Privacy Notice

Tándem is a co-surgery collaboration programme operated by Dr Roberto López-Píriz and Dr David Madruga, registered in Spain and the United Kingdom. We are the data controllers for personal information submitted through this website and through case-submission correspondence.

We collect the following categories of personal data: your name and professional contact details; your GDC or national registration number; clinical information about your patient, including imaging and case summaries; and technical data generated by your use of this website, such as your IP address and browser type.

The lawful basis for processing clinical case data is the performance of a contract and, where applicable, the processing of special-category health data under Article 9(2)(h) UK GDPR 2018 for the purposes of providing professional medical treatment. Contact and registration data is processed on the basis of legitimate interest in operating a professional referral service.

Clinical case data is retained for seven years from the date of the last clinical activity, in line with professional regulatory requirements. Website usage data is retained for no longer than thirteen months. You may request deletion of your contact data at any time, subject to our legal retention obligations.

This website uses a single first-party analytics cookie from Google Analytics to understand how the site is used. It loads only after you accept it in our cookie banner; if you decline, no analytics cookie is set and no data is sent to Google. We also use Vercel's privacy-friendly analytics, which measures usage without cookies. You can change your choice at any time using the “Cookie preferences” link in the footer.

To operate this service we share personal data with a small number of trusted providers who process it on our behalf under written data-processing agreements: Supabase (secure database, authentication and file storage for the case portal), Brevo (transactional email notifications), Google Analytics (website-usage measurement, subject to your consent), and Vercel and Railway (website and application hosting). Some of these providers, including Google and Vercel, are based in the United States; where personal data is transferred outside the United Kingdom or the European Economic Area, that transfer is protected by Standard Contractual Clauses or the EU–US / UK Data Privacy Framework. We do not sell your personal data or use it for advertising.

You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom or the Agencia Española de Protección de Datos (AEPD) in Spain.

To exercise any of these rights or to ask a question about how we handle your data, please write to us at cases@tandemsurgery.com. We aim to respond within thirty calendar days.