Privacy Policy

1. Who We Are

After.surgery is an independent website providing surgical recovery information and product recommendations. After.surgery is the data controller in respect of personal data collected through this website.

If you have any questions about this Privacy Policy or our data practices, please contact us at hello@after.surgery.

2. What Information We Collect

2.1 Browsing the site

You can read every guide on after.surgery without giving us any personal information and without an account. We only receive personal data from browsing if you choose to send it, for example your name, email address and the contents of any message you send us by email.

2.2 If you create an account

An account is needed only to buy, redeem or open a recovery plan. When you create one we store:

• Your email address;
• A cryptographic hash of your password, if you set one. We never store the password itself and cannot see it;
• The date you created the account and the date you last signed in;
• A first name, if you choose to give one.

2.3 If you build a recovery plan (health information)

A recovery plan is built from answers you give us about an operation. This is health information, and in the UK and EU it is a special category of personal data with extra protection. We are explicit about it because you should know exactly what you are handing over.

When you save a plan we store:

• The operation you selected and its date;
• Whether the plan is for you or for someone you are looking after, and a first name if you give one;
• Your answers about your circumstances: who will be at home with you, whether you have stairs, what your work involves, and whether anyone depends on you at home;
• Your answers to an optional question about factors that affect healing. Those are diabetes, smoking or vaping, blood-thinning medication, a previous blood clot, steroids or immune-suppressing medication, and anxiety about health matters;
• An optional answer about what is worrying you most.

The healing-factors question is optional and can be left blank. Every question is answered from a fixed list of options. We never ask for a diagnosis, a medical record, a hospital, a surgeon, or free text about your health, and we have no way to receive them.

Before you pay, your answers are held only in a signed cookie on your own device and are not stored on our servers. If you never buy a plan, nothing about your health ever reaches us.

Which items you tick off on your daily list is stored in your browser and never sent to us.

2.4 If you buy a plan

Payments are taken by Lemon Squeezy, who act as the merchant of record. That means Lemon Squeezy is the seller and processes the payment, not us.

We never see or store your card details. Lemon Squeezy receives your email address, the amount, and the country and tax information they need in order to charge the correct tax. They do not receive your health answers or anything else about your operation. Our own record of a purchase is limited to an internal reference, the amount, the currency, and whether it was paid.

2.5 If you redeem a code from a hospital or clinic

We record that a code was used and which batch it came from. The organisation that issued your code is told how many of its codes have been redeemed. It is not told who redeemed them, and it does not receive your email address, your answers, or your plan.

2.6 Technical data collected automatically

When you visit after.surgery, certain technical data may be collected automatically, including your approximate region derived from your device settings, your browser and device type, and the pages you view. This is described further in section 5.

3. How We Use Your Information

We use the information above only to:

• Build, store and display your recovery plan, and keep it correct as the days pass;
• Let you sign in and get back to your plan on any device;
• Send the emails the service requires: a sign-in link, a link to your plan, and confirmation that a code was redeemed;
• Take payment, provide refunds, and keep the records we are required to keep;
• Tell an organisation that issued vouchers how many have been used, in aggregate only;
• Understand in aggregate how the site is used, so that it can be improved.

We do not sell your personal data. We do not share your health information with anyone. We do not use your health information for advertising, and we do not use it to target you with anything. Your answers are used to build your plan and for nothing else.

4. Legal Basis for Processing

For readers in the UK and the EU, our lawful bases under the UK GDPR and the EU GDPR are:

• Contract. Holding your email address, your account and your plan, and taking payment, are necessary to provide the service you asked for.
• Explicit consent. The health information described in section 2.3 is special category data, and we rely on your explicit consent under Article 9(2)(a). You give that consent by choosing to save a plan built from your answers. You may withdraw it at any time by deleting your plan or your account, as described in section 9.
• Legal obligation. Keeping records of transactions for the period required by tax law.
• Legitimate interests. Keeping the site secure, and understanding in aggregate how it is used, balanced against your rights.

5. Cookies

After.surgery uses cookies and similar technologies. Cookies are small text files placed on your device by your browser.

We use the following types of cookies:

• Essential cookies, necessary for the website to function correctly;
• Analytics cookies, used in aggregate, anonymised form to understand how visitors interact with the site;
• Third-party cookies, set by external services such as Amazon when you click affiliate links.

You can control and delete cookies through your browser settings. By continuing to use this site, you consent to our use of cookies as described above.

6. Affiliate Links and Commercial Relationships

After.surgery participates in the Amazon Associates Program, and may participate in other affiliate schemes. When you click an affiliate link and visit a third-party site such as Amazon, that site's own privacy policy will apply. We have no control over and accept no responsibility for third-party data practices.

We do not sell, rent, or trade your personal data to any third party for marketing purposes. We have no advertising relationships, paid placements, or sponsorship arrangements with any product manufacturer or healthcare provider. Our only commercial arrangements of this kind are the affiliate programmes named above.

7. Data Retention

We keep personal data only as long as there is a reason to:

• Your account and your plans: for as long as your account exists. A recovery plan is meant to stay useful for months, so we do not delete it on a timer. You can delete it whenever you want, as described in section 9.
• Unfinished answers: held on your own device only, and discarded after fourteen days if you never save a plan.
• Sign-in links: thirty minutes, after which they stop working. Only a hash of the link is ever stored.
• Purchase records: the period required by tax law, currently six years in the UK. These contain a reference, an amount and a date. They contain no health information.
• Emails you send us: as long as needed to deal with what you asked about.

8. Data Security

We take reasonable technical and organizational measures to protect your personal data from unauthorized access, loss, destruction, or alteration, including encrypted connections (HTTPS). However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

If you believe that your personal data has been compromised, please contact us immediately at hello@after.surgery.

9. Your Rights

Under applicable data protection law, you may have the following rights in relation to your personal data:

• Right of access, you may request a copy of the personal data we hold about you;
• Right to rectification, you may ask us to correct inaccurate or incomplete data;
• Right to erasure, you may ask us to delete your personal data in certain circumstances;
• Right to restriction, you may ask us to restrict processing of your data in certain circumstances;
• Right to object, you may object to processing based on legitimate interests or for direct marketing;
• Rights related to automated decision-making, we do not use automated decision-making or profiling that produces legal or similarly significant effects.

Deleting your plan or your account

You can ask us to delete your account entirely by emailing hello@after.surgery from the address the account uses. Deleting your account removes your email address, your plans, and every health answer you have given us. We will do it within 30 days and confirm when it is done. We keep only the minimal transaction record that tax law requires, which contains no health information.

To exercise any of these rights, please contact us at hello@after.surgery. We will respond within a reasonable timeframe as required by applicable law. You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

10. Children's Privacy

After.surgery is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data without parental consent, please contact us so that we can take appropriate action.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will be revised accordingly. We encourage you to review this policy periodically. Continued use of the website after any changes constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us at hello@after.surgery. We take privacy inquiries seriously and aim to respond promptly.