Legal

Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data SurgeryLab.AI collects, why, and your rights over it. It applies to the SurgeryLab.AI website and the accounts and course bookings made through it.

1. Who we are

SurgeryLab AI Ltd (“we”, “us”) is the data controller for the personal data described here. Registered address: [company registered address]. For any privacy question or request, contact us at admin@surgerylab.ai.

2. What we collect

Account details — your name, email address and password (passwords are stored securely hashed, never in plain text).
Profile details you provide — your role/profession, organisation, and optionally your specialty/area of interest and country.
Course bookings — which programmes you reserve and your payment status. We do not collect or store your card or bank details; payment is made by bank transfer directly to our account.
Communication preferences — whether you have opted in to marketing emails.
Limited technical data — standard information your browser sends (such as general log data) needed to run the site securely.

We ask only for what we need. We do not ask for health information or other special-category data at sign-up.

3. Why we use it, and our lawful basis

To create and run your account and bookings — basis: performance of a contract with you, and our legitimate interest in running the Academy.
To understand our audience and improve our programmes — basis: legitimate interests.
To send you marketing about courses and updates — basis: your consent, which you can withdraw at any time.
To meet legal and accounting obligations — basis: legal obligation.

4. How we store and protect it

Your data is held in our Supabase database (Supabase acts as our data processor), protected by access controls so that each member can only see their own data. Only authorised SurgeryLab.AI administrators can view the full records.

5. Who we share it with

We do not sell your data. We share it only with service providers who help us run the service (such as Supabase for hosting and our email provider), and where required by law. Some providers may process data outside the UK/EEA; where they do, appropriate safeguards are in place.

6. How long we keep it

We keep account and booking data for as long as you have an account and as needed for our legal and accounting obligations, after which it is deleted or anonymised. You can ask us to delete your account and data at any time.

7. Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict or object to how we use it;
receive a copy of your data in a portable format;
withdraw consent (e.g. to marketing) at any time.

To exercise any of these, email admin@surgerylab.ai. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

8. Cookies

We use only the cookies and similar storage needed to keep you logged in and to run the site. We do not use advertising cookies.

9. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised.