Privacy Policy

Effective October 17, 2026.

SurgX (surgx.io) is operated by Concept Bytes LLC (“we”). Questions: info@scrubstack.io.

What SurgX is

SurgX is a catalog and education reference for surgical supplies and devices. It holds no patient records. Do not enter patient information anywhere on SurgX. Preference cards live on ScrubStack, not here.

What we collect from you

If you create an account

• Your name, email address and organization, and the account type of the page you sign up on (buyer, seller or rep). If you leave the name blank, we use the part of your email before the @.
• A username, and the organization you pick from our search, if you add them.
• Your password, stored only as a salted one-way hash. We cannot read it.
• Your account’s roles (for example, subscriber) and when you last signed in.

If you search for your organization while signing up

• The text you type. If you allow it, your browser also shares its location, which we use to rank nearby organizations.
• Our server sends your search text, with an area within about 60 km of that location (or of a ZIP code you type), to OpenStreetMap’s Nominatim service. It does not pass on your IP address or cookies.
• We keep the search text, the location rounded to about 11 km, and the results for 7 days, to answer the same search faster.

If you send an inquiry about a product

• The name, email, phone, organization, quantity and message you enter, and the product it is about.

When you use the site

• Cookies. When you sign in, we set two cookies: one keeps you signed in, and one protects your account against forged requests. Both last up to 30 days, or until you sign out. We set no advertising or tracking cookies.
• Saved products. The products you save are kept only in your browser, on your device. They are not sent to us.
• Visit counts. We count page visits with GoatCounter, which runs on our own server and sets no cookies. For each page you open, your browser sends it the page address (with any search text in it), the page title, the address of the page you came from, and your screen width.
• Server logs. Our web server records each request, including your IP address, the time, the address requested and your browser’s identification. Search text, scanned codes and the location your browser shares for the organization search travel in the address, so they are recorded too. These logs are kept for about 14 days.
• Security records. To protect accounts, we record sign-up, sign-in, sign-out, email-verification and password-reset events with your account number, the outcome, and a SHA-256 hash of your email and IP address. To slow down repeated attempts, we also keep attempt records keyed by IP address or email address.
• The Breakroom. If you use the Breakroom, our discussion space, you sign in to it through ScrubStack. ScrubStack sends us a Breakroom ID, your display name and your role, but not your ScrubStack account number. We store your Breakroom profile (display name, role, specialty, region and verification status), what you post there (threads, posts, comments, device ratings, pictures and direct messages), who and what you follow, your likes, blocks and reports, and the points and awards you earn.

Outside services your browser contacts

SurgX pages also load content from these services. They see your IP address and browser details. We send them no account details.

• Google Fonts (fonts.googleapis.com and fonts.gstatic.com), for the fonts.
• unpkg.com, for code libraries the pages use.
• The public websites that host some product pictures.
• Clearbit (logo.clearbit.com), for company logos on the older page designs.
• Cloudflare (r2.dev), which stores our education audio, video and mind maps.

People who are not SurgX users

SurgX shows public business information about some people who do not use it:

• Sales representatives and distributor contacts: for example name, title, company and work area. It comes from manufacturers’ public rep pages, public government records (such as SAM.gov, GSA Schedules, CMS Open Payments and USAspending.gov), and listings people submit. Email, phone and LinkedIn are shown only to administrators and to verified subscribers.

To correct or remove a listing about you, email info@scrubstack.io.

How we use information

We use it to run SurgX and your account, keep the service secure, answer inquiries, and improve the catalog. We do not sell personal information, and we do not use it for advertising. We do not use SurgX browsing to train a public consumer model on your identity.

How long we keep information

• Your account: while it exists.
• Sign-in sessions: up to 30 days, or until you sign out.
• The organization-search cache: 7 days.
• Server logs: about 14 days.
• Security records and product inquiries: until we delete them.

Your choices

• Delete your account: email info@scrubstack.io from the address on your account. We delete the account within 30 days.
• Correct your details: email us. There is no edit page yet.
• Location: your browser asks before it shares your location. You can say no and still search.
• Saved products: clear them from your browser at any time.

Children

SurgX is for healthcare and industry professionals. It is not meant for anyone under 18.

Changes

If we change this policy, we will update the effective date at the top.

Contact

info@scrubstack.io. Related: Terms of Service.