Herasight Privacy and Cookies Policy
Effective and last updated: September 10, 2026
This policy explains how Herasight, Inc. ("Herasight," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our public website, submit a website form, request a report or resource, schedule a call, or otherwise contact us through a website channel.
Separate notices may apply to clinical services, patient or provider portals, research, employment after the website application stage, or other services outside this public website. If a separate notice applies, it controls for that service.
Who is responsible for your information
Herasight, Inc. is the controller of personal information covered by this policy.
Herasight, Inc.1007 N Orange St.
4th Floor, Suite 2398
Wilmington, Delaware 19801
United States
Privacy questions and rights requests: privacy@herasight.com. Formal EEA or UK regulatory matters: dpo@herasight.com.
Information we collect
Information you provide
Depending on how you use the website, you may provide:
- Contact information, such as your name, email address, phone number, location, organization, or professional profile.
- Consultation or inquiry details, including timing, clinic status, clinic or doctor name, referral source, inquiry type, and a message you choose to send.
- Newsletter, content-request, career-interest, and other form information.
- IVF pathway calculator inputs and report state when you ask us to generate and deliver a personalized report.
- Scheduling information you provide directly to our scheduling provider and information you choose to provide during a phone call.
Please do not submit medical records, genetic test results, embryo reports, or other sensitive medical documents through general website forms or by phone.
Information collected automatically
Our website and service providers may collect:
- Network and device information, including IP address, browser type, device information, request time, and security signals.
- The page or landing path you use, referrer origin, and bounded campaign source, medium, campaign, and campaign ID associated with a request.
- Cookie and consent choices, including Global Privacy Control (GPC) or Do Not Track (DNT) signals.
- Site usage information when allowed under the regional cookie choices below. Search-term, ad creative, and advertising click identifiers are included or persisted only when Marketing is allowed.
When Marketing is off, campaign and referrer values remain in page memory and are not persisted across a reload. A necessary session landing path may be retained for the current visit and attached to a request you submit.
Consumer Health Data Privacy Notice
Some information handled through this website may be considered consumer health data under applicable law. This section explains our practices for that information.
Categories and sources
Consumer health data may include:
- Fertility, IVF, clinic, treatment-timing, or reproductive-health interests you disclose in a form or communication.
- IVF pathway calculator inputs, modeled results, and report state when you request a personalized report.
- Scheduling or call context associated with a consultation you request.
- Inferences about fertility or reproductive-health interests that may arise from visiting a particular page or interacting with its content.
We collect this information directly from you, from your interaction with the website, and from service providers involved in a request you make, such as scheduling, report delivery, or phone services.
Why we collect and use it
We use consumer health data to:
- Respond to an inquiry or consultation request.
- Generate and deliver a report or resource you request.
- Offer and administer scheduling or a phone conversation.
- Maintain security, prevent abuse, document consent, and comply with law.
- Measure or advertise the website under the regional cookie choices described below.
Categories of recipients
Depending on the service you request and your consent choices, we may share relevant categories of consumer health data with:
- Website hosting, security, CRM, communications, report-generation, and delivery providers that help us fulfill your request.
- Cal.com for scheduling and CallRail for phone routing, recording, transcription, attribution, and Voice Assist when those services are used.
- Cookiebot for choice management and Matomo Cloud for permitted website statistics.
- Google Ads, Microsoft Advertising, Meta, Reddit, and X for advertising on approved pages under the regional cookie choices below.
We do not currently share public-website consumer health data with a separate Herasight corporate affiliate. We do not exchange consumer health data for direct payment. Depending on the law, use of advertising technologies may be considered a sale, sharing, or targeted advertising. You can opt out through cookie settings, GPC, DNT, or a request to our Privacy Office.
Herasight does not place form fields, contact details, calculator or report data, clinic details, or explicit reproductive-health attributes into advertising event payloads. Advertising vendors may still receive the approved page URL, referrer, IP address, device information, cookies, and click identifiers through normal browser requests when Marketing is allowed under the regional cookie choices below.
Your consumer health data rights
Subject to applicable law, you may ask whether we collect, share, or sell consumer health data about you; access that data and a list of recipients; withdraw consent from future collection or sharing; or request deletion. You may also appeal a refusal by replying to our decision. Submit a request to privacy@herasight.com. We will not unlawfully discriminate against you for exercising a privacy right.
How we use personal information
We use personal information to:
- Provide requested information, reports, resources, scheduling, and customer support.
- Record and route inquiries, maintain durable CRM receipts, prevent duplicates, and operate our relationship with you.
- Send a newsletter you explicitly request and manage unsubscribe choices.
- Review career interest and communicate about potential roles.
- Secure, maintain, troubleshoot, and improve the website and our services.
- Measure website use and approved marketing activity after the relevant consent.
- Comply with law, enforce our terms, protect rights and safety, and complete a corporate transaction.
Where law requires a legal basis, we rely as appropriate on your consent, steps taken at your request, performance of a contract, compliance with legal obligations, and legitimate interests such as security and responding to requests. Where information receives special protection, including health information, we also rely on an applicable condition that permits that processing.
Service providers and other disclosures
We disclose only the information reasonably needed for the relevant purpose. Our principal website recipient categories are:
| Recipient or category | Purpose and information |
|---|---|
| Hosting, security, and infrastructure providers | Operate and secure the website and process form requests, including ordinary network, device, request, and submitted data. |
| CRM, communications, and report-delivery providers | Record and route requests, communicate with you, and generate or deliver requested resources and reports. |
| Cal.com | Display availability and complete optional scheduling after an accepted request. The website does not prefill the embed with your contact information, form answers, calculator inputs, or report data. |
| CallRail | Route and attribute calls and, when disclosed in the call flow, record, transcribe, or use an AI receptionist to handle the information you choose to provide. |
| Cookiebot | Present consent controls and retain your consent choices, region, and consent record. |
| Matomo Cloud | Measure website use when Statistics is allowed using device, network, and usage information. |
| YouTube | Provide optional embedded media only after you request it and allow Preferences. |
| Google Ads, Microsoft Advertising, Meta, Reddit, and X | Measure and support approved advertising when Marketing is allowed on an allowlisted page using generic events and ordinary browser and advertising identifiers. |
We may also disclose information to professional advisers, regulators, law enforcement, courts, or transaction counterparties when reasonably necessary to comply with law, protect rights or safety, or complete a merger, financing, acquisition, reorganization, or sale of assets.
Cookies, analytics, media, and advertising
- Strictly necessary: security, consent records, form delivery, bounded request provenance, and scheduling or phone functionality you request.
- Preferences: optional media such as YouTube and related display preferences.
- Statistics: Matomo Cloud measurement.
- Marketing: approved advertising and attribution, including Google Ads, Microsoft Advertising, Meta, Reddit, X, and CallRail dynamic number insertion.
For visitors located in the United States outside Washington state, optional cookies and tracking are on by default unless you have opted out. In Washington, outside the United States, or when we cannot determine your country and US state, optional categories begin off and wait for your choice. Location is estimated from your IP address. Your saved choices take precedence over regional defaults. You can opt out or change categories through Cookie settings at any time. Turning off a category stops future vendor initialization and events and clears vendor state where supported. Events suppressed before consent are not replayed later.
A GPC or DNT signal disables Statistics, Preferences, and Marketing in this website runtime, even if an older choice allowed them. It does not cancel a newsletter you requested or prevent requested form, report, scheduling, or phone service.
Cookiebot retains a consent record for no more than 12 months and may re-prompt sooner after a material change. Matomo visitor and referral cookies are configured for 180 days and its session cookie for 30 minutes. Permitted marketing attribution is retained for up to 90 days.
Email communications
A newsletter signup is an explicit request for Herasight email updates and every marketing message includes an unsubscribe method. Other forms request a response or resource and do not make delivery depend on marketing eligibility. Cookie choices do not cancel an email subscription you directly requested, and a later form submission does not override a durable unsubscribe.
Retention
In addition to the cookie periods above, we retain personal information only for as long as reasonably necessary for the purpose described in this policy, including to provide a requested service, maintain consent and transaction records, resolve disputes, enforce agreements, and meet legal, regulatory, tax, accounting, security, and backup requirements. Retention varies by record type and service-provider contract. We may retain deidentified or aggregated information where it can no longer reasonably identify you.
Your privacy rights
Depending on where you live, you may have rights to know or access the personal information we process, correct it, delete it, restrict or object to processing, obtain a portable copy, withdraw consent, or opt out of targeted advertising, sale, or sharing. You may also have the right to appeal a decision and complain to your local regulator.
To exercise a right, email privacy@herasight.comand describe your request. You do not need to create an account. We may request information reasonably necessary to verify your identity or authority. An authorized agent may submit a request where permitted by law. If we deny a request, you may appeal by replying to the denial.
International transfers
Herasight is based in the United States, and our providers may process information in the United States and other countries. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses.
Security
We use administrative, technical, and organizational safeguards designed to protect personal information. No transmission or storage system can be guaranteed completely secure. Please use the designated clinical or secure channel when Herasight instructs you to provide sensitive records.
Children
This public website is directed to adults and is not intended for use by children under 16. We do not knowingly collect personal information from a child under 16 through the public website. If you believe a child submitted information, contact our Privacy Office.
Changes to this policy
We may update this policy when our practices, vendors, or legal requirements change. We will post the updated policy and revise the date above. Where required, we will provide additional notice or ask for consent before using information for a materially different purpose.
Contact us
For questions, rights requests, consent withdrawal, or appeals, email privacy@herasight.com or write to the Privacy Office at the address above. For formal EEA or UK regulatory matters, email dpo@herasight.com.