Privacy policy

1. Who we are

Surgical Recovery London Limited (“Surgical Recovery”, “we”, “us”) is a private healthcare service registered with the Care Quality Commission (CQC provider 1-11582445037) and incorporated in England and Wales (company number 11626393). Our registered office is in London, UK.

For data protection enquiries, contact our Data Protection Officer at hello@surgicalrecovery.com (marked “Data protection”).

2. The data we collect

We collect two categories of personal data.

Contact data

Name, email address, phone number, hospital, operation date, and any contextual information you choose to share when enquiring through our website, booking a call or speaking with our team. Referrers share their own contact details and their patient’s name, phone number, procedure, hospital and operation date.

Health data (special-category, GDPR Article 9)

If you become a patient of Surgical Recovery, we collect the clinical information necessary to deliver your pathway: medical history, current medication, surgical procedure, and clinical observations made by our team during consultations, check-ins and home visits.

3. Why we hold this data

We process your data on the following lawful bases:

• Performance of contract — to deliver the clinical pathway you have purchased.
• Legitimate interests — to respond to enquiries and referrals and operate our service.
• Provision of healthcare — for processing of health data under GDPR Article 9(2)(h).
• Consent — for marketing communications, which we will only send if you opt in explicitly, and for sharing your final report with your GP or a sponsor.

Our systems use automation and AI to sort, summarise and draft administrative messages. A clinician reviews anything clinical before it reaches you, and no clinical decision is made automatically.

4. Who we share data with

We share your data only with:

• Your surgeon and their secretary, where clinical care requires it.
• The hospital where your operation takes place, for continuity of care.
• Your GP, at the end of your episode, with your consent.
• A sponsor, where one arranges your care, only with your consent.
• Sub-processors who help us run the service (secure messaging, scheduling, form handling, payment processing and secure cloud hosting, which is provided by Netlify), bound by data-processing agreements. Payments are processed by our payment provider; we do not store your card details.
• Regulatory bodies (CQC, GMC, HCPC) where legally required.

We use WhatsApp to message you. WhatsApp is provided by Meta Platforms Ireland Limited, which carries those messages for us as a processor.

We do not sell your data to anyone, ever.

5. How long we keep it

Clinical records are retained for the period required by the NHS Records Management Code of Practice for healthcare providers (typically a minimum of 8 years after the episode closes for adult patients; longer for specific record categories). Contact and enquiry data is retained for 24 months unless you become a patient or opt in to ongoing communication.

6. Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate or incomplete data
• Request deletion (subject to clinical-record retention requirements)
• Restrict or object to processing
• Data portability
• Withdraw consent for processing that relies on it
• Complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we have handled your data

To exercise any of these rights, contact hello@surgicalrecovery.com. We will respond within one calendar month.

7. Cookies and analytics

This site uses Netlify Web Analytics, provided by Netlify, who host this website. It counts visits from server request logs rather than from your browser: it sets no cookies and stores nothing on your device, and it cannot follow you to other websites. To produce those counts Netlify processes your IP address and the pages you request, as our data processor under a data-processing agreement. This site sets no cookies of its own. Sign-up, referral and payment all happen on our platform at app.surgicalrecovery.com, which has its own privacy notice.

8. Security

We hold your data on secure infrastructure provided by reputable cloud vendors, encrypted in transit and at rest. Access to clinical data is restricted to staff who need it to deliver your care. All staff complete annual information-governance training.

9. Changes to this policy

We will update this policy as our service evolves. Material changes will be communicated to active patients by email at least 14 days before they take effect.

10. Contact

For any privacy or data-protection question, please email hello@surgicalrecovery.com or write to our registered office.