Privacy Policy

The data controller is Journal of Plastic, Breast & Reconstructive Surgery (JPBRS). For any privacy question or to exercise your rights, contact us at [email protected].

• Account & profile data: name, email address, password (stored only as a salted hash), and optionally your title, specialty, institution, country, ORCID and biography.
• Authentication data: if you sign in with Plast ID or another single sign-on provider, we receive your identifier and basic profile from that provider.
• Submission & review content: the case reports, comments, reviews and scores you create, and records of your activity in the editorial workflow.
• Clinical case material: case text and images you upload. This may include clinical/medical content — see our Patient Privacy & Consent policy.
• Payment data: if you buy peer-review publication tokens, payments are processed by Stripe. We do not store your full card details.
• Technical data: limited log and security data needed to operate the service. See our Cookie Policy.

• To provide the service (accounts, submission, peer review, publication) — performance of a contract.
• To process payments for peer-review publication tokens — performance of a contract.
• To communicate about submissions, reviews and account matters — legitimate interests / contract.
• To keep the platform secure and prevent abuse — legitimate interests.
• To meet legal and publishing-ethics obligations — legal obligation / public interest.

Where we publish your name and affiliation as an author, we rely on the contractual relationship and the legitimate interest of scholarly attribution.

We never sell your personal data. We share it only with service providers who process it on our behalf under contract:

• Hosting and database infrastructure (EU-based).
• Object storage for uploaded media (Hetzner, EU).
• Email delivery (Resend).
• Payment processing (Stripe).

Published cases (including author names, affiliations and case content) are, by design, publicly available open-access content.

We aim to keep personal data within the EU/EEA. Where a processor transfers data outside the EEA, that transfer is protected by an adequacy decision or the European Commission’s Standard Contractual Clauses.

We keep account and profile data for as long as your account is active. Published scholarly content forms part of the permanent scientific record and is normally retained indefinitely. Other data is kept only as long as needed for the purposes above or as required by law, then deleted or anonymised.

Subject to legal limits, you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and to withdraw consent at any time.

To exercise any right, email [email protected]. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

We use appropriate technical and organisational measures — including encryption in transit, hashed passwords, access controls and removal of image metadata (EXIF) on upload — to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of any breach as required by law.

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above, and where appropriate we will notify you.