Operating Systems

Privacy Policy

Effective date: 25 October 2026

This Privacy Policy explains how Operating Systems ("we", "us", or "our") collects, uses, stores, and protects information when you visit this website or use our software products. We are committed to complying with the Privacy Act 2020 and the Health Information Privacy Code 2020 (New Zealand), and the Privacy Act 1988 (Cth) and the Australian Privacy Principles (Australia).

1. Who we are

Operating Systems is a software company based in Auckland, New Zealand, building digital tools for surgical clinicians — including GONC MDMer, endoMDM, Surgibud, NextDose, GONC Referrer, and Middleman. If you have privacy questions, contact our Privacy Officer at [email protected].

2. Scope of this policy

This policy applies to this website (operatingsystems.nz) and to any of our products that do not publish their own privacy policy. Where a product has its own privacy policy (for example, Surgibud), that policy describes the product's data handling in detail and takes precedence over this one for that product.

3. What information we collect

This website

  • This website has no sign-up forms, analytics, advertising cookies, or tracking pixels
  • Our hosting provider keeps standard server access logs (IP address, browser type, pages requested) for security and operational purposes
  • Fonts are loaded from Google Fonts, so your browser sends your IP address and browser details to Google when the page loads

Our products

Depending on the product you use, we may collect:

  • Account information — such as your email address, name, and job title, used for authentication, account management, and transactional emails
  • Billing information — for paid products, payments are processed by Stripe; your card details are entered directly with Stripe and are never seen or stored by us
  • Clinical content you enter — such as de-identified case details, clinical notes, or referral text
  • Technical and usage data — such as authentication event logs (login times, IP addresses) and server access logs

Patient information

Our products are designed to work with the minimum patient information necessary. Where a product is designed around de-identified data, you must not enter patient names, dates of birth, official patient identifiers or numbers, or any other information that directly identifies a patient, unless the product provides a field specifically for that purpose.

AI feature data

Some products offer AI-powered features. When you use them, the text or images you submit are sent to an AI provider for processing (see section 7). We do not use content submitted to AI features to train AI models.

4. How we use your information

PurposeLegal basis
Providing and operating our productsContract performance
Authentication and account securityContract performance / Legitimate interest
Processing subscription payments and receiptsContract performance / Legal obligation
AI feature processingYour explicit action (submitting content)
Operating and securing this websiteLegitimate interest
Rate limiting and abuse preventionLegitimate interest
Complying with legal obligationsLegal obligation

We do not sell your information, use clinical content for marketing, or use it to train AI models.

5. Data storage and security

Where your data is stored

Our products are hosted with reputable cloud infrastructure providers. Where a product stores data, its own privacy policy states where that data is physically located. Content delivery networks may process request metadata at global edge locations but do not store your health information.

Security measures

  • All data is transmitted over HTTPS (TLS 1.2 or higher)
  • Access controls ensure each user can access only their own data
  • Authentication tokens are validated server-side
  • We collect and retain only the information each product needs to function

Data retention

We keep personal information only for as long as it is needed for the purpose it was collected, or as required by law — including the Health (Retention of Health Information) Regulations 1996 (New Zealand) where they apply. You may ask us to delete your account and associated data at any time, subject to those obligations.

Data breach notification

In the event of a privacy breach that is likely to cause serious harm, we will assess and contain the incident promptly and notify affected individuals and the relevant regulator without undue delay — the Office of the Privacy Commissioner (New Zealand) and/or the Office of the Australian Information Commissioner (Australia) — consistent with the notifiable privacy breach provisions of the Privacy Act 2020 and the Australian Notifiable Data Breaches scheme.

6. Health information

Clinical content you record in our products may constitute health information under the Health Information Privacy Code 2020 (New Zealand) and the Privacy Act 1988 (Cth) (Australia). We handle this information with the additional care required for sensitive information: it is used only for the purposes you specify, is not disclosed to third parties without your consent except as required by law, and is subject to the security controls described above.

As the clinician entering the data, you are also subject to your own professional and legal obligations regarding health information, including obligations under the Health Information Privacy Code and your professional body's standards.

7. Third-party services

We use trusted third-party providers to deliver our website and products. Each processes information only as needed to provide its service to us. Depending on the product, these may include:

Some of these providers may process data outside New Zealand and Australia subject to their own safeguards. We strongly advise you not to submit identifiable patient information to AI features.

8. Your rights

New Zealand (Privacy Act 2020)

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

  • Access the personal information we hold about you (Information Privacy Principle 6)
  • Correct inaccurate personal information (Information Privacy Principle 7)
  • Know why we collect information, how it will be used, and to whom it may be disclosed (IPP 3)
  • Complain to the Office of the Privacy Commissioner if you believe your privacy rights have been breached

Australia (Privacy Act 1988, Cth)

Under the Australian Privacy Principles, you have the right to:

  • Access the personal information we hold about you (APP 12)
  • Correct personal information that is inaccurate, out of date, incomplete, or misleading (APP 13)
  • Complain to the Office of the Australian Information Commissioner (OAIC) if you are dissatisfied with how we have handled your personal information
  • Anonymity — where lawful and practicable, you may interact with us anonymously or under a pseudonym

To exercise any of these rights, contact us at [email protected]. We will respond within 20 working days (New Zealand) or 30 days (Australia).

9. Cookies and tracking

This website sets no cookies. Our products use only functional cookies, such as those necessary to keep you signed in. We do not use advertising cookies, tracking pixels, or third-party analytics.

10. Children

Our products are intended for health professionals and are not directed at people under 18 years of age. We do not knowingly collect personal information from minors.

11. Changes to this policy

We may update this Privacy Policy from time to time. Where you have an account with one of our products, we will notify you by email or in-app notification before material changes take effect. The effective date at the top of this page shows when the policy was last updated.

12. Complaints

If you have a privacy concern, please contact us first at [email protected]. If you are not satisfied with our response:

  • New Zealand: Office of the Privacy Commissioner — privacy.org.nz — 0800 803 909
  • Australia: Office of the Australian Information Commissioner — oaic.gov.au — 1300 363 992

13. Contact our Privacy Officer

Privacy Officer
Operating Systems, Auckland, New Zealand
[email protected]