Privacy Policy
Last updated: 16 August 2026
VetDoze holds two very different kinds of information: the account details of the veterinary professionals who use it, and the clinical content they create about their patients. This policy explains how each is handled, what kind of company processes each part of it, and exactly what you can ask us to delete.
The short version
- Your clinical content belongs to you. You decide what goes in, and you can delete any recording, document, or record at any time.
- Your database records are stored in the European Union (Frankfurt), not the United States.
- We do not sell your data, we do not run advertising, and we do not train any model of our own on your consults or patient records.
- Consult audio is sent to specialist speech to text and language model providers so a note can be drafted, then stored until you delete it. We do not delete it automatically.
- You can delete anything you have added. If you want everything we hold wiped, including stored files, email us and we will do it.
- Telling the pet owner that the consultation is being recorded is your responsibility, not ours.
1. Who we are, and who this policy is for
VetDoze is a veterinary clinical workspace covering documentation, verified dose and fluid calculation, and patient records. It is operated from Seattle, Washington, United States. This policy covers www.vetdoze.com and the VetDoze application, and you can reach us at sina@vetdoze.com about anything in it.
Three groups of people appear in VetDoze data, and their positions differ:
- Veterinary professionals and clinic staff who hold an account. For your account, billing, and usage data we are the data controller.
- Animal owners (your clients) whose contact details and animals you record. For that content you are the controller and we act as your processor: we store and process it on your instructions and do not use it for our own purposes.
- Visitors to the public website, who are covered by the analytics and cookie sections below.
In a clinic account, the clinic owner is the controller for everything the clinic creates, and every member of that clinic can see it.
2. The data we hold
| Category | What it contains | Where it comes from |
|---|---|---|
| Account and identity | Name, email address, sign-in identity, language preference, account creation date. | You, through our authentication provider. |
| Subscription and usage | Plan, trial start and end dates, renewal state, consult balance, counts of calculations and AI requests, payment provider customer and subscription identifiers. For Iranian customers, the manual transfer record we approve. | Created by the product as you use it, and by the payment provider. |
| Clinic and team | Clinic name, seat count, member roles (owner, doctor, receptionist, laboratory), invite email addresses, joining dates, and per-member activity totals shown to the owner. | The clinic owner and the members who join. |
| Client (animal owner) records | Name, phone number, and optionally email address, postal address, and free-text notes. | Entered by you. |
| Patient records | Animal name, species, breed, sex, date or year of birth, weight history, photo, notes, medical records, diagnoses, treatments, medication, follow-up dates. | Entered by you, or drafted by the scribe from your consultation and then reviewed by you. |
| Consult content | Audio recordings, transcripts with timings, SOAP notes, chief complaint, dose and fluid calculations with their inputs and results, prescriptions, discharge summaries, note templates, and referral links you create. | Recorded, uploaded, or typed by you. |
| Uploaded documents | Lab results and other files, their extracted text, and the structured summary generated from them. | Uploaded by you. |
| AI request logs | The prompt sent and the response received for AI features, kept so a result shown to you stays traceable. These can contain clinical text. | Generated automatically when you use an AI feature. |
| Product analytics and diagnostics | Pages viewed, features used, button interactions, device and browser type, approximate location inferred from IP address, and error reports with stack traces. | Collected automatically. See section 11. |
| Communications | Contact form submissions (name, email, optional phone, message) and any email you send us. | You. |
| Push notifications | Browser push endpoint, its encryption keys, and the user agent string, only if you enable notifications. | Your browser, when you grant permission. |
We never see or store full card numbers. Card payments are handled entirely by our payment provider.
3. Audio recordings and the AI scribe
This is the part of VetDoze that touches the most sensitive material, so here is the whole path a consultation takes.
- You record in the browser or upload an audio file (up to 25 MB). The file is stored as an object with our object storage provider and linked to the consult.
- For live transcription, audio streams to a speech to text provider and text comes back as you speak. For a recording processed after the fact, the stored audio file is sent to a speech to text provider for transcription.
- The transcript is sent to a language model provider, which returns a structured draft note in your language.
- The model names drugs and routes. It never writes a dose number: every dose and fluid rate is computed by our own deterministic engine from a verified formulary, using the species and weight you supply.
- The draft note is stored on the consult. Nothing reaches a patient record until you review it and finalise it.
Recording consent is your responsibility
Before you record a consultation, tell the animal owner that it is being recorded and why, and give them a real opportunity to decline. Depending on where you practise, recording someone without telling them may be unlawful.
We provide the recording tool. We cannot obtain that consent for you, and we do not verify that you have it.
On training: we do not use your recordings, transcripts, notes, or patient records to train any model of our own, and we do not sell or license them to anyone for training. We do look at aggregate, de-identified usage statistics, such as how often a feature is used or how long a step takes, and those never contain clinical content. Transcription and note drafting are performed by the third-party providers described in section 5, which process the content under their own API terms in order to return a result to us. Those terms differ between providers and can change, so rather than making a blanket promise on their behalf, we will tell you exactly which companies are involved if you ask: write to sina@vetdoze.com and we will send you the current list so you can read their terms yourself. If your clinic needs a written commitment covering the whole chain, contact us at the same address.
Recordings are kept so that you can play a consultation back later. We do not delete them on a schedule. Deleting a recording deletes the stored audio file with it. Deleting a consult also deletes any recording or document that was never attached to a patient, because those belong to the draft; anything already attached to a patient stays with that patient's history until you delete it there.
If you want a patient, a client, or an account wiped in full, including every stored file, email sina@vetdoze.com and we will do it. That is the route to a complete erasure, and section 9 explains how it works.
4. Why we process it, and our legal basis
Where the UK GDPR or EU GDPR applies to our processing of your account data, these are the bases we rely on.
| Purpose | Legal basis |
|---|---|
| Running your account and providing the features you ask for | Performance of our contract with you. |
| Taking payment, managing subscriptions and seats, preventing payment fraud | Performance of our contract, and compliance with tax and accounting law. |
| Answering support requests and sending service emails about your account, trial, or subscription | Performance of our contract, and our legitimate interest in supporting our users. |
| Understanding how the product is used so we can fix and improve it | Our legitimate interest in improving the service. See section 11 for how to object. |
| Keeping the service secure, investigating abuse, maintaining backups | Our legitimate interest in a secure and reliable service. |
| Sending marketing email | Your consent, which you can withdraw at any time. |
| Storing and processing the clinical content you enter | Your documented instructions as controller. We act only as your processor for this content. |
6. Where your data is stored
The database that holds your accounts, clients, patients, consults, and records runs in the European Union (Frankfurt). Audio recordings, documents, and photos are stored as objects with our object storage provider, reachable only through short-lived signed links that our servers mint per request.
Several sub-processors in section 5 operate in the United States, so some data, including consult audio and transcripts sent for transcription and note drafting, is transferred outside the EU and the UK. Those transfers rely on the standard contractual clauses or equivalent safeguards in each provider's data processing terms. Where you are in Iran, this is unchanged: your records still live in the EU database.
7. How long we keep it
| Data | Kept for |
|---|---|
| Clients, patients, records, consults, notes, calculations | As long as your account is open. Deleting an item removes it from your account, and deleting a client or patient removes the animals and records beneath it. |
| Audio recordings and uploaded documents | Until you delete them. There is no automatic expiry. Deleting a file deletes the stored copy. Where you delete a parent record instead, ask us and we will clear any file left in storage underneath it. |
| Case referral links | Until the expiry you set, until you revoke the link, or until the underlying records are deleted. |
| Account and clinic data | For the life of the account. On a verified deletion request we remove it from live systems, normally within 30 days. |
| Encrypted database backups | They age out on our hosting provider's standard rotation, typically up to 30 days after deletion from live systems. |
| Invoices and payment records | As long as tax and accounting law requires, which can be several years after you leave. |
| Product analytics and error reports | On our analytics provider's standard retention schedule. |
| Support and contact emails | Typically up to 24 months after the conversation ends. |
If you are a member of a clinic and you leave or are removed, the records stay with the clinic, which is the controller for them. You keep access to what you personally authored and lose access to the rest.
8. How we protect it
- All traffic to the site and the application is encrypted in transit with TLS, and data at rest is encrypted by our database and storage providers.
- We never store passwords. Sign-in credentials are held by our authentication provider.
- Recordings, documents, and photos are not publicly addressable. Every read or write goes through a signed link that our server mints for a single object and that expires within minutes.
- Every database query is scoped to your account, or to your clinic if you are on a clinic account, so one account cannot read another's records.
- Access to production systems is limited to the small number of people who need it to operate the service.
What we do not claim
VetDoze does not hold SOC 2, ISO 27001, or HIPAA certification, and we will not tell you otherwise. Animal health information is not protected health information under HIPAA, which is a human-health law, so HIPAA does not apply to veterinary records in the first place.
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant supervisory authority as the law requires.
9. Your rights and choices
Subject to local law, you can ask us to do any of the following with the personal data we hold about you as a user:
- Ask for a copy of what we hold about you.
- Correct it if it is wrong or incomplete.
- Delete it, along with your account and the files stored with it.
- Restrict or object to a particular use, including our use of analytics.
- Withdraw a consent you have given, such as marketing email or push notifications, without affecting what we did before you withdrew it.
- Complain to your data protection supervisory authority. If you are in the EEA or the UK, you may complain to your national regulator.
Email sina@vetdoze.com to exercise any of these. We aim to answer within 30 days, and we will tell you if a request is complex enough to need longer. We may need to confirm your identity first, and we do not charge for a reasonable request. There is no self-service delete button in the product yet, so deletion goes through that address: we remove the account, its records, and the files stored with them, and we confirm when it is done.
If you are a resident of California or another US state with a comparable privacy law: we do not sell or share personal information as those laws define it, we do not use it for targeted advertising, and exercising any of the rights above will never lead to a worse service or a different price.
10. If you are an animal owner and your vet uses VetDoze
Your veterinary practice, not VetDoze, decides what is recorded about you and your animal, and how long it is kept. They are the controller and we process it on their behalf.
To see, correct, or delete what is held about you, contact your practice first. If you write to us at sina@vetdoze.com instead, we will pass your request to them and support them in answering it.
12. Children
VetDoze is a professional tool for veterinary practice. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, write to sina@vetdoze.com and we will remove it.
13. Changes to this policy
We update this policy when what we do with data changes, for example when we add or replace a sub-processor. The date at the top always reflects the current version.
If a change materially affects how your clinical content is handled, we will make reasonable efforts to email account holders before it takes effect rather than relying on you to re-read the page.
Contact us
Questions about this policy, requests about your data, or a request for a data processing agreement for your clinic: sina@vetdoze.com.
Tell us what you need and, if it is a request about your data, which account or clinic it concerns. We answer within 30 days.