Privacy Policy

This policy explains how laparoscopic.tv, operated by the operator of laparoscopic.tv (the “controller”, “we”), processes personal data when you use the Service. Contact for all privacy matters: [email protected].

1. Data we collect

• Account data — email address, first and last name, and your password, which is stored only as a salted hash (we never store or see the plain-text password).
• Optional profile data — specialty, institution, country, bio, and avatar, if you choose to provide them.
• Content — videos you upload, their titles, descriptions and metadata, comments and discussion posts, and content derived from your videos (transcripts, captions, AI analysis, search embeddings).
• Billing data — your plan, usage quotas (for example AI minutes and storage), and invoice history. Payment card details are collected and processed directly by Paddle, our merchant of record — we never receive them.
• Technical data — IP address, browser user agent, and request logs generated by our servers and reverse proxy for security and troubleshooting.

2. Why we process it (legal bases)

• To provide the Service (Art. 6(1)(b) GDPR — contract): account management, hosting and streaming your videos, AI features, discussions, billing, and transactional email such as password resets.
• Security and abuse prevention (Art. 6(1)(f) — legitimate interests): server logs, rate limiting, and moderation of published content.
• Legal compliance (Art. 6(1)(c)): tax and accounting records connected to purchases.

We do not use your data for advertising, and we do not sell it.

3. AI processing

Videos are processed on our behalf by Coniviso, our video-intelligence provider, to provide storage, streaming, transcription, analysis, semantic search, and Ask AI answers. A partner account is provisioned with Coniviso for your laparoscopic.tv account for this purpose. Coniviso processes this data as our processor under a data processing agreement.

4. Who receives your data

• Coniviso (coniviso.com) — video hosting, streaming, and AI processing (processor).
• Paddle — payment processing as merchant of record; for payment data Paddle acts as an independent controller under its own privacy policy.
• Resend — delivery of transactional email (processor).
• Hosting and network providers — our servers are hosted with Hetzner in the EU; DNS and network services are provided by Cloudflare.
• Other users — content you choose to publish, along with your name and public profile fields, is visible to the community. Moderators can view videos submitted for publication.

Where a provider processes data outside the EU/EEA, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

5. Cookies and local storage

We use a single, strictly necessary session cookie to keep you signed in. It is httpOnly and is not used for tracking. We use your browser’s localStorage for interface preferences (for example, sidebar state) and a non-sensitive cache of your own profile. We use no analytics, advertising, or third-party tracking cookies, which is why you don’t see a cookie banner.

6. How long we keep data

• Account, profile, and content data — until you delete your account or the specific content. Account deletion is self-service from your profile page and also removes the partner account and content held by Coniviso.
• Server logs — kept for a short rolling window for security and troubleshooting.
• Billing records — kept for as long as tax and accounting law requires.
• Backups — deleted data may persist in encrypted backups for a limited period before being overwritten.

7. Your rights

Under the GDPR you can, at any time:

• access the personal data we hold about you and receive a copy (portability);
• correct inaccurate data (most profile data is editable directly in your profile);
• delete your account and data (self-service in your profile, or by emailing us);
• object to, or ask us to restrict, processing based on legitimate interests;
• lodge a complaint with your local data-protection authority if you believe we process your data unlawfully.

To exercise any right, email [email protected]. We answer within one month.

8. Patient data

laparoscopic.tv is designed for de-identified surgical footage only; our Terms of Service require uploaders to remove all patient identifiers and to have obtained any required consents. We do not intentionally process patient health records. If you believe a video contains identifiable patient information, report it via Copyright & Takedown and we will review it promptly.

9. Security

All traffic is encrypted in transit (TLS). Passwords are stored as salted hashes, API credentials are encrypted at rest, and access to production systems is restricted. No system is perfectly secure, but we notify affected users and authorities of breaches as the GDPR requires.

10. Children

The Service is intended for medical professionals and students aged 18 or over. We do not knowingly collect data from children.

11. Changes

We may update this policy as the Service evolves. Material changes will be announced by email or in-app notice, and the “last updated” date above always reflects the current version.