Privacy

What we store

For each surgeon account: name, email address, hospital, department and position. For each patient record entered by a surgeon: name, age, sex, address, registration number, diagnosis, unit, management, surgery date and remarks, along with any photographs or lab reports attached to that record.

Where it is stored

Patient records are held in a managed Postgres database. Photographs and lab report files are held in a private object storage bucket and are never publicly readable — they are served only through short-lived signed links generated for a signed-in surgeon.

When you use RoundDoc offline, records you have opened or created are cached in your browser's local storage on that device so they remain available without a signal. They sync to the server when the device reconnects.

Who can see it

Access is enforced at the database level, not only in the interface. A surgeon can read and write their own patients and those shared within their department. Department administrators approve who joins a department. Edits to a patient record are written to an audit trail.

We do not sell data, and we do not share patient data with third parties for advertising or analytics.

Your responsibilities

Patient information you enter remains the responsibility of you and your institution, including obtaining any consent your hospital requires before recording identifiable information or clinical photographs.

Getting in touch

For questions about this policy, data removal, or a request to export or delete an account, write to info@treesera.com.