is enforced in the database itself rather than only in the interface.
Where it lives, and who else touches it
The database, authentication and file storage are hosted with Supabase in Ireland (eu-west-1). The application runs on Vercel, in the same region. Email is always sent through Resend, and the bot check on the sign-in page runs on Cloudflare. AI assistance, electronic signature, illustrative donor portraits and a one-way import from Monday (if you migrate from it) are used only if you switch them on, and each can be switched off again. The full list, with what each service receives and where, is in Annex 3 of our data processing agreement.
This website
On this public site — not inside the platform — we count page visits with Vercel Web Analytics, so we know which pages people read and which links brought them here. It sets no cookie and stores nothing on your device; Vercel counts a visit using a daily-rotating identifier that it discards, and we see only aggregate figures. Separately, if you accept our cookie banner we use a first-party cookie to measure our own outreach; if you decline, it never runs.
Rights, retention and breaches
Requests from a data subject come to you as the controller; the platform gives you the access, export and correction tools to answer them, and we will help where a request needs something only we can do. Records are retained while the relationship is live and then according to the retention policy — which is deliberately conservative for medical, financial and audit records, because they are the ones people need years later. If we become aware of a personal data breach affecting your data we will tell you without undue delay, with what we know and what we are doing about it.
Contact
Carme's business address is Office 1503, 60 Tottenham Court Road, Fitzrovia, London W1T 2EW, United Kingdom. Post sent there reaches us.
For anything on this page, or to ask for an export, a deletion or the current sub-processor list, write to privacy@carmesrm.com and we will answer. To report a security problem, write to security@carmesrm.com; for anything else, hello@carmesrm.com. Our data processing agreement applies in addition to this notice, and our information security and privacy policy sets out how we protect the data.
If you are an intended parent, a surrogate or a donor, please contact your agency first: it holds your records and can act on your request straight away.
Security risk summary
We assess the risks to the data held in Carme at least once a year and whenever something material changes. This is a summary of the current assessment (October 2026): the main risks we have identified, how likely and how serious we judge each to be, what is in place against it, and what risk remains. It is given for information so that you can make your own assessment. It is not a warranty or a service commitment, and it does not change these terms or the data processing agreement.
| Risk | Likelihood | Impact | In place | What remains |
|---|---|---|---|---|
| Someone takes over a staff account (phishing, a reused password) | Medium | High | Two-step sign-in switched on for staff of a new agency (the agency admin can change it per role) and always required for platform administrators; passwords of at least 10 characters checked against common and known-breached passwords; a bot check on sign-in; disabling a user or resetting their two-step sign-in ends all their sessions. | Low to medium. Two-step sign-in is optional for families unless the agency requires it, and an agency can relax it for its staff. |
| One agency sees another agency’s data | Low | Very high | Separation enforced in the database itself (row-level security), not only in the interface; automated tests of the access rules; an internal review on 24 October 2026 tried cross-agency and cross-person access, and the gaps it found were fixed. | Low. |
| The wrong person inside an agency sees a record (for example, a surrogate seeing an intended parent’s documents) | Low to medium | High | Role-based access; visibility set document by document, and each conversation has fixed members; every change to records logged in the audit trail. | Low to medium. It depends partly on what each agency chooses to share. |
| Data is lost, or the platform is unavailable for a long time | Low | High | Daily backups by the database provider; a separate nightly, verified, encrypted backup with an offsite copy in the EU under a 30-day lock; instant rollback of releases. | Medium. A full restore from the offsite backup has not yet been rehearsed end to end, the platform runs in one region, and there is no contractual uptime guarantee. |
| Data is processed by service providers in the United States | Certain (email, bot check); only if switched on (AI, portraits, e-signature) | Medium | Every sub-processor named in the data processing agreement; transfers under the EU–US Data Privacy Framework or Standard Contractual Clauses; the optional services can be switched off per agency; data is not used to train models. | Low to medium. Transfers to the US carry a risk of access by public authorities that contracts can reduce but not remove. |
| Personal information leaves the platform in notification emails | Low | Medium | Notification emails carry no message content: no message text, notes, answers or questions. They say who wrote and ask the reader to sign in. They go only to the recipient’s own address. Names, journey references and document titles still appear. | Low. A notification still shows that a message or update exists, and who it is from. |
| Misuse of access by Carme’s own personnel | Low | Very high | Production access limited to named personnel; two-step sign-in on administrative accounts; Carme staff signing in to an agency’s account from inside Carme recorded in that agency’s audit log (direct database access is not); a duty of confidentiality. | Low to medium. As a small team we cannot separate duties as a larger company would. |
| A software change introduces a security flaw | Medium | High | Every change tested on a separate staging environment; automated type checks and tests, including tests of the access rules; a second review pass before release; any release can be rolled back. | Medium. No independent penetration test has yet been commissioned. |
| A sub-processor is compromised | Low | High | Established providers under written data protection terms; encryption at rest; each provider receives only the data its service needs; backups encrypted with keys the backup provider does not hold. | Low to medium. |
How we manage these risks, who is responsible and what we have not yet done are set out in our information security and privacy policy.