Carrot

Our Findings

• Invested meaningfully in privacy infrastructure.
• Named subprocessors with an RSS update feed, TLS 1.2/AES-256 encryption documented, annual third-party penetration testing, a HIPAA BAA executed with detailed compliance obligations, GDPR compliance with Standard Contractual Clauses, and a public warrant canary page.
• The main concerns are data minimization and control gaps: Carrot collects sensitive sexual orientation and fertility journey data well beyond what constitutes HIPAA-protected PHI; employers receive utilization reports containing identifiable member data; and individual members appear to have no MFA option.
• The platform also lacks top-tier security certifications expected at this scale and sensitivity.

Strengths

• TLS 1.2 in transit and AES-256 at rest documented in Trust Center
• Named subprocessor list with 9 vendors, locations, and services; RSS feed for updates
• HIPAA BAA executed (Oct 1, 2024) with detailed compliance obligations
• GDPR compliance with Standard Contractual Clauses and country-specific DPA schedules
• Annual third-party penetration testing and secure SDLC processes documented
• Washington State My Health My Data Act addendum published
• "Do Not Sell or Share My Personal Information" and "Limit Use of Sensitive Personal Information" controls available
• Public warrant canary page for FISA transparency
• Clean track record: no documented breaches, regulatory actions, or FTC complaints

Weaknesses

• Data collection scope exceeds minimization standard: sensitive sexual orientation and fertility journey data collected and retained, even though only infertility HRA reimbursement claims constitute HIPAA-protected PHI
• Employers receive Utilization Reports with identifiable member data elements, not just aggregated metrics
• Vague third-party tracking language: "joint tracking with third-party websites" not explained beyond the named subprocessor list
• No explicit denial of data broker relationships in privacy policy
• Account deletion and data export processes referenced in Privacy Policy but not detailed in Customer FAQ, creating friction for users exercising rights
• MFA appears limited to employer SAML SSO; no evidence individual members can enable MFA for their own accounts
• No SOC 2 Type II or ISO 27001 certification documented despite operating at scale with sensitive reproductive health data in 170+ countries

What We Couldn't Find

• SOC 2 Type II or ISO 27001 certification status
• Specific third-party websites and business partners receiving joint tracking data beyond the named subprocessor list
• Explicit account deletion process and timeline in Customer FAQ
• Data export format and process despite GDPR portability requirements
• Whether individual members can enable MFA beyond employer SAML SSO
• Breach notification timeline for non-HIPAA data
• Explicit confirmation that Carrot does not sell data to brokers

Our Findings

• Makes specific, quantified clinical outcome claims: a 55.4% IVF live birth rate, a 41% lower preterm birth rate, and a 63% lower multiple-birth rate — that are more precise than most femtech products would publish.
• The foundation for these claims is a company-generated 2024 IVF Outcomes Study, partially validated by Milliman for methodology consistency against SART benchmarks.
• That's meaningful, but Milliman explicitly did not validate competitor comparisons, no peer-reviewed publications exist, and methodology details, including sample sizes, population characteristics, and study design, are not publicly disclosed.
• Independent user reviews on Trustpilot raise concrete concerns about reimbursement failures and benefit misrepresentation. Outcome claims are presented without prominent disclaimers about selection bias or individual variability.

Strengths

• Published 2024 IVF Outcomes Study with Milliman actuarial validation confirming methodology is consistent with industry practices for benchmarking against SART national data
• Outcome metrics are specific and quantified rather than vague: 55.4% live birth rate, 41% preterm birth reduction, 63% lower multiple birth rate
• CMO Dr. Asima Ahmad is board-certified in reproductive endocrinology and infertility; academic training at Yale and UCSF; active ASRM Access to Care Special Interest Group Vice-Chair role
• Explicitly discloses that Carrot is not a HIPAA Covered Entity but acts as Business Associate for infertility HRAs — honest about the scope of its clinical role

Weaknesses

• No FDA clearance, approval, or 510(k) registration despite being classified as 'Medical' and making specific clinical outcome claims—represents a critical regulatory gap for a product marketed with clinical metrics
• Milliman validation limited in scope: per blog post, they 'did not review Carrot's methodology for assessing performance compared to competitors,' meaning comparative claims are not independently verified
• No peer-reviewed publications in medical journals (PubMed, Google Scholar searches yielded no results)—clinical validation relies entirely on company-generated study with partial external validation
• Study methodology details not publicly disclosed: sample sizes, population characteristics, study design (observational vs RCT), and other critical details unavailable for independent evaluation
• Trustpilot reviews show significant accuracy/reimbursement concerns: users report promised treatments were not reimbursed ('Fake benefit' 5/10/2025), and process described as 'black hole' with lack of understanding of IVF complexities
• Outcome claims presented without prominent disclaimers about population differences, selection bias, or individual variability—transparency about limitations is minimal
• Medical partnerships are primarily with technology/analytics providers (Oura, Dexcom, Milliman) rather than research collaborations with academic medical centers or hospitals
• No external advisory board with named clinical, research, or bioethics expertise publicly identified

What We Couldn't Find

• Peer-reviewed publications in medical journals
• Study methodology details: sample sizes, population characteristics, study design, statistical methods, confidence intervals
• External advisory board with named clinical, research, or bioethics experts
• Independent clinical outcome reviews or meta-analyses
• Academic institutional research collaborations beyond technology integrations
• Detailed disclaimers about outcome limitations, population differences, and individual variability in marketing materials

Our Findings

• Strongest foundation profile. Founded in 2016 by five co-founders out of Y Combinator: Tammy Sun (CEO), Dr. Asima Ahmad (CMO), Arun Venkatesan (Design), Juli Insinger (Growth), and Maxwell Radomsky (Engineering). Sun brings White House and FCC-level healthcare leadership experience and personal lived experience with premature ovarian failure; Dr. Ahmad is triple board-certified in reproductive endocrinology, OB/GYN, and infertility with training at Pritzker, Harvard, Yale, and UCSF, published research, and an active ASRM governance role. The mission is specific, actionable, and consistently communicated across every public touchpoint. Marketing genuinely reflects stated values, with explicit LGBTQ+ support, faith-inclusive offerings, diverse family-building path coverage, and 25+ language support. The one meaningful governance gap is the absence of a publicly documented external advisory board — notable for a global platform making specific clinical outcome claims.

Strengths

• Five co-founders bringing complementary expertise across medicine, design, engineering, growth, and operations
• Founded through Y Combinator (S17 batch)
• Tammy Sun: White House and FCC-level healthcare leadership background, extensive mainstream media presence, and personal lived experience with premature ovarian failure — the company's founding mission is personally grounded and consistently told
• Dr. Asima Ahmad: triple board-certified in reproductive endocrinology, OB/GYN, and infertility; MD/MPH from Pritzker/Harvard; residency at Yale; fellowship at UCSF; published research; Vice-Chair of ASRM Access to Care Special Interest Group — an active governance role in reproductive medicine policy, not an honorary title
• Mission is specific, actionable, and explicitly inclusive: "for everyone, everywhere" with named dimensions of age, race, income, sexual orientation, gender, faith, marital status, and geography
• Active thought leadership: CEO and CMO regularly speak at ASRM, British Fertility Society, and Fortune conferences; publish in CNN, NPR, and Fortune on fertility equity and reproductive health
• Marketing strongly reflects stated values: explicit LGBTQ+ employer guides, support for surrogacy, adoption, egg freezing, and men's health on equal footing; faith-inclusive offerings; 25+ language support
• No public controversies, red flags, or reputational concerns identified across any named leadership

Weaknesses

• No external advisory board publicly documented: Carrot does not disclose any named external advisors with backgrounds in women's health, clinical research, bioethics, or regulatory affairs, meaningful governance gap for a global platform making specific clinical outcome claims
• Two of the five original co-founders (Venkatesan and Insinger) are listed as former co-founders, suggesting early team attrition not addressed publicly
• Limited formal clinical research infrastructure: Milliman validated benchmarking methodology but is an actuarial firm, not a clinical research body; no peer-reviewed publications or academic institutional research partnerships documented

What We Couldn't Find

• External advisory board with named members and credentials — searched About/Team page, blog, and external sources; none publicly documented
• Formal clinical research partnerships with academic medical centers, research institutions, or hospitals
• Current roles or reasons for departure of former co-founders Venkatesan and Insinger
• WCAG accessibility compliance statement — App Store listing indicates developer has not documented which accessibility features the app supports

Our Findings

• Equity commitment is genuine in language and policy but inconsistent in implementation.
• The multilingual infrastructure is genuinely impressive (25+ languages on the platform, 300+ for live support, 50+ currencies) and the explicit inclusion of LGBTQ+ individuals, single people, and all family-building paths is structural, not decorative.
• But critical gaps undermine the mission's promise of income inclusion: the platform is entirely employer-gated, with no direct consumer pathway, no Medicaid option, and no sliding scale, meaning the people who most need fertility access are structurally excluded.
• Accessibility compliance is undocumented, visual diversity in marketing cannot be verified, and there are no community health partnerships or user diversity research, despite operating in 170+ countries.

Strengths

• Comprehensive multilingual support: 25+ languages on the platform, 300+ languages for live customer support, 50+ currency options
• Explicit diversity commitment across named dimensions: age, race, income, sex, sexual orientation, gender, faith, marital status, and geography
• LGBTQ+-inclusive design: published employer guide, LGBTQ+ worker survey conducted, app supports diverse family-building paths including surrogacy, adoption, and assisted reproduction for all family structures
• Personalized care plans explicitly designed for diverse journeys including male fertility, hormonal health, and metabolic fertility
• HRA mechanism and health plan integrations with SAG-AFTRA and Cigna provide some economic accessibility through employer-sponsored and health plan channels
• Carrot Card available in 50+ currencies, reducing payment friction for international members

Weaknesses

• Entirely employer-gated model: no direct consumer pathway, no Medicaid option, no sliding scale, and no low-income assistance — structurally excludes the workers who most need fertility access despite the mission explicitly naming income as a dimension of inclusion
• Accessibility compliance gap: Apple App Store states "developer has not yet indicated which accessibility features this app supports"; no WCAG compliance documentation or screen reader support confirmed
• Visual diversity in marketing cannot be verified from available sources despite strong inclusivity language
• No documented community health organization partnerships or underserved population outreach programs despite operating in 170+ countries
• No published user research or studies demonstrating product efficacy across diverse body types, ages, health statuses, or socioeconomic backgrounds
• No plain language assessment or health literacy documentation for patient-facing materials

What We Couldn't Find

• WCAG 2.1 Level A/AA compliance statements or accessibility audit results
• Screen reader and assistive technology support documentation (VoiceOver, TalkBack)
• Visual diversity audit of website, app, and marketing materials
• Sliding scale pricing, income-based financial assistance, or uninsured patient support programs
• Community health organization partnerships or health equity program documentation
• Published user research demonstrating efficacy across diverse demographic groups
• Plain language or health literacy verification for patient-facing materials
• Documentation of how 300+ language support accounts for regional accessibility standards (EN 301 549, AODA)