Privacy Notice & Terms of Use

1. Data Controller and Processor

Under UK/EU GDPR, responsibility for patient personal data is allocated as follows:

• Data Controller: The clinic where you have booked or completed your consultation determines the purposes and means of processing your clinical data and is the data controller. Controller identity is confirmed at the time of your consultation and referenced on your consent record.
• Data Processor: SurgiCheck is operated by Ocean Health & Travel Ltd (Company No. 16186647, registered in England & Wales), registered office: 17 Green Lanes, London, England, N16 9BS. Ocean Health & Travel Ltd provides the platform and processes patient data solely on the documented instructions of the clinic, under a written data processing agreement. Contact: privacy@surgicheck.net.
• Sub-processor: Google Ireland Ltd (Firebase / Google Cloud) provides hosting infrastructure as a sub-processor. Data centre region: Europe (eur3).

Where SurgiCheck determines the purposes of processing (e.g. platform security, product development on aggregated non-identifiable data), it acts as an independent controller for those limited operations.

2. Platform Purpose and Scope

SurgiCheck is a perioperative risk screening and workflow management platform for aesthetic and plastic surgery clinics. The platform covers patient pre-assessment forms, clinician decision support, digital informed consent documentation, and post-operative follow-up modules.

SurgiCheck operates as a Clinical Decision Support System (CDSS). It does not generate autonomous surgical decisions; final clinical responsibility rests entirely with the treating clinician.

3. Personal Data Processed

The platform processes the following personal and special category data:

• Full name, telephone, email, date of birth, country
• Medical history (conditions, medications, lifestyle factors) — special category health data
• Physical measurements (height, weight, BMI)
• Pre-operative and post-operative photographs — special category health data
• Digital signature data

4. Lawful Basis for Processing (UK GDPR / EU GDPR)

Processing is justified under two required layers: an Article 6 basis for general lawfulness, and an Article 9 condition for special category (health) data.

Article 6 — lawfulness of processing:

• Art. 6(1)(b): Performance of the pre-assessment service requested by the patient.
• Art. 6(1)(f): Legitimate interests — clinical safety, record integrity, and documentation obligations.

Article 9 — condition for special category (health) data:

• Art. 9(2)(h): Medical purposes — preventive medicine, medical assessment, and provision of health care, carried out by or under the responsibility of a health professional subject to a duty of confidentiality.
• Art. 9(2)(a) — explicit consent: Obtained via the patient declaration at intake, as an additional basis for the digital record.

Patients may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand, nor processing that continues to be required under Art. 9(2)(h) or under records-retention law. Contact: privacy@surgicheck.net

5. Data Storage and Security

All data is stored on Firebase (Google Cloud) infrastructure. Data centre region: Europe (eur3).

Medical records (cases, consents, follow-up responses) are preserved as an append-only audit trail: the original entry is never overwritten. Corrections are recorded as new, timestamped versions alongside the original, preserving both accuracy and audit integrity. Deletion (where legally required or requested) can only be performed by an administrator via Firebase Console, in accordance with applicable data retention obligations.

Retention periods are determined according to record type, clinic policy, contractual requirements, and applicable national law governing medical records.

6. Data Sharing

Patient data is not shared with third parties for commercial purposes. Data may be accessed or transferred only in the following circumstances:

• Treating clinician and authorised clinic staff (role-gated access)
• Competent public authorities where required by law
• Google Ireland Ltd (Firebase / Google Cloud) as infrastructure sub-processor

7. Your Rights (UK GDPR / EU GDPR Art. 15–22)

You have the following rights, exercisable against the data controller (see Section 1):

• Right to be informed about processing of your data
• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to restriction of processing
• Right to data portability
• Right to lodge a complaint with the supervisory authority — the ICO (UK): ico.org.uk, or your national data protection authority (EU)

To exercise your rights: privacy@surgicheck.net (requests are routed to the responsible controller).

8. Terms of Use

By using the SurgiCheck platform, you agree to the following:

• Patients should provide information that is complete and accurate to the best of their knowledge.
• All patient-reported information must be reviewed and verified by the treating clinical team before any clinical decision is made.
• Platform outputs are produced solely for clinician decision support and do not constitute medical advice.
• Unauthorised reproduction or commercial use of platform content is prohibited.

9. Contact

For privacy and data processing requests: privacy@surgicheck.net

General enquiries: surgicheck.net