Privacy Policy

Working version · last updated June 20, 2026

This policy explains what information VetsApp collects, how we use it, and the choices you have. It is written to be read. Short summaries appear at the start of each section; the details below them are the binding text.

1. Scope

This policy covers the VetsApp website, applications, and services (the "Service"), operated in the United States. Health-data-specific disclosures required by certain states appear in our Health Data Privacy Notice, which is part of this policy.

Pet health records are not covered by HIPAA (the U.S. health-privacy law for human medical records — it does not extend to animals). We say this plainly because some services imply otherwise. Instead, this policy and the safeguards below are the protection your data gets — and we have designed them to meet the strictest applicable state standards.

2. What we collect

Your account details, your pet’s health information, the records you upload, and basic technical data. No advertising trackers.

• Account information: name, email address, phone number, login credentials (managed by our authentication provider).
• Pet profile and health information: your pet’s signalment (species, breed, age, sex), health history, symptoms and observations you describe, and the content of consultations with the Service.
• Uploaded records: documents, images, and files you upload (for example, vet records, lab reports, discharge notes), and the structured data our AI extracts from them.
• Information about you that you choose to share in a consultation. Some questions about your pet touch on your household or your own health (for example, asking whether a pet’s condition can spread to a person who is immunocompromised). Where you share information about your own health, we treat it as consumer health data under our Health Data Privacy Notice.
• Technical data: log data, device/browser type, IP address, and security telemetry needed to operate and protect the Service.
• Approximate location: your city, region or state, postal code, and time zone, derived automatically from your internet connection (IP address) by our infrastructure provider. This is coarse, connection-derived location — not GPS or precise device location. We use it for regionally relevant information (for example, location-appropriate guidance and cost context) and for security.
• What we do not collect: we do not use third-party advertising trackers, analytics pixels, or ad SDKs on the Service.

3. How we use information

To run the Service for you. Not for advertising. Not for sale.

We use your information to: provide the Service (including AI-assisted triage, record parsing, summaries, and the health record you maintain); present regionally relevant information using your approximate location (Section 2); secure accounts and prevent abuse; respond to support requests; comply with law; and improve the reliability of the Service’s infrastructure (for example, error diagnosis).

We do not use your information for third-party advertising, and we do not sell it (Section 5). Any future use of de-identified data for research would occur only under the separate, opt-in program described in Section 5 — never by default.

4. AI processing

AI reads what you write and upload, to do the work you asked for. The AI providers we use process it on our behalf and are contractually limited.

The Service uses large language models to conduct consultations, assess urgency, parse uploaded documents, and generate summaries. Your consultation content and uploaded records are processed by our AI infrastructure providers (currently Anthropic, OpenAI, and/or Google, routed through Cloudflare’s AI gateway) as processors on our behalf, solely to provide the Service.

Information extracted by AI is marked with its origin in your pet’s record, so you and anyone you share with can see what was AI-parsed versus contributed by a person.

5. How information is shared

With the people you choose, and with the vendors that run the Service. Nobody else.

• At your direction. You control access grants to your pet’s record — to a veterinarian, a boarding facility, an emergency provider. We share what you direct, with whom you direct, for as long as you direct.
• Service providers (processors): cloud compute and storage (Cloudflare), database and authentication (Supabase), AI providers (Section 4), and — when paid features launch — a payment processor. Each processes data only to provide its service to us.
• Legal: we may disclose information if required by law, subpoena, or to protect the rights, safety, or property of users, the public, or VetsApp.
• Business transfers: if VetsApp is involved in a merger, acquisition, or asset sale, your information may be transferred subject to this policy’s commitments, with notice to you.

We do not sell your personal or pet health data. We do not share it with advertisers or data brokers. If we ever introduce an optional, de-identified research data program, it will be strictly opt-in, off by default, separately consented, honest about who receives the data, and declining will never affect your access to care.

6. Retention and deletion

Clinical records are kept long-term because that’s what makes them medically useful; you can delete your account and data, with narrow legal exceptions we name.

• Pet health records are retained by default for as long as your account is active, and otherwise consistent with veterinary record-retention standards (up to 7 years, matching the strictest U.S. state requirements for veterinary records). A longitudinal record is the product — its value to your pet’s care depends on persistence.
• Derived copies created in processing your records (for example, AI-parsing working data) live under the same patient-scoped access controls as the original. When you ask us to delete a record, we delete the record on request; cleanup of its derived copies is currently performed manually, and an automated sweep is in progress.
• Exported copies are outside our reach. If you have exported a record (for example as a .kip file) and hold the copy outside VetsApp, deletion within the Service cannot reach it. To remove an exported copy, delete the file you hold yourself.
• Deletion: you may delete individual content you contributed, or your entire account. We honor deletion requests subject to narrow exceptions we will state at the time (for example, data we must retain for legal compliance, security, or fraud prevention, and content already shared with a third party at your direction). Contributed clinical content from professionals follows the record-integrity rules in our Terms (you can annotate and dispute; the entry persists in the record while the record exists).
• Account data (name, email) is deleted with your account, subject to the same narrow exceptions.

7. Security

We encrypt data in transit (TLS) and at rest (AES-256), enforce role-based access controls and row-level security in our database, and maintain audit logs of access to clinical records. No system is perfectly secure, but security is designed in, not bolted on.

8. If a breach happens

If a security breach affects your unencrypted personal information, we will notify you without unreasonable delay, consistent with the strictest applicable state deadline, and will notify regulators where required. Our notice will tell you what happened, what data was involved, and what we are doing about it.

9. Your rights and choices

See your data, fix it, take it with you, delete it — wherever you live.

We extend the following rights to all users, regardless of state:

• Access / know what personal information we hold about you;
• Correct inaccurate personal information (clinical record corrections follow the annotate-and-dispute model in our Terms);
• Delete (Section 6);
• Portability — export your data in a usable format;
• Opt out of sale or sharing — we do not sell or share your data for advertising, so there is nothing to opt out of; we honor Global Privacy Control signals regardless;
• Non-discrimination — exercising your rights never affects your access to care or the quality of the Service.

To exercise any right: [email protected] or in-product settings. We will verify your identity before acting and respond within the timeframe required by your state (45 days or less in most states).

10. State-specific disclosures

• California: the categories of personal information we collect, the purposes, and recipients are described in Sections 2–5. We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right-to-limit notice. A Notice at Collection is provided at signup.
• Washington, Nevada, Connecticut (consumer health data): see our standalone Health Data Privacy Notice.
• Other states: residents of states with comprehensive privacy laws have the rights in Section 9, which we extend to everyone.

11. Children

The Service is not directed to children and may not be used by anyone under 18. We do not knowingly collect personal information from children under 13; if we learn we have, we will delete it.

12. Changes to this policy

We may update this policy. Material changes will be notified to you (email or in-product) at least 30 days before taking effect, with a dated changelog. We will never apply a material reduction of these commitments retroactively to data collected under an earlier version without your consent.

13. Contact

[email protected]. A mailing address will be provided once our company is formed.