Trust Centre
Everything about how Surgibud handles your data, in one place. We hold professional records about real operations on real people, and designed it the way you'd want your own surgeon's logbook designed: minimal data, strong crypto, and a healthy distrust of everyone — including ourselves.
Built around the privacy law that actually governs your patients — not US-style HIPAA.
There is no field for a patient name, official patient number, or date of birth — anywhere. Cases are keyed by your own non-identifying codes like "WGN-001", and the terms of use require that nothing identifying is entered. The less identifying data a logbook holds, the less there is to leak.
PROM contact details (a first name and an email or phone number) are encrypted with AES-256-GCM at the application layer before they reach the database. The database holds only ciphertext. Surgibud staff cannot read them — and neither can anyone who steals the database.
Contact details are hard-deleted automatically the moment the last scheduled survey is sent, or instantly if the patient opts out. They exist only as long as they are useful to your patient.
Database-enforced row-level security means each surgeon can only ever read their own data. This is enforced by PostgreSQL itself, not just application code.
Sign-in uses one-time email codes — no password to reuse or breach. Add a passkey (WebAuthn) for phishing-resistant multi-factor authentication.
Compliance events are written to an append-only audit log. Database triggers reject any update or delete. What happened, happened.
All data is stored securely in Sydney, Australia — close to home for NZ and Australian clinicians, and governed by the NZ Privacy Act 2020, the Health Information Privacy Code 2020, and the Australian Privacy Principles.
Your logbook belongs to you. Export everything — cases, statistics, CPD — to PDF and structured data at any time, no questions asked. Delete any record, or your whole account, yourself. We earn your stay; we never trap it.
Surgibud is a private professional record, not a surveillance system. Your data is never shared with employers, hospitals, colleges, or regulators. Nothing leaves your logbook unless you export it or share a specific case.
No advertising cookies, no third-party analytics, no selling data — and content sent to AI features is never used to train models. The business model is the subscription. That is the whole business model.
| Transport | HTTPS everywhere, TLS 1.2+ enforced |
|---|---|
| Application | SvelteKit on Cloudflare with strict Content-Security-Policy headers and WAF rate limiting |
| Database | PostgreSQL on Supabase, stored securely in Sydney, Australia, row-level security on all tables |
| Patient contacts | AES-256-GCM application-layer encryption, ephemeral storage |
| Authentication | One-time email codes + optional WebAuthn passkeys, server-side token validation on every request |
| AI | Anthropic API, server-side only, rate-limited per user, zero retention for training |
| Email/SMS | Resend and Kudosity for transactional dispatch only |
| Retention | 10-year clinical record retention per NZ Health (Retention of Health Information) Regulations 1996, then automated purge |
Found a vulnerability? Please email [email protected] with details. We respond within 2 business days, fix confirmed issues promptly, and will happily credit you (or keep you anonymous — your call). Please don't test against accounts or data that aren't yours.
For the full legal detail, read the privacy policy and terms of service.
How we handle AI
AI features — form-filling from an op note, reflection enhancement — are entirely optional and switch off in one click. Don't want AI near your logbook? Turn it off completely: no extraction, no suggestions, nothing. Surgibud works beautifully either way.
Anything you do submit is processed by Anthropic's API on the server, never stored by us beyond a timestamp for rate-limiting, and never used to train models. And because Surgibud has no field for patient identifiers, there's nowhere for identifying data to land even if it slips into a pasted note — though we still advise removing identifiers before pasting.
A short, honest list of every service involved in running Surgibud — what they do, what they see, and where. No hidden fourth parties.
| Service | Role | What they see | Where |
|---|---|---|---|
| Supabase | Database & authentication | Your account and case data (as processor) | Sydney, Australia |
| Cloudflare | App delivery, WAF & bot protection | Request metadata, IP addresses — no health data stored | Global edge |
| Stripe | Payments | Your card details directly (we never see them) + billing status | Global |
| Anthropic | Optional AI features | Only content you submit; never stored by us, never used for training | US |
| Resend | Transactional & PROM survey email | Recipient email + message content, for delivery only | US |
| Kudosity | PROM survey SMS | Recipient phone + message content, for delivery only | Australia |
Full detail and policy links are in the privacy policy.
If something goes wrong
In the unlikely event of a privacy breach, we assess and contain it immediately and notify affected users and the relevant authorities — the NZ Office of the Privacy Commissioner and/or the Australian OAIC — without undue delay, consistent with the NZ Privacy Act 2020 and the Australian Notifiable Data Breaches scheme.
Because Surgibud holds no patient names, birth dates, or official identifiers, the realistic blast radius of any breach is deliberately tiny — the safest data is the data we never collect.
Suspect a breach or have a concern? Email [email protected].
3 months free for everyone, no credit card to sign up. Free beyond that for trainees, fellows, and low-income countries.