Privacy Policy
1. What we collect
Clinic account info (name, email, role), authentication data (hashed password or Google OAuth identifier), and clinical operational data your clinic chooses to enter (owner + patient records, appointment notes, transcripts, signed SOAP notes, discharge instructions, client messages, audit events, billing metadata). We do not collect pet-owner data directly — the clinic controls what owner information is entered.
2. How we use it
Solely to provide and operate the Vetaura service you signed up for: authentication, storing your clinical records, generating AI drafts on your behalf, processing subscription billing via Stripe, and logging activity in your audit trail.
3. Sub-processors
We use trusted sub-processors under strict data-processing agreements: Anthropic (Claude Opus 5.5 for clinical drafting), OpenAI (Whisper for audio transcription), Stripe (subscription billing), and our cloud infrastructure provider. A current list is available on request. All are contractually prohibited from using your data for training or resale.
4. AI model training
Your data is NEVER used to train the underlying AI models. Anthropic and OpenAI enterprise API endpoints run with zero-retention policies where available. Any transient copy held for the duration of a single request is discarded when the request completes.
5. Encryption & security
AES-256 at rest, TLS 1.3 in transit. Session tokens are HTTP-only, Secure, SameSite=None cookies with 7-day expiry. Audio recorded in the browser is streamed straight to transcription and never written to durable storage. Backups are encrypted and retained for 30 days.
6. Data location & transfers
By default, data is stored in the US. EU/UK clinics may request a EU-resident deployment. For international transfers we rely on Standard Contractual Clauses (SCCs). A Data Processing Addendum (DPA) is available on request.
7. Retention & deletion
Signed veterinary records are retained indefinitely unless you delete them, matching state/provincial veterinary medical record retention requirements. On written deletion request, we delete your clinic's records within 30 days from active systems and within 60 days from encrypted backups.
8. Your rights
You have the right to access, correct, export or delete your data at any time. EU/UK residents additionally have GDPR/UK-GDPR rights (data portability, objection to processing, complaint to a supervisory authority). California residents have CCPA/CPRA rights. Contact privacy@vetaura.ai to exercise any right.
9. Cookies
We use strictly necessary cookies (session token). We do not use advertising or cross-site tracking cookies.
10. Children
Vetaura is not intended for use by children under 16. We do not knowingly collect data from children.
11. Contact
Privacy inquiries: privacy@vetaura.ai · Security incidents: security@vetaura.ai · Data requests: honored within 30 days (45 for CCPA).