Privacy Policy

Working version · last updated October 12, 2026

This policy explains what information VetsApp collects, how we use it, and the choices you have. It is written to be read. Short summaries appear at the start of each section; the details below them are the binding text.

1. Scope

This policy covers the VetsApp website, applications, and services (the “Service”), operated in the United States. Health-data-specific disclosures required by certain states appear in our Health Data Privacy Notice, which is part of this policy.

Pet health records are not covered by HIPAA (the U.S. health-privacy law for human medical records — it does not extend to animals). We say this plainly because some services imply otherwise. Instead, this policy and the safeguards below are the protection your data gets — and we have designed them to meet the strictest applicable state standards.

2. What we collect

Your account details, your pet’s health information, the records you upload, and basic technical data. No advertising trackers.

• Account information: name, email address, phone number, login credentials (managed by our authentication provider).
• Pet profile and health information: your pet’s signalment (species, breed, age, sex), health history, symptoms and observations you describe, and the content of consultations with the Service.
• Uploaded records: documents, images, and files you upload (for example, vet records, lab reports, discharge notes), and the structured data our AI extracts from them.
• Information about you that you choose to share in a consultation. Some questions about your pet touch on your household or your own health (for example, asking whether a pet’s condition can spread to a person who is immunocompromised). Where you share information about your own health, we treat it as consumer health data under our Health Data Privacy Notice.
• Technical data: log data, device/browser type, IP address, and security telemetry needed to operate and protect the Service.
• Approximate location: your city, region or state, postal code, and time zone, derived automatically from your internet connection (IP address) by our infrastructure provider. This is coarse, connection-derived location — not GPS or precise device location. We use it for regionally relevant information (for example, location-appropriate guidance and cost context) and for security.
• What we do not collect: we do not use third-party advertising trackers, analytics pixels, or ad SDKs on the Service.

3. How we use information

To run the Service for you. Not for advertising. Not for sale.

We use your information to: provide the Service (including AI-assisted triage, record parsing, summaries, and the health record you maintain); present regionally relevant information using your approximate location (Section 2); secure accounts and prevent abuse; respond to support requests; comply with law; improve the reliability of the Service’s infrastructure (for example, error diagnosis); and review AI consultations for clinical quality and safety (below).

Clinical review. During our pilot, a licensed veterinarian reviews the Service’s AI consultations — the concern presented, the AI’s assessment and recommendations, and the clinical knowledge it drew on — to catch errors and make the Service’s reasoning more accurate for every pet. Review copies are keyed by internal identifiers and exclude your name, your contact details, and your pet’s name. They are handled in the engineering and quality-review tools listed in Section 5.

We do not use your information for third-party advertising, and we do not sell it (Section 5). Any future use of de-identified data for research would occur only under the separate, opt-in program described in Section 5 — never by default.

4. AI processing

AI reads what you write and upload, to do the work you asked for. The AI providers we use process it on our behalf and are contractually limited.

The Service uses large language models to conduct consultations, assess urgency, parse uploaded documents, and generate summaries. Your consultation content and uploaded records are processed by our AI infrastructure providers (currently Anthropic, OpenAI, and/or Google) as processors on our behalf, solely to provide the Service.

Information extracted by AI is marked with its origin in your pet’s record, so you and anyone you share with can see what was AI-parsed versus contributed by a person.

5. How information is shared

With the people you choose, and with the vendors that run the Service. Nobody else.

• At your direction. You control access grants to your pet’s record — to a veterinarian, a boarding facility, an emergency provider. We share what you direct, with whom you direct, for as long as you direct.
• Service providers (processors): cloud compute and storage (Cloudflare), database and authentication (Supabase), email delivery (Resend), AI providers (Section 4), engineering and quality-review tooling (GitHub, for the clinical-review copies described in Section 3), and — when paid features launch — a payment processor. Each processes data only to provide its service to us.
• Legal: we may disclose information if required by law, subpoena, or to protect the rights, safety, or property of users, the public, or VetsApp.
• Business transfers: if VetsApp is involved in a merger, acquisition, or asset sale, your information may be transferred subject to this policy’s commitments, with notice to you.

We do not sell your personal or pet health data. We do not share it with advertisers or data brokers. If we ever introduce an optional, de-identified research data program, it will be strictly opt-in, off by default, separately consented, honest about who receives the data, and declining will never affect your access to care.

6. Retention and deletion

We keep your pets’ records while you have an account, because a record is most useful when it’s complete. When you delete your account, they’re deleted too. We name the few things we keep below.

• Pet health records are kept while you have an account and deleted when you delete it.
• Derived copies created in processing your records (for example, AI-parsing working data) live under the same patient-scoped access controls as the original. Removing a pet, or taking a record off a pet, hides it but doesn’t delete it or its files. Both are deleted when you delete your account.
• Deleting your account. You can delete your account by emailing [email protected]. We delete your sign-in, your name, email and phone number, and every pet on your account, including pets you removed. That covers their records, uploaded files, consults and summaries, and what your veterinarians added to them. Any sharing you set up ends. Stored files are deleted within 24 hours.
• What we keep:
  • Comments or entries you added to other families’ pets stay in their records, because they’re part of that pet’s care. They’re no longer connected to your account, and your name on them is replaced with “a veterinarian (account closed)”, or “(account closed)” if you aren’t a veterinarian.
  • If your veterinary clinic uses VetsApp, the records it keeps about you and your pets belong to the clinic and aren’t deleted with your account. Contact the clinic about those.
  • A record that an account was deleted, and when, and our log of past activity reduced to the kind of action and its time. Neither is connected to anyone.
  • A monthly count of what was deleted, such as accounts, pets and records. It holds numbers only.
  • Backups and our service providers’ short-term logs, which clear on their own, most within 55 days. An AI provider may keep content it flags for misuse for up to 2 years.
  • Records you downloaded or sent to someone stay with you or with them. We can’t reach those copies.

7. Security

We encrypt data in transit (TLS) and at rest (AES-256), enforce role-based access controls and row-level security in our database, and maintain audit logs of access to clinical records. No system is perfectly secure, but security is designed in, not bolted on.

8. If a breach happens

If a security breach affects your unencrypted personal information, we will notify you without unreasonable delay, consistent with the strictest applicable state deadline, and will notify regulators where required. Our notice will tell you what happened, what data was involved, and what we are doing about it.

9. Your rights and choices

See your data, fix it, take it with you, delete it — wherever you live.

We extend the following rights to all users, regardless of state:

• Access / know what personal information we hold about you;
• Correct inaccurate personal information (clinical record corrections follow the annotate-and-dispute model in our Terms);
• Delete (Section 6);
• Portability — export your data in a usable format;
• Opt out of sale or sharing — we do not sell or share your data for advertising, so there is nothing to opt out of; we honor Global Privacy Control signals regardless;
• Non-discrimination — exercising your rights never affects your access to care or the quality of the Service.

To exercise any right: [email protected] or in-product settings. We will verify your identity before acting and respond within the timeframe required by your state (45 days or less in most states). If you email a request, we keep your email and our reply for 24 months as a record that we handled it, and then discard them.

10. State-specific disclosures

• California: the categories of personal information we collect, the purposes, and recipients are described in Sections 2–5. We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right-to-limit notice. A Notice at Collection is provided at signup.
• Washington, Nevada, Connecticut (consumer health data): see our standalone Health Data Privacy Notice.
• Other states: residents of states with comprehensive privacy laws have the rights in Section 9, which we extend to everyone.

11. Children

The Service is not directed to children and may not be used by anyone under 18. We do not knowingly collect personal information from children under 13; if we learn we have, we will delete it.

12. Changes to this policy

We may update this policy. Material changes will be notified to you (email or in-product) at least 30 days before taking effect, with a dated changelog. We will never apply a material reduction of these commitments retroactively to data collected under an earlier version without your consent.

13. Contact

[email protected]. A mailing address will be provided once our company is formed.