SurgiCrew Privacy Notice

1. Controller and scope

This notice covers the web and mobile SurgiCrew application. An organization may be a separate controller for its content. Instructions, access and processing roles must be agreed with that organization before institutional deployment; creating a workspace is not itself a data-processing agreement.

Provider contact telephone: +48 737 529 933.

The controller for SurgiCrew account, security and support data is Praktyka pielęgniarska Dominik Kozłowski, tax number (NIP) 9710716971. Contact: contact@loginesis.com. Loginesis Digital is the provider’s brand. Full address details are available in the linked legal PDF.

2. Data, purposes and legal bases

Account information, email, profile name, profession, settings, membership, permissions and actions necessary for an account are used to perform the agreement and take steps at your request before it — GDPR Article 6(1)(b). Providing required account information is voluntary but necessary to create an account; optional materials are not required simply to register.

Session data, request limits and security events protect accounts, prevent abuse and establish or defend claims — GDPR Article 6(1)(f). You may object on grounds relating to your particular situation.

Contract-related complaints are handled to perform the agreement; statutory complaint and data-rights obligations rely on GDPR Article 6(1)(c) together with the applicable provisions. Reading this notice is not consent to every processing activity.

Team content includes organizational procedures, catalogs, checklists, messages, daily plans and uploaded photos. Patient data and unnecessary information about other people are prohibited.

The terms acceptance record contains the account identifier, document version and exact text, language and acceptance time. It supports performance of the agreement and evidence of its terms; it is not advertising consent. This mechanism does not record an IP address or device fingerprint. Records are available in the data export and are deleted with the account.

Terms-copy delivery records the verified recipient address, version, attempts, status and provider message identifier. These records are included in export and deleted with the account. Provider acceptance does not confirm inbox delivery.

3. Sign-in and email

When you choose Google or Apple sign-in we receive a provider identifier, email and available profile information; Apple may provide a relay address. We do not receive your Google or Apple password. SurgiCrew passwords and one-time tokens are stored as hashes, not plaintext passwords.

Resend delivers transactional email such as verification, recovery and invitations. It receives the recipient address, message content and information needed for delivery. Account messages do not constitute consent to marketing.

Google and Apple separately control their own account and authentication services. Their notices describe responsible entities, transfers and rights: https://policies.google.com/privacy and https://www.apple.com/legal/privacy/. Selecting sign-in does not send them workspace content.

For ordinary API sending, Resend does not send messages to Anthropic. Resend may analyze a small sample on dedicated RunPod infrastructure for abuse prevention; the provider states that content is not used to train or fine-tune models. We do not use Resend’s AI editor or support assistant to share user content. Details: https://resend.com/security.

4. Providers, recipients and sharing

Cloudflare provides Workers hosting, the D1 database and private R2 photo storage, and Workers AI when you choose AI. Google and Apple participate in sign-in chosen by the user. Resend handles email. Providers may process technical data necessary for their services and security.

Workspace materials are visible to authorized members. Workspace administrators manage membership and roles. Exported or deliberately shared materials may be outside SurgiCrew’s control. We disclose data to competent authorities where legally required.

Cloudflare, Inc. (USA) processes data under the DPA incorporated into its Self-Serve terms. The DPA provides Standard Contractual Clauses for transfers under GDPR Article 46. Our D1 database has EU jurisdiction; this does not restrict all Cloudflare services, including AI and support access, to the EEA. DPA and subprocessors: https://www.cloudflare.com/cloudflare-customer-dpa/ and https://www.cloudflare.com/gdpr/subprocessors/. Contact contact@loginesis.com for a copy of safeguards.

Email is handled by Plus Five Five, Inc. (Resend), USA. Message and log data is stored in the USA; the European sending region does not change storage location. Resend’s DPA incorporates Standard Contractual Clauses for transfers. To obtain a copy of safeguards, contact contact@loginesis.com; DPA: https://resend.com/legal/dpa.

Cloudflare, Inc. and Plus Five Five, Inc. (Resend) participate in the EU–US Data Privacy Framework for data covered by their active listings. Such transfers to the US may rely on the European Commission’s adequacy decision. Onward transfers remain subject to provider obligations; this does not mean EU-only storage. Current participation scope can be checked at https://www.dataprivacyframework.gov/list.

Correspondence to contact@loginesis.com is forwarded by Cloudflare Email Routing to an ordinary Gmail mailbox. This is separate from Google sign-in and Resend transactional mail. Standard Google terms and its Privacy Policy apply; we do not claim a Google Workspace agreement. Do not send patient data or passwords in correspondence.

5. AI and photos

After a separate confirmation, selected text or an image is sent to Cloudflare Workers AI. Results are drafts requiring review. SurgiCrew code does not save analysis input to the database or photo store; this is not a promise of zero retention across the provider’s systems.

Do not send patient data. Removing image metadata does not remove names, numbers or medical information visible in the image. Analysis is optional; you can enter permitted data manually.

AI limit counters include an account identifier and period. Code removes old periods during later analyses; this is not an independent daily cleanup schedule. Catalog photos stay in private workspace storage until the photo or workspace is deleted.

6. Retention and erasure

Account data is retained while the service is provided. Account deletion invalidates sessions and deletes private records. Shared content may remain with the author link removed; avoid personal data within content that would require separate content-level erasure. Removing the author link does not itself anonymize content. If content still identifies you, you may request a separate erasure review; we assess the applicable legal basis and any statutory exception, not merely other team members’ interests.

Erasure requests are retained for 90 days after completion or rejection, and support cases for 365 days after closure. Open cases receive ongoing attention and review. Expired login tokens and expired or revoked sessions are removed by daily cleanup, so deletion may take until the next scheduled run.

Audit history is retained for 365 days after the event, and completed content reports for 365 days after review. After 365 days, we remove the identity of the person taking a moderation decision and the reason text; the technical hidden or removed marker remains so that prohibited content is not made visible again. Deleted-identity hashes are retained for 90 days to protect against reuse of former sign-in credentials. These records are pseudonymous, not anonymous.

Where a specific record remains necessary for a dispute or legal obligation, we document the reason for continued retention and require another review within at most 90 days. This does not extend retention of all data. Erasure requests are assessed separately, respecting individual rights and statutory exceptions.

The D1 database uses a seven-day recovery window. Backups are not used for ordinary access; following an incident, earlier erasures and restrictions must be reapplied before access resumes. Photos are deleted when their associated resource is deleted, according to its private or shared scope. AI attempt counters are cleaned after the current and two preceding calendar months.

Under Resend’s rules for our Free plan, email and log retention is 30 days, backups persist for 7 days, and remaining customer data is deleted within 90 days after service termination. Earlier removal of a specific message requires contacting the provider.

Ordinary contact correspondence and closed complaints are retained for 365 days after the case is closed. This is an operational period for handling and checking responses, not a universal statutory retention requirement. If a particular document is necessary for an existing dispute or a legal obligation, we retain only the necessary part, record the basis and applicable deadline, and review it at least every 90 days. Specific obligations, such as those applying to tax documents, are assessed separately and do not extend retention of every message. Mailbox correspondence is deleted by the operator, not by the application database cleanup job.

7. Rights and contact

You may request access and a copy, rectification, erasure, restriction and portability where provided by law, and object to processing based on legitimate interests. Consent may be withdrawn at any time without affecting prior lawful processing.

Export and account deletion are available in SurgiCrew settings. You may also email contact@loginesis.com regardless of account access or workspace ownership. Do not send passwords or ID scans; where reasonably necessary we will arrange proportionate identity verification.

We explain action taken without undue delay and no later than one month after receiving a request. Complex or numerous requests may require up to two additional months; we explain any extension within the first month. Refusals include reasons and available remedies. You may complain to the Polish President of UODO or the competent EU supervisory authority.

We do not make decisions about you with legal or similarly significant effects based solely on automated processing within GDPR Article 22.

8. Advertising and device storage

The SurgiCrew mobile app on Android and iOS may display ads supplied by Google AdMob. The Google Mobile Ads SDK may automatically collect and share with Google IP address (including to estimate general location), app and ad interactions, diagnostic and performance data, and device or account identifiers. These data may be used to deliver and measure ads, analytics and fraud prevention; the scope depends on platform, SDK settings and user choices. See Google’s Privacy Policy: https://policies.google.com/privacy .

Before requesting an ad, the app checks consent through Google User Messaging Platform (UMP). Depending on message settings, region and user choice, Google may select the applicable ad mode. You can manage advertising privacy settings in the app through “Ad privacy”. SurgiCrew does not send workspace content such as procedures, checklists, messages or member data to the advertising provider. The public information website and browser version do not have AdSense configured.

Session storage and selected settings support account operation. Declining or changing advertising choices does not remove access to the core service.

Subscriptions and Premium purchase data

For Premium we process the link between a SurgiCrew account and a random account identifier sent to Apple or Google, product and transaction identifiers, status, expiry and renewal information, and evidence of an express request to begin performance. Performing the contract is the basis under GDPR Article 6(1)(b); preventing purchase reassignment and abuse relies on legitimate interest under (f). Mandatory accounting documents are processed only under a specific legal obligation under (c). We do not receive your payment card number or the bank account used to pay.

Apple and Google operate payments and store accounts under their own terms and privacy notices; Cloudflare operates the backend and private verification records. We send the store a product identifier and pseudonymous account binding, not procedures, profession, workplace, chats or patient information. Google Play purchase tokens are encrypted server-side and API keys never enter the client. Verification uses Apple/Google APIs directly without an additional subscription intermediary.

Records needed for active access are kept while the service is provided. Account deletion removes its store binding and encrypted token. A minimal purchase marker, no longer linked to the app account, remains for 90 days to reduce reassignment and handle delayed events, then is deleted by the server job; the identifier may still be pseudonymous personal data, not anonymous. Tax records or documents necessary for a specific dispute follow a separately documented applicable period; accounting duties do not justify retaining the entire account history. Deleting the SurgiCrew account does not delete the independent store account or documents retained by that store.