Surely is end-to-end encrypted, and designed to handle personally identifiable health information in accordance with New Zealand law. Patients are in control of their own health records throughout, and Surely does not retain that data once a request has been fulfilled.
Surely operates in accordance with all applicable New Zealand health information legislation and international security standards:
Surely connects to Practice Management Systems via a standards-based, authenticated Fast Healthcare Interoperability Resources (FHIR) integration. Practice credentials are never stored by Surely. No data beyond what is covered in the consented authorisation is accessed.
Surely does not retain health record data. Once a request has been fulfilled and delivery is confirmed, access is revoked and the data is automatically and permanently deleted from the system. Audit logs are maintained separately and retained for compliance purposes.
If you discover a security vulnerability in Surely's platform, please report it responsibly to hello@surely.nz. We will acknowledge receipt within 48 hours and work to resolve confirmed vulnerabilities promptly.
For security enquiries, contact us at hello@surely.nz.