Security & legal
Your clinic's data. In your clinic's control.
Vetaura is built for veterinarians who take patient records seriously. Encrypted end-to-end, siloed by clinic, audit-logged and exportable — with a vet-in-the-loop on every AI draft.
Data encryption, everywhere
AES-256 at rest for every note, transcript and lab. TLS 1.3 in transit. Encrypted database backups every 6 hours, retained for 30 days.
Tenant isolation — your clinic, your silo
Every record is scoped by clinic_id at the query layer, not just the UI. Two clinics on the same infrastructure can never see each other's data. Multi-site plan available with a dedicated tenant.
You control access
Enforce your own MFA policy via Google Workspace SSO. Session tokens expire in 7 days. Instant staff revocation. Optional IP allow-list on Multi-site plan.
Audit log — clinician-signed, timestamped
Every AI draft, every signature, every share, every export, every message approval logged with user, action, target and metadata. Immutable append-only.
No training on your data
Your transcripts, notes and messages are NEVER used to train the underlying AI models. Anthropic and OpenAI enterprise APIs run with zero-retention policies where available.
You own it. Export or delete any time.
One-click CSV export of patients and signed notes. Written deletion request honored within 30 days. Backups purged within 60 days of deletion.
Your infrastructure · your rules
Runs inside your world — behind your firewall, your MFA, your policies.
Every Vetaura clinic gets its own isolated tenant. Multi-site plans can request a dedicated single-tenant deploy inside a VPC — your DNS, your IAM, your KMS keys, your backup retention. You bring the security perimeter; we plug into it.
- TLS 1.3 in transit · AES-256 at rest
- Role-based access (owner / vet / tech / front-desk)
- Immutable audit log · exportable
- Session-token expiry with instant revocation
- Automated encrypted backups every 6 hours (30-day retention)
- Vulnerability scanning · dependency alerting · patching SLA
- Breach notification within 72 hours of confirmed incident
- Optional dedicated tenant + VPC deploy (Multi-site plan)
Data flow
1
Clinician records or types
Audio never touches disk. Streams direct to transcription.
2
Whisper → text (discarded)
Audio dropped once transcription is returned. Only text is stored, and only if you save the note.
3
Claude drafts SOAP
Draft is displayed in-browser. Zero-retention where the API supports it. Never used for training.
4
Clinician reviews & signs
Nothing enters the record until a licensed clinician signs. Signature + timestamp logged immutably.
5
Optional share
Owner portal link generated only if you click share. Owner sees no other patient's data.
Legal channels & frameworks
Every jurisdiction, addressed.
Veterinary practice framework
Vetaura is built as a documentation and workflow tool — it never issues a diagnosis, prescription or treatment plan on its own. Every clinical output is a draft the licensed veterinarian reviews and signs. This preserves the Veterinarian-Client-Patient Relationship (VCPR) required in every US state and equivalent frameworks in Canada, UK and EU.
AVMA Model Veterinary Practice Act · VCPR
State medical record retention
State laws require veterinary medical records to be retained 3–7 years after last patient visit. Vetaura retains signed notes indefinitely with 30-day rolling backups; you can export CSV at any time and delete on written request.
State-by-state VMR laws
GDPR & UK GDPR (EU / UK clinics)
For EU/UK clinics, Vetaura acts as a data processor under Art. 28. We provide a Data Processing Addendum (DPA), Standard Contractual Clauses (SCCs) for transfers, and a Record of Processing Activities (RoPA). Owner data may be handled under legitimate-interest or consent basis at the clinic's choice.
GDPR Art. 28 · UK GDPR
CCPA / CPRA (California)
California owners can request access, deletion or portability of their data. Vetaura provides tooling and honors requests within 45 days.
Cal. Civ. Code §1798.100
HIPAA context
Veterinary records are not covered by HIPAA (HIPAA applies to human protected health information). However, we voluntarily follow HIPAA-equivalent controls: audit logs, encryption at rest and in transit, least-privilege access and breach notification within 72 hours.
HIPAA · voluntary parity
AI transparency & AVMA guidance
Following AVMA guidance on AI in veterinary medicine (2024–2025), Vetaura discloses model provenance (Claude Opus 5.5, OpenAI Whisper), shows confidence and flags on every draft, keeps source transcripts for verification and requires clinician sign-off before anything enters the record.
AVMA AI in Veterinary Medicine guidance
Owner consent language
Vetaura provides a ready-to-adopt owner consent snippet you can add to intake paperwork disclosing that AI is used to assist documentation and communication — with clinician review — as recommended when AI materially contributes to clinical decision-making.
Recommended AVMA reporting practice