Skip to main content
Request a Quote
  • Home
  • Privacy Policy
Surgivalley

Privacy Policy

Privacy Policy

SurgiValley Pvt Ltd ("SurgiValley", "we", "us", "our") is committed to protecting your privacy and safeguarding your personal information. This Privacy Policy comprehensively describes how we collect, use, store, protect, and disclose data across our global websites (surgivalley.com and surgivalley.co) and our social media publishing and management application (Twee Postiz / SurgiValley Social, accessible at mypostiz.surgivalley.co). Effective date: 20 October 2026.

1. Who We Are and What This Policy Covers

SurgiValley Pvt Ltd operates surgivalley.com and surgivalley.co as premier B2B platforms for surgical, dental, and medical instruments, and operates an internal and authorized social media management application, Twee Postiz (powered by Postiz and hosted at mypostiz.surgivalley.co). Twee Postiz is used to manage, schedule, and publish video and multimedia content to authorized social channels, including YouTube, Facebook, Instagram, Threads, and LinkedIn.

Data Controller Contact:
SurgiValley Pvt Ltd, 143C Small Industrial State, Sialkot 51360, Pakistan
Email: [email protected] · [email protected] · Support: [email protected]
Telephone: +92 322 2800090 / +92 52 3556777

2. Information We Collect

Depending on how you interact with our websites and applications, we collect:

  • Commercial & Quotation Enquiries: Contact and company details (name, business email, phone number, physical address, company name), surgical instrument specifications, quantities, attached inquiry drawings, and quotation communications.
  • Account & Security Records: Login credentials, order history, language preferences, consent choices, and diagnostic logs (IP address, browser type, timestamps).
  • Social Publishing Tool (Twee Postiz): When connecting social media accounts, we receive platform user IDs, username, channel identifiers, post text, video files, images, scheduling metadata, and official platform analytics (views, impressions, reach).
  • Google User Data & YouTube API Data: When connecting a Google account or YouTube channel to Twee Postiz, we access authorized scopes:
    • Basic Profile & Identity (openid, .../auth/userinfo.email, .../auth/userinfo.profile): User Google account ID, primary email address, and profile name/avatar.
    • YouTube Uploads & Channel Management (.../auth/youtube.upload): Channel title, channel ID, and permissions to upload, schedule, manage metadata (titles, descriptions, tags, thumbnail images, category, privacy status), and publish video content directly to the connected YouTube channel.
    • YouTube Downloads & Verification (.../auth/youtube.download): Video metadata and download links for user-uploaded videos to verify upload integrity.
    • Google Business Profile (.../auth/business.manage): Business listing details where connected.
    • Sensitive Authentication Data: Secure OAuth 2.0 access and refresh tokens.

3. How We Use Google User Data

Google user data is accessed and used strictly and exclusively to deliver user-facing features within Twee Postiz, specifically:

  • To authenticate and connect your designated YouTube channel to your Postiz publishing dashboard.
  • To upload, schedule, and publish video content and metadata directly to your YouTube channel via the official YouTube Data API v3.
  • To provide upload confirmation, status monitoring, and publishing logs within the user interface.

Strict Prohibitions on Google User Data:

  • We do NOT sell, transfer, or disclose Google user data to data brokers, advertising networks, or third-party resellers.
  • We do NOT use Google user data for advertising, including targeted, personalized, or retargeted ads.
  • We do NOT use Google user data for creditworthiness or lending evaluations.
  • We do NOT use Google user data to develop, train, or improve generalized or non-personalized artificial intelligence (AI) and/or machine learning (ML) models.

4. Data Sharing and Transfers

We do not share, sell, or disclose Google user data to any external parties. Data is transferred only:

  • Directly to Google servers via official YouTube Data API v3 endpoints to execute your requested video uploads.
  • To our dedicated, secure self-hosted infrastructure operated directly by SurgiValley Pvt Ltd.
  • Where required by law, court order, or regulatory authorities pursuant to valid legal obligations.

5. Data Protection Mechanisms for Sensitive Data

We enforce rigorous technical, administrative, and physical security mechanisms to protect sensitive data (including OAuth tokens, credentials, and user data):

  • Encryption in Transit: All communications between user browsers, our self-hosted application (mypostiz.surgivalley.co), and Google API endpoints are encrypted with modern Transport Layer Security (TLS 1.2 and TLS 1.3). HTTPS is enforced across all domains with HSTS enabled; unencrypted HTTP connections are rejected.
  • Encryption at Rest: All sensitive data—specifically OAuth 2.0 access tokens, refresh tokens, client secrets, and authentication keys—is encrypted at rest using industry-standard AES-256 (Advanced Encryption Standard with 256-bit keys) encryption algorithms before storage in our persistent database.
  • Access Control & Principle of Least Privilege: Access to servers, databases, and encryption keys is strictly confined to authorized system administrators under role-based access control (RBAC), multi-factor authentication (MFA), and SSH key authentication with IP whitelisting. No third parties have access to credentials.
  • Token Isolation & Zero Plaintext Exposure: OAuth tokens are isolated in secure database partitions and environment variables. Tokens are never exposed in client-side code, URLs, browser storage, or plaintext application logs.
  • System Hardening & Vulnerability Management: Our self-hosted deployment runs inside isolated Docker containers on hardened Linux servers with active firewalls, automated security updates, rate-limiting, and continuous monitoring to prevent unauthorized intrusion or data exfiltration.

6. Data Retention and Deletion

Retention Period: Google user data, channel metadata, and OAuth tokens are retained only for as long as your account remains connected to Twee Postiz, or as necessary to provide scheduled publishing services.

Account Disconnection & Immediate Token Purge: You may disconnect your YouTube channel at any time in Twee Postiz (Settings → Social Accounts → Disconnect). Disconnecting immediately and permanently deletes stored OAuth access and refresh tokens from our database.

Revocation via Google Security Settings: You can independently revoke access at any time through Google's Security Settings page at https://myaccount.google.com/permissions.

Deletion Requests: You may request complete deletion of any stored personal data or upload logs by emailing [email protected] or [email protected]. All verified requests are permanently completed within 30 days.

7. Google API Limited Use Policy Disclosure

Twee Postiz's and SurgiValley's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. YouTube Terms of Service Compliance

Twee Postiz uses YouTube API Services. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy.

9. Meta Platforms (Facebook, Instagram, Threads) Compliance

Meta platform data is used strictly to operate publishing and analytics for connected accounts; it is never sold, transferred to brokers, or combined with external datasets.

10. Your Rights

Depending on applicable law, you have rights to access, correct, delete, restrict, or port your personal data. Contact us at [email protected] to exercise your rights.