Privacy notice

Who we are

SurgeryScreen is provided by SurgeryScreen (“we”, “us”).

You can contact us at [email protected].

Our two roles

For enquiries made on this website, and for running sign-in accounts, we decide how the information is used: we are the controller.

For what a GP practice puts on its screens, and for the patient calls it sends to them, the practice is the controller and we act on its instructions as its processor. If you're a patient, please contact your practice about how it uses your information. Our data processing terms describe that arrangement.

What we collect, and why

When you ask about SurgeryScreen

The enquiry form asks for your name, role, practice, ODS code, email address, telephone number, how many screens you're thinking about and anything else you choose to tell us. We use it only to reply, talk through what you need and arrange a visit. Our lawful basis is legitimate interests (answering business enquiries) and taking steps at your request before a contract. Enquiries are deleted automatically two years after you send them.

When you have a sign-in account

Practice staff sign in with their work email address and a one-time code. We hold your email address, your name if one was given, which displays you can manage, who added you, and when you last signed in. Codes are stored only in scrambled form and are deleted within a day. A cookie keeps you signed in (see cookies). We use this to let you sign in, keep the service secure and send you messages about the service, such as sign-in codes and access you've been given. Our lawful basis is legitimate interests in providing a secure service to the practice. Your account is kept until you or your practice removes it, or the practice's contract ends.

When you visit the website

Like any website, our servers record technical details of each request (such as the network address and browser) for security and troubleshooting. Our hosting provider keeps these logs for a short period. We don't use analytics, advertising or tracking tools.

What practices put on their screens

Practices upload pictures and write messages for their screens. Anything personal in them (for example a staff photo) is processed for the practice, which is responsible for it.

Patient calls

When a clinician calls a patient, the practice's screen shows the patient's surname, and optionally Mr or Ms and their day and month of birth (never the year), with the room number. The practice chooses which of these to show. We keep a call only long enough to show it: it is deleted automatically 15 minutes after the call. Daily database backups, kept for 7 days in case of disaster, may contain calls that were less than 15 minutes old when the backup was taken. Spoken announcements are made on the screen's own device, so patients' names aren't sent to a voice service.

Who we share it with

These companies process information for us, under contract and only to provide the service:

Screens also fetch the weather and air quality from Open-Meteo, bank holidays from GOV.UK, practice figures from caip.app, and practice names from the NHS Organisation Data Service. None of these receive personal information.

Where a provider handles information outside the UK, it is protected by the safeguards UK data protection law requires, such as the UK International Data Transfer Agreement or Addendum, or the UK–US data bridge.

Keeping it safe

• Everything travels encrypted, including the connection between our service and its database.
• Everyone signs in with their own account and a one-time code sent to their email. There are no shared passwords.
• Patient calls are only sent to screens that hold that display's private screen key.
• We keep personal information for the shortest time we can (see above).

Your rights

You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, restrict how we use it, or object to our using it. You can also ask for a copy to take elsewhere. Email [email protected]; we'll reply within one month. For information a practice holds about you as a patient, contact the practice.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Changes

If we change this notice, we'll update it here and change the date at the top. If a change matters to you, we'll tell you directly.