Privacy policy

In shortYou don't need an account and we don't ask who you are to check a surgeon. We keep the names you check so we can reuse the result, and we keep contact messages so we can reply. We don't sell data or run adverts. The only cookies we set are the one that holds your pass and, if you say yes, anonymous analytics.

Who we are

Surgeon Shortlist is run by Vibrant Consulting Ltd, a company registered in Ireland (company number 718751). We are the data controller for the information described here. You can reach us through our contact form.

What we collect

Surgeon checks. The surgeon's name, country and any city you type in, and the report we produce. We don't link a check to you: we don't ask for your name or email to run one. Reports have their own page; only reports confirming a specialist appear in search engines.
Emailed reports. If you ask us to email a report, we use your address to send it and keep a record of the send, with your IP address, for 30 days to prevent misuse. We don't add you to any list.
Surgeons updating their page. The surgeon's details they send us, and the name, email and phone number of the person sending them, so we can confirm who they are before publishing anything.
Finding a surgeon. The answers you choose on these screens are not stored against your name; they travel in the page address so you can share or revisit a search.
Contact messages. Your name, email address and message, so we can reply.
Technical data. Our hosting provider keeps short-lived server logs, such as IP address and browser type, to keep the site secure and working.

If you buy a pass

Payments are handled by Stripe Payments Europe Ltd, who act as a separate data controller for your card and billing details under their own privacy policy. Stripe tells us your email address, the amount, the country used for tax and a payment reference. We keep those with your pass for seven years for tax records.

We email your pass link through Resend, which processes the email address and message on our behalf. We record when a pass link is opened so we can spot misuse. We don't keep the searches you run under a pass against your name.

A pass sets one cookie on each device you open it on, so the site knows the pass is yours. It holds only the pass reference, expires with the pass, and is not used for anything else. Free searching is limited to a fair number per hour per connection, and the address counter is kept for an hour only.

Cookies and analytics

We ask before setting any analytics cookie. If you say yes, Google Analytics (through Google Tag Manager) records which pages are visited, which searches are run and whether a pass was bought, so we can see what helps people. It does not record names, emails or the surgeons you look at against you, and we have advertising features switched off. If you say no, or say nothing, no analytics cookie is set. Your answer is kept in your browser, and you can change it by clearing site data.

Google may process this data in the United States under the EU–US Data Privacy Framework and standard contractual clauses.

Information about surgeons

Our reports describe surgeons using information that is already public: official registers, surgical colleges, professional societies, publication databases and surgeons' own websites. We process it in the legitimate interest of helping patients make informed, safe choices. We report what each source shows and the date we checked it. If you are a surgeon and think something is out of date or wrong, please tell us and we'll look at it promptly.

How we use it

To run checks and show reports. We keep each report so the next person who checks the same surgeon gets an answer quickly, and we re-check after 30 days.
To reply to messages and act on corrections.
To keep the service secure and fix problems.
With your consent, to measure which pages and searches help people, through anonymous analytics.

Our legal basis

We rely on legitimate interests: providing an independent way to check and find surgeons, answering people who contact us, and keeping the site secure. A pass is a contract with you, and the records of it are kept to meet tax law. Analytics run only on your consent. We never use your information for advertising, and we never sell it.

Only the service providers who help us run the site: our hosting and database providers, providers who process search terms on our behalf to carry out a check, Stripe for payment, Resend for email and, with your consent, Google for analytics. They act on our instructions and may not use the data for their own purposes, except Stripe, which is a controller for your payment details.

Some of these providers are based in the United States. Where data leaves the European Economic Area it is protected by the European Commission's standard contractual clauses or an equivalent safeguard.

How long we keep it

Surgeon reports: while they remain useful, refreshed every 30 days when checked again.
Contact messages: until we've dealt with them, and no longer than two years.
Pass records (email, amount, payment reference): seven years, for tax.
Analytics: as set in Google Analytics, 14 months.
Server logs: kept by our hosting provider for a short period, usually days.

Your rights

You can ask to see, correct or delete information we hold about you, ask us to restrict or stop using it, or ask for a copy. Use our contact form. If you're unhappy with how we handle your data you can complain to Ireland's Data Protection Commission at dataprotection.ie.

Changes

If we change how we use information, we'll update this page and the date at the top.