Privacy policy

This policy covers two things that are worth separating.

Data about you as a customer — the account holder and users of a workspace. We are the controller of that data and this policy describes how we handle it.

Data your facility puts into the service — items, vendors, stock, purchase orders, cases and chart references. Your facility controls that; we process it on your instruction. Where it includes protected health information, a business associate agreement governs it.

• Account — your name, work email address, a hash of your password, and which facility workspaces you belong to.
• Facility — name, address, phone and fax, used on your purchase orders and reports.
• Billing — handled by Stripe. We store a customer identifier, the subscription status and the renewal date. We never see or store your card number.
• Sign-in records — the time of your last sign-in, the IP address and browser of a session, and failed attempts. Used for security and to end sessions when someone leaves.
• Support — what you send us when you get in touch.

• We do not sell or rent your data to anybody.
• We do not use your data — clinical or otherwise — to train machine-learning models.
• We do not run third-party advertising or analytics trackers on the application. There is no advertising network embedded in a page your staff use during a case.
• We do not add you to a marketing list because you started a trial. We email you about your account, your subscription and things you asked about.

We process this data to perform our contract with you, to meet legal and tax obligations, and for our legitimate interest in keeping the service secure and working. Where consent is the appropriate basis we ask for it and you can withdraw it.

We use a small number of providers to run the service. They process data on our instruction, under contract, and cannot use it for their own purposes. The current list — hosting, payments and email — is on the subprocessors page, and we update it before adding a new one.

We may disclose data if the law requires it. Where we are permitted to tell you first, we will.

Data is held in the United States. Each facility’s clinical and inventory records live in a database provisioned for that facility alone, not in a shared table.

Your facility’s records are kept for as long as the workspace exists. When a subscription ends the workspace becomes read-only and we keep it for at least 12 months, so you do not lose traceability records because an invoice went unpaid. We will email before deleting it, and you can ask us to delete it sooner.

Account records are kept while you have an account. Billing records are kept for as long as tax law requires — normally seven years. Sign-in and audit records are kept for 12 months.

Traffic is protected by deployment controls that require HTTPS and encrypted storage, and the credentials for each facility database are separately encrypted before being stored. Passwords are hashed with scrypt and are not recoverable by us or by your administrator.

Access by our staff is limited to what is needed to operate the service or to investigate a problem you have raised, and is logged. The security page describes the measures in more detail.

If we determine that data in your workspace has been accessed without authorisation, we will notify you without undue delay.

The application sets one cookie: a session cookie that keeps you signed in. It is HTTP-only, restricted to our own site, and cleared when you sign out. It is strictly necessary for the service to function, so there is no consent banner asking you to accept something you have no realistic choice about.

We do not set advertising or cross-site tracking cookies.

You can ask us for a copy of the data we hold about you, to correct it, to delete it, or to restrict how we use it. Email support@surgi-sys.com and we will respond within 30 days.

For data your facility holds in Surgi-Sys — including any request from a patient — the facility is the right place to start. We will support them in answering you.

If we make a material change we will email the workspace owner before it takes effect. The date at the top of this page always reflects the current version.

Any question about this policy, or about data we hold: support@surgi-sys.com.