Privacy

The short version

• There are no accounts, and we never ask who you are.
• We use analytics tools from other companies — Google Analytics, Microsoft Clarity, Clicky and Cloudflare Web Analytics — to understand how the site is used. They may set cookies. What they collect, and how to opt out, is below.
• Your quotes and your shortlist stay in your browser. There is exactly one exception, and it only happens if you ask for it: Email me a link to this brief.
• We store a contact detail in two other situations, both of which you start: claiming a practice listing, and asking a practice for a consultation. Each one deletes itself, and each one has a button that deletes it sooner.
• We also count how often a handful of actions happen, in our own database, and how often people search for something we do not cover. A count is a few columns and a number; none of it can be traced to a person, because none of it has ever held one.
• If you write to us with the contact form, your message is emailed to us and is not stored on this site.
• We do not sell your personal information.

What stays on your device and never reaches us

The quote checker, your shortlist and the prices you keep to compare all live in your browser’s own storage. Nothing about them is sent to us, put into a web address, written to a log, or counted. There is a switch on the checker to keep them between visits and a button to clear them, and both act only on your device.

The analytics tools below see that these pages were used — a page view, a click — but not what is on them: the checker, your shortlist, the brief and the compare page are marked so that Microsoft Clarity masks their contents before anything leaves your browser, and none of what you enter is ever in a web address for a tool to record.

An end-to-end test watches every network request the checker makes (with the analytics tools switched off, so that it sees only our own code) and fails the build if any of them carries an amount or a practice name.

The three things we do store about a person

1. A saved brief, if you ask for one

On the consultation brief there is a closed panel that says Email me a link to this brief. Using it — and only using it — sends us a copy of what is on that page: the surgeons on your shortlist, your quotes, the prices you kept, and any answers you have typed. We store it as one document, with your email address, and send you a link.

• Who can read it: whoever has the link. There is no account, no lookup, and no way for us to find it by your email address or anything else. Our own review console is told how many saved briefs exist and not one word of any of them.
• What the email says: a neutral subject, one line, and two links. No procedure, no amount, no surgeon’s name — a mailbox is read over shoulders.
• How long: 90 days, starting again each time you open it. Then it is deleted.
• Deleting it: from the brief’s own page, or from the second link in the email. It deletes the row itself, not a flag on it, and both links then lead nowhere.

2. Asking a practice for a consultation

On a practice that has claimed its listing there is a Request a consultation form. It asks for your name and one way to reach you — an email address or a phone number, not both — plus the operation you are asking about and anything you want to add.

• Who it goes to: that practice, and nobody else. We send them a message containing a link and nothing about you; your name and contact detail are on the page that link opens, which only they have.
• What we promise them: nothing. The words are “a request was sent” and “they may or may not be in touch”. No time is held and nothing is arranged.
• How long: 30 days. Then your name, your contact detail and anything you wrote are erased, and both links stop working. The practice, the operation and the dates stay, so that we can count how many requests a practice received and how many it answered — a date is not a person, and by then the row holds nobody.
• Taking it back: the status page has Cancel this request and delete what I gave you. It erases you straight away rather than in 30 days. If the practice had already read it we cannot reach into their records, and we say so rather than implying otherwise.
• The marketing box under the consent sentence is unticked and is used for nothing. We record that you said yes or no, and no code anywhere reads it. If that ever changes, a way to withdraw it has to exist before the first message is sent.

3. Claiming a practice listing

Somebody at a practice can claim its listing. We store the email address they claimed from, their name and their role — separately from everything else, read by one module that no public page may import. The address has to be at the practice’s own web domain; that is the whole of the proof, and there is no other way to claim.

• The verification link works once and lasts 72 hours. The practice’s own page is opened by a separate link that expires and can be revoked.
• Operations can end a claim at any time, and can delete the contact details on request. What survives is that a claim existed and which domain it required — facts about a business, not about a person.
• A practice that confirms a price is emailed once, about a month before that price reaches a year old, to say it is about to stop being shown. That message names a date and no amount. Prices go stale after 12 months.

Analytics tools

We use three analytics services from other companies to understand how the site is used — which pages are read, where visitors come from, and where a page is confusing. Each one runs in your browser, may set its own cookies, and sends what it collects to its own servers.

• Google Analytics (Google). Counts visits and page views and records the address of each page viewed, the page that sent you here, your browser and device type, and an approximate location worked out from your IP address. Its cookies (_ga and _ga_…) tell one visit from the next for up to two years. How Google uses information from sites that use its services.
• Microsoft Clarity (Microsoft). Session recordings and heatmaps: where people scroll, click and get stuck. What you type into any form field is masked before it leaves your browser, and so is everything on the quote checker, the brief, the compare page, your shortlist and the contact form. Its cookies (_clck, _clsk) last up to a year. Microsoft privacy statement.
• Clicky (Roxr Software). Visitor and page-view counts, the page that sent you here, and the links you follow off the site. Depending on its settings it may set a cookie (_jsuid, up to a year) to tell a returning visitor from a new one. Clicky privacy policy.
• Cloudflare Web Analytics (Cloudflare, which also hosts the site). Page views and how quickly pages load, measured in your browser. It sets no cookies and does not identify you. Cloudflare privacy policy.

Because they record page addresses, they see what a search asked for: a search’s address includes the procedure and the place you typed, such as a city or ZIP code. They never see a quote, a shortlist, a brief or a message, because none of those is ever in an address.

None of them records our review console, or any page opened by a private link — a saved brief, a consultation request and its status page, a practice’s page, a claim link — or the form that asks a practice for a consultation. Those addresses carry a key, and a key does not belong in anybody’s log.

Opting out

• Block or delete cookies in your browser’s settings, or use a private window; most browsers can also block third-party trackers outright.
• Google offers a Google Analytics opt-out browser add-on.
• A content or tracker blocker stops all three. The site works the same without them.

What we count ourselves

Separately from those tools, our own analytics is one table: a day, an event name, a procedure, a coarse area, and a number. No IP addresses, no cookies, no identifiers, no sessions, no free text. The area is a city name or the first three digits of a ZIP code — never a full one, which in a thinly populated place can identify a household.

Three of those events — a profile view, a click on a practice’s phone number or website, and a consultation request — also carry which practice they were about, so that we can tell a practice how many people looked at it last month. A database rule refuses that column on any other event. None of it can be traced back to a person, because none of these rows has ever held one.

One more count holds words. When a search is for something we do not cover — a colonoscopy, say — we count how many times those words were searched for that day, so that we know what people come here looking for. The words are reduced to lower-case letters, digits and spaces, sixty characters at most; a search with a long number in it is not counted, and neither is a first and last name that matches a listed surgeon. What is kept is the words, the day and a number, and nothing about who searched.

The address you connect from is used, briefly and in memory, to rate-limit the forms that send email. It is hashed with a key that exists only while the server is running, and it is never written down.

The search box can offer Use my area. For that, the network that carries this site (Cloudflare) estimates a city and ZIP code from the network address you connect from, and our server passes that estimate to your browser, which uses it once, if you choose it, to fill in the box. It is approximate — often the next town over — nothing is searched until you press Search, and we do not store it or write it to a log.

If you write to us

The contact form asks for your name, your email address, a topic and your message. Sending it emails exactly that to us, with your address as the one we reply to. It is not written to our database, and nothing on this site keeps a copy; it lives in our email, where we keep it for as long as we need to answer you and look after our correspondence. The form keeps no record of who sent what — only the short-lived rate limit below. If you email us directly, the same applies.

What a practice sees, and what our reviewers see

• A practice sees a consultation request addressed to it: your name, the one contact detail you chose, the operation, and anything you wrote. Nothing else, and nothing about anybody else.
• Our review console shows a request’s status, its delivery attempts and its dates. It does not list your name or contact detail. A reviewer can reveal them, once, by giving a reason — and that is written down against their name before they see anything.
• Nobody at Surgery.com can read a saved brief. There is no route to one.

Asking us to delete something

Every one of the three things above has a button. If you would rather write to us, use the contact form and tell us which of the three it is — we will need the link, because without it we have no way to find your brief or your request. To ask us to delete a message you sent us, write to us the same way.

What we do not do

• We do not sell your personal information.
• We do not pass your details to anybody except the one practice you chose, and we never pass a saved brief to anybody at all.
• We do not build profiles of visitors ourselves. The analytics tools above keep their own records under their own policies.
• The only cookie this site sets itself belongs to the review console, holding the reviewer’s own name. The cookies visitors receive come from the analytics tools above.