Privacy Policy

Last updated: October 31, 2026

1. Who is responsible

RC Capital Partners LLC, a company registered in the State of New Jersey, United States, 210 Westervelt Ave, North Plainfield, NJ 07060, United States ("we"), operates and maintains Durgical at durgical.app and is responsible for your personal data there. Contact: info@durgical.com. Durgical and its logo are used with permission of Durgical SAS, which does not receive your data from us.

2. What we collect, and nothing else

Account: your email; optionally a display name; your language. With Google sign-in, your Google email and name.
Teacher accounts: institution and role. Classes keep no student names.
Study content: notes, flashcards, study plans, exam date, quiz and review progress.
Your lecture PDFs (if you upload them): the file, its name, size, page count, a fingerprint (hash) of the file and the text your device extracts from it for search.
Images in your notes (if you add them): a reduced copy of each image, without metadata, a thumbnail and, if the photo records it, the day it was taken.
Links you share (if you create them): what you share, the link's code, whether it is still active and how many times a copy was saved.
AI questions (only if you turn AI on): the question, note or photo of your notes you send to Durgi or Estudiar, and the answer. They pass to the AI model to get the answer; we don't store their text or the photo.
AI usage log: time, feature, model, number of calls, and the size and cost of each call. It holds no text of your questions or answers.
Subscription (from Paddle): plan, status, renewal date, country, and Paddle customer and transaction IDs.
Usage and security: features used, counts and times, error logs, IP address, browser and device type.
Error reports: if you use "Report an error" in Estudiar (signed in) or "Spotted a mistake?" on durgical.com pages (no account): the page or card, the language and the text you write. Reports without an account keep no name, email or IP address; the IP is used for a moment to limit submissions. Don't type personal or patient data in the message.
Support: the messages you send us.

We do not collect your card details (Paddle handles them), audio (voice search is done by your browser: Google in Chrome, Apple in Safari; we only get the structure name), contacts, precise location or health data, and we don't store photos. Please don't write or photograph patient data or anyone's health information.

Durgi with your notes and photos

When you ask Durgi to tidy up or summarize a note, or to turn a photo of your notes into text, we send that text or photo to Anthropic, the provider of the Claude model, only to prepare the suggestion. The first time, we ask for your permission, and nothing is sent until you tap the button. Before sending text we remove emails, phone numbers and long numbers (such as ID or medical-record numbers); we can't do that in a photo, so please don't photograph patient data. We don't keep the photo or the text sent: we keep only the note you accept and a usage record with no content (date, feature, model, cost). Your note only changes if you accept the changes. Anthropic does not use this data to train its models and deletes it from its systems within 30 days, unless the law requires it to keep it or it must review it for possible misuse of its service. You can withdraw your permission in Account › Preferences › "Durgi reads your notes and photos".

Your lecture PDFs

PDFs you upload to the lecture panel are stored in a private Cloudflare R2 space that only you can see; they are not public and nobody else has access. In Supabase we keep only their details (name, size, page count and a fingerprint of the file) and the text your device extracts so you can search them. We use them to show them to you and to search them. If you ask Durgi about a PDF or a note, we send the text of that PDF or note to Anthropic, the provider of the Claude model, only to prepare the answer; Anthropic does not use this data to train its models and deletes it from its systems within 30 days, unless the law requires it to keep it or it must review it for possible misuse of its service. We never use your PDFs to train AI models and never share them with anyone. If you delete a PDF, it goes to the Trash and is permanently erased after 30 days; if you delete your account, all are erased. Storage is 2 GB on the free plan and 40 GB on Plus. Downloading your data gives you a list of your PDFs (including those in the Trash) with download links for each PDF and its text, valid for 7 days; downloading your data again gives you new links. Only upload material you have the right to use, such as your own class material, and don't upload documents with patient data.

Images in your notes

If you add photos, screenshots or diagrams to a note, your device shrinks them (up to 2400 px) and re-encodes them before uploading: this removes all their metadata, including GPS location, and we never upload the original file. Of that data we keep only the date the photo was taken (the day, without the time), separately from the image, to show it under the image; screenshots and photos without a date have none. A thumbnail is also made. Both are stored in the same private Cloudflare R2 space as your PDFs, which only you can see (except in what you share by link, as explained below), and count toward the same plan storage (2 GB on the free plan, 40 GB on Plus). If you use Durgical without an account, images stay on your device only. Durgi doesn't see your images: when you ask it about a note, we send only its text (with each image's caption), never the image; the only photo that reaches Durgi is the one you send with "Photo of notes". If you delete an image, or the note that contains it, it goes to the Trash and is permanently erased after 30 days; if you delete your account, all are erased. Downloading your data gives you a list of your images, with the note each one belongs to, its date and download links valid for 7 days. Don't upload photos of patients or images with other people's health data.

You can share a note, a notebook, an Estudiar deck or a template with a link. Anyone with the link can view it without an account and can't edit it. They see only that content (the title and the text; for a deck, its cards), without your Durgi requests and without knowing who shared it. Before showing it, we hide emails and long numbers, such as phone or ID numbers. If the note or notebook has images, anyone with the link sees the note's images and their captions, through temporary links, but not the date they were taken; only those the page still includes. You can revoke the link at any time; if you revoke it or send the note to the Trash, it can no longer be seen, and if you take an image out of the page, that image can no longer be seen. Whoever receives it can keep a copy ("Save a copy", with an account; for a deck, "Add to my cards"): that copy is theirs and doesn't change if you later edit the original or revoke the link. The saved copy includes the text and the images the link shows: those images are copied into the saver's own storage and count toward their plan; if they don't fit, the text is saved and the image is marked as not copied. Your original images don't change. Share only with people you choose, and never share patient data.

3. Why we use it

To give you access and run your account (to perform our contract with you).
To save, sync and export your notes and study progress (contract).
To run the AI study features you turned on (your consent; you can withdraw it in Settings).
To sell and manage your subscription with Paddle: plan status, the free-plan limits, renewal reminders and refunds (contract; legal duties for tax and accounting records).
To keep the service secure and working: usage limits, abuse prevention, fixing errors (legitimate interest).
To improve Durgical using aggregated usage counts (legitimate interest).

We send only service emails (sign-in codes, receipts, renewal reminders, important changes). We do not sell your personal data, do not share it for cross-context behavioral advertising, show no ads, and use no advertising or analytics trackers. We make no automated decisions with legal or similarly significant effects on you.

4. Who processes it for us

Supabase (United States, Virginia): accounts, notes and study data.
Cloudflare (global network, United States): hosting, security, usage counts and, in R2, your lecture PDFs and the images in your notes.
Resend (United States): sign-in codes and service emails.
Google (United States): "Sign in with Google", only if you use it.
Anthropic (United States): the AI model for Durgi and Estudiar (questions, notes, photos of notes and lecture PDFs), only when you ask. Under its commercial terms it does not train its models on this data and deletes it within 30 days, unless the law requires otherwise or it reviews it for misuse.
Paddle (United Kingdom and United States): our reseller and Merchant of Record, for checkout, payments, tax, invoices and refunds. Paddle collects your payment and billing details as an independent controller under Paddle's privacy notice and shares with us only what we need to run your plan.

Our providers act under contracts that limit their use of your data.

5. International transfers

We are a US company and our providers store data mainly in the United States. If you live in Colombia, Mexico, Peru, Chile, Argentina or elsewhere, your data is transferred to the United States, with safeguards: encryption in transit and at rest, per-user access rules, and contracts with each provider. By accepting this policy you authorize this transfer where the law requires your authorization.

6. How long we keep it

Account, notes and study data: until you delete them or your account. Deleted notes are purged after 30 days.
Questions, notes and photos sent to the AI: we don't store their text or the photo. The AI usage log keeps only metadata, for up to 24 months.
Lecture PDFs, their extracted text and the images in your notes: while you keep them; deleted ones are erased after 30 days; all of them with your account.
Usage and security logs: up to 24 months, then deleted or made anonymous.
Error reports: 12 months after they are fixed or dismissed, and in any case after 24 months. Reports you sent while signed in are also deleted with your account.
Subscription and invoice records: as long as tax and accounting law requires.
After you delete your account: removed within 30 days, except what the law requires us to keep.

7. Your rights

Wherever you live, you can:

see and download your data (My account);
correct it;
delete it, or delete your whole account (My account);
withdraw consent (for example, turn AI off in Settings);
object to uses based on our legitimate interest;
write to us at info@durgical.com. We answer free of charge, after confirming it's you, within the time your law sets and in any case within 15 business days.

Colombia (Law 1581 of 2012 and Decree 1074 of 2015): you can know, update, rectify and delete your data, ask for proof of your authorization, be told how your data is used, revoke your authorization, and complain to the Superintendencia de Industria y Comercio (SIC) after first contacting us. We answer queries within 10 business days and claims within 15.

Mexico (Federal Law on Protection of Personal Data Held by Private Parties, 2025): you have ARCO rights (access, rectification, cancellation, opposition) and can limit the use or disclosure of your data. Send your request to info@durgical.com; we reply within 20 business days.

Peru (Law 29733 and its regulation): access, rectification, cancellation and opposition; you can complain to the Autoridad Nacional de Protección de Datos Personales.

Chile (Law 19.628, as amended by Law 21.719): access, rectification, deletion, opposition and portability; you can complain to the competent data protection authority.

Argentina (Law 25.326): the data owner may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown (Law 25.326, art. 14, para. 3). The Agencia de Acceso a la Información Pública, as the supervisory authority of Law 25.326, handles complaints from anyone whose rights are affected by breaches of the personal data rules.

United States (California and other state privacy laws): you can know what we collect and why, access, correct and delete it, and opt out of "sale" or "sharing" (we do neither, and we honor Global Privacy Control signals). We do not use sensitive personal information to infer characteristics about you, and we won't treat you differently for using your rights. An authorized agent may ask on your behalf with proof of authorization. In the last 12 months we collected identifiers, commercial information (subscription), internet activity (usage) and the content you create, from the sources and for the purposes above, and disclosed them only to the providers in section 4.

8. Age

Durgical is for people 16 and older. Users under 18 need a parent's or guardian's permission. We don't knowingly collect data from children under 16; if we learn we did, we delete it.

9. Security

Encryption in transit and at rest, per-user access rules so only you can read your notes, limited staff access, and usage limits against abuse. If a breach affects you, we will tell you and the authorities as the law requires.

10. Cookies and local storage

No advertising or analytics cookies. The app stores your settings, your session and an offline copy of your notes in your browser. See Cookies.

11. Changes

We will email you and show a notice in the app before important changes take effect.

12. Contact

info@durgical.com · RC Capital Partners LLC, 210 Westervelt Ave, North Plainfield, NJ 07060, United States

Durgical and its logo are used with permission of Durgical SAS.