Privacy Policy

1. Who we are

Case to Content ("we", "us") is operated by Surgiflow (the company behind the Case to Content brand). We are the data controller for personal data processed through the Service. Contact us at support@casetocontent.com.

2. The data we process

• Account data: your name and email address.

• Usage data: how you use the app (e.g. number of items generated, time spent, feature use) to improve the Service.

• Content you provide: case notes, text, and any images or videos you upload.

• Payment data: handled directly by Stripe. We receive confirmation of your subscription status but do not store your card details.

• Communications: messages and feedback you send us.

3. Patient images and identifiable information — important

Photos and videos you upload are processed to generate your content. Images are handled in your browser and sent securely to our AI provider only to produce your requested output; we do not build a stored library of your uploaded patient media on our servers.

You are responsible for ensuring you have appropriate patient consent and a lawful basis before uploading any patient-identifiable data. Please avoid uploading identifiable patient information unless necessary and properly consented.

4. How and why we use data (legal bases)

• To provide the Service and process your content — legal basis: performance of our contract with you.

• To operate billing and subscriptions — contract / legal obligation.

• To improve and secure the Service (usage analytics) — legitimate interests.

• To send you service and update emails — contract / legitimate interests, or consent where required.

5. Who we share data with (processors)

We use trusted service providers to run the Service, including:

• Anthropic — AI processing of your inputs to generate content.

• Vercel — hosting.

• Supabase — authentication and database.

• Stripe — payment processing.

• Kit (ConvertKit) — email and list management.

These providers process data on our behalf under appropriate agreements. We do not sell your personal data.

6. International transfers

Some providers (e.g. Anthropic, Vercel, Stripe) may process data outside the UK/EEA. Where they do, appropriate safeguards (such as Standard Contractual Clauses) are relied upon.

7. Retention

We keep account and billing data for as long as your account is active and as required for legal and accounting purposes. Uploaded media is not retained beyond what is needed to generate your content. Usage analytics are kept in aggregate/limited form.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. To exercise these, contact us at support@casetocontent.com. You may also complain to the UK Information Commissioner's Office (ICO).

9. Security

We use reasonable technical and organisational measures to protect data, including encryption in transit. No method is completely secure, and you use the Service at your own risk.

10. Cookies & analytics

We use essential cookies to run the Service and limited analytics to understand usage and improve it. We do not use advertising trackers.

11. Changes & contact

We may update this policy from time to time. For any privacy question, contact support@casetocontent.com.