This is a launch scaffold. Have counsel review it before surgrate.com goes live.
Privacy policy
Who operates Surgrate
The operator named in the imprint decides why and how personal data is processed. Replace the placeholder name, address, and contact before launch.
Health data is special-category data
A review that describes a treatment can reveal health information. Under GDPR Article 9, Surgrate asks for a separate, explicit consent before publishing that review. You can export or delete your account. Deletion removes your identity and the written review. Numeric scores may remain without your name so the aggregate stays accurate.
What we store
Account data, reviews, consents, verification notes you type, moderation decisions, and technical logs needed to run the service and limit abuse. Profile photos are stored in the configured object store. We do not sell ranking placement.
Where data sits
Production is intended to run on EU infrastructure: Vercel functions in Frankfurt (fra1) and a managed Postgres database in an EU region such as Frankfurt. Object storage should use an EU bucket. See the README before you point a custom domain at the app.
Your rights
You can access, correct, export, and delete your account from the account page, and you can complain to a supervisory authority. Verification documents should not be uploaded until a retention schedule exists.