Data processing terms
Last updated 18 October 2026
These terms cover the personal data we process for a practice: the practice is the controller and we are its processor, as UK GDPR Article 28 requires. They form part of our terms of service.
1. The parties
SurgeryScreen is provided by SurgeryScreen (“we”, “us”).
You can contact us at [email protected].
“You” means the practice or organisation using SurgeryScreen, which is the controller of the personal data described below.
2. What we process
| Purpose | Showing your content on your waiting-room screens, relaying patient calls from your clinical system to those screens, and giving your staff sign-in access. |
| Personal data | Patient calls: surname, optionally Mr/Ms and day and month of birth, and room number. Staff: name and work email address. Anything personal in content you upload, such as staff photos. |
| People | Your patients, your staff, and anyone shown in your content. |
| Special care | A patient call can show that someone is attending the practice, which may be information about their health. We treat it with that in mind. |
| How long | Patient calls: deleted 15 minutes after the call (daily backups kept for 7 days may contain calls less than 15 minutes old when taken). Everything else: for as long as the agreement lasts, then deleted within 30 days. |
3. What we promise
- We process the data only on your instructions, which are these terms and how you set up and use SurgeryScreen, unless the law requires otherwise (we'll tell you if so, unless the law forbids it).
- Anyone who works on SurgeryScreen with access to the data is bound to keep it confidential.
- We protect it with the measures in section 4.
- We use only the sub-processors in section 5, and tell you at least 30 days before adding or replacing one, so you can object.
- We help you respond to people exercising their data protection rights, and with data protection impact assessments.
- We tell you without undue delay, and within 48 hours of becoming aware, if there's a personal data breach affecting your data, with the information you need to meet your own obligations.
- When the agreement ends we delete your data within 30 days, or return it first if you ask, unless the law requires us to keep it.
- We give you the information you reasonably need to show we meet these terms.
4. Security
- Hosted in a UK data centre (DigitalOcean, London).
- All traffic is encrypted, and the connection to the database is encrypted and verified.
- Staff sign in with individual accounts and one-time email codes; there are no shared passwords. Access is limited to the displays each person manages.
- Patient calls are only sent to screens that present that display's private screen key, and are deleted 15 minutes after the call.
- Call links carry the patient's details in the web address, so our SystmOne set-up opens them in private browsing, which keeps them out of browser history.
- Spoken announcements are generated on the screen's own device, so names aren't sent to a voice service.
- Daily database backups are kept for 7 days.
5. Sub-processors
| Company | What for | Where |
|---|---|---|
| DigitalOcean | Hosting, database and backups, including patient calls. Its network provider, Cloudflare, carries the traffic. | United Kingdom (London) |
| Cloudflare | Storage of uploaded pictures and the video library | Global network |
| Resend | Emailing staff sign-in codes and invitations (names and email addresses only) | United States and EU |
Where a sub-processor handles data outside the UK, it is protected by the safeguards UK data protection law requires.
6. Your part
You decide what to show and whether to call patients by name, and you're responsible for having a lawful basis for it and telling patients in your privacy notice. You keep your sign-in access and screen addresses to the people and screens that need them.