Privacy
What SurgFlow collects about you, what we do with it, and what we never touch. Plain English, no legal padding.
Last updated: 23 August 2026
1. Who we are
SurgFlow is a theatre coordination tool for private hospitals in South Africa, operated by SurgFlow.
Your hospital decides what goes into SurgFlow and why. Under the Protection of Personal Information Act, 2013 (POPIA), your hospital is the responsible party for that information and we process it on their instructions. Where we use information for our own purposes — keeping the service secure, and running our business — we are the responsible party, and that is what this page describes.
If you want to see, correct or delete information your hospital holds in SurgFlow, ask your hospital first. For anything we hold in our own right, our Information Officer can be reached at privacy@surgflow.co.za.
2. What we collect about you
Only what SurgFlow needs to coordinate theatre work — nothing about your private life:
- Your name, work email address, and your role at the hospital.
- Your work phone number, and — for surgeons — your practice name, if these are added to your profile.
- Which hospital or hospitals you work at, and which surgeons you work with.
- For supplier contacts: your company, your name, and the work email or phone number the hospital uses to reach you.
- A record of what you do in SurgFlow — cases you create or change, items you mark, notes you post, and when you did each one.
- Technical information your device sends when you use SurgFlow, including your IP address when a sign-in attempt fails.
- If you turn on notifications, an address identifying your device, so alerts can reach it.
- Anything you type into a free-text box, such as a note.
3. SurgFlow is not a patient record
SurgFlow is built to coordinate theatre work, not to hold clinical records. There is no field anywhere in the app that asks for a patient's name, ID number, date of birth or medical aid details, and we do not want them.
A case in SurgFlow is identified by the procedure, the surgeon and the time — never by the patient.
Some boxes let you type freely, such as a note. Anything typed there is saved as written, so the rule for everyone using SurgFlow is simple: do not put patient details in them. The app reminds you at each of those boxes, and messages sent to a whole role are additionally refused if they contain something that looks like an ID number, a medical aid number or a date of birth.
If patient information is entered by mistake, your theatre unit manager or hospital administrator can redact it, and it stops being visible in the app. Tell them as soon as you notice.
4. Where your information goes
Your information is stored in South Africa. SurgFlow runs on Microsoft Azure in the South Africa North region, and the database cannot be reached from the public internet.
Two things leave our systems, and only for the purpose of reaching you:
- Email. When SurgFlow emails you — a password reset, or a supply link for a supplier — the message goes out through our email provider.
- Push notifications. If you switch notifications on, the alert reaches your device through the push service your browser uses — Google (Android and Chrome), Apple (iPhone, iPad and Safari) or Mozilla (Firefox). To deliver it they receive your device's push address and the timing of each message, and their servers may be outside South Africa. They cannot read the message itself: it is encrypted before it leaves us and is only unscrambled on your device. Turning notifications off stops this entirely.
5. Cookies, and tracking we do not do
SurgFlow has no advertising, no analytics, and no third-party tracking of any kind. Nobody outside SurgFlow is watching what you do in it.
We use one cookie: the one that keeps you signed in. Without it you would have to enter your password on every page. It is removed when you sign out. Because it is strictly necessary for the app to work, we do not ask you to consent to it — there is nothing optional to consent to.
Separately from cookies, we do keep the activity record described in section 2. That is a first-party record used to coordinate theatre work and to investigate security questions — not a tracking profile, and it is never sold or shared for marketing.
6. Your rights, and how to reach us
Under POPIA you may ask what personal information we hold about you, ask us to correct it, or object to how we use it. Write to privacy@surgflow.co.za and we will respond.
Some of your information is held by your hospital as your employer. Where a request is really about your employment record rather than SurgFlow, we will tell you so and point you to the right place.
If you are not satisfied with our answer, you can complain to the Information Regulator of South Africa at https://inforegulator.org.za.