1. Who We Are
SurgAtlas is operated by Dr. Ali Heidari, who is the data controller for personal data collected through the Platform. Contact: aliheydari92@gmail.com
2. What Data We Collect
Depending on how you use SurgAtlas, we may collect: email address and account identifiers; full name; optional exam date and study preferences; chapter, retrieval, quiz, and performance activity; technical and security logs; and device or browser information used to operate, secure, and improve the Platform.
If your account or plan includes AI features and you choose to use them, we may also process AI prompts, transcripts, conversation history, assessment outputs, and the limited study or case context needed to provide that feature.
We do not collect payment-card details directly. Where paid plans are offered, card processing is handled by the configured payment provider.
3. How We Use Your Data
We use personal data to provide and secure the SurgAtlas service; maintain accounts and learning progress; generate personalised revision and performance information; deliver AI features where your plan includes them; send service communications; send optional communications where permitted; diagnose technical problems; understand proportionate service usage; improve the Platform; and comply with legal obligations. We do not sell personal data to advertisers or use SurgAtlas to serve behavioural advertising.
4. Legal Basis for Processing (UK GDPR)
Depending on the processing activity, we rely on contract where processing is necessary to provide the service you request; legitimate interests for activities such as service security, fraud prevention, and proportionate product analytics; consent where consent is the appropriate basis, such as certain optional communications; and legal obligation where processing is required by law.
5. Data Sharing and Service Providers
We share personal data only where necessary to operate SurgAtlas or where the law otherwise permits or requires it. Service providers may include Supabase for database hosting and authentication, Vercel for application hosting, Resend for email delivery, and Cloudflare for configured service analytics and security telemetry.
When you use an AI feature, the prompt or transcript and relevant context needed for that request may be sent to the AI provider configured for that feature, which may include OpenAI and/or Anthropic. If paid subscriptions are introduced, the configured payment provider will process the payment information needed to provide that subscription.
6. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including account operation, learning history, security, legal, accounting, and dispute-resolution requirements. The period therefore depends on the type of information and why it is needed. Account-deletion requests are handled in accordance with the Platform's deletion process and applicable law. Anonymised aggregate data that no longer identifies an individual may be retained for product analysis.
7. Your Rights
Depending on applicable law, your rights may include access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent where processing is based on consent. To exercise a right, contact us at aliheydari92@gmail.com. Where UK data-protection law applies, we respond to rights requests without undue delay and normally within one month, subject to any lawful extension or other applicable rule. You may also have the right to complain to the Information Commissioner's Office at ico.org.uk.
8. Cookies and Similar Technologies
SurgAtlas uses technologies that are necessary to operate authentication and remember user preferences. We may also use proportionate service analytics where configured. We do not use the Platform to sell personal data or serve behavioural advertising.
9. International Transfers
Some service providers may process personal data outside the UK. Where a transfer is subject to UK international-transfer rules, SurgAtlas will use an applicable lawful transfer mechanism, such as UK adequacy regulations, appropriate safeguards, or another permitted mechanism where the legal requirements for that mechanism are met.
10. Children's Privacy
SurgAtlas is intended for medical professionals and adult medical learners. We do not knowingly collect personal data from children. If you believe a child has registered contrary to the Platform's eligibility requirements, please contact us.
11. Changes to This Policy
We may update this Privacy Policy when the Platform, our providers, or legal requirements change. We will bring material new uses of personal data to users' attention where required. The current version and last-updated date are shown on the Privacy Policy page.
12. Contact
Dr. Ali Heidari · SurgAtlas
aliheydari92@gmail.com