PRIVACY POLICY

Last updated: 29 October 2026

This policy explains how Vetty handles personal data when you visit https://vetty.app, book or hold a video consultation through it, join a consultation as a guest, receive a consultation report from a veterinary practice, or use Vetty Pro, the practice portal at https://pro.vetty.app, as a veterinarian or a member of practice staff. Vetty Scribe, our consultation-notes product for in-person work, has its own privacy notice at https://vettyscribe.com/privacy.

This policy is written in English, and the English text governs. We publish translations into other languages; each is for convenience only.

1. WHO WE ARE AND HOW TO CONTACT US

1.1 The controller of the personal data this policy describes is Brahim Ouasti EI, trading as Inumbra Labs, an individual entrepreneur (entrepreneur individuel) registered in France in the national business register (Registre national des entreprises) under SIREN 538 543 034, intra-community VAT number FR24538543034, and which operates Vetty ('Vetty', 'we', 'us' or 'our'). Our legal notice is at https://vetty.app/legal-notice.

1.2 We are established in France, so the General Data Protection Regulation (Regulation (EU) 2016/679, the 'GDPR') and the French Data Protection Act (loi Informatique et Libertés) apply to everything we do with personal data, wherever you live. Because we are established in the European Union, our lead supervisory authority is the French Commission nationale de l'informatique et des libertés (CNIL). If you live in the United Arab Emirates, Australia, New Zealand or Singapore, your own country's data-protection law also applies, and section 14 explains what it adds.

1.3 Privacy contact. Brahim Ouasti is responsible for privacy at Vetty and handles every privacy request and every security incident. You can reach him at privacy@vetty.app. He is our privacy contact; we have not designated a data protection officer under Article 37 of the GDPR, because our activities do not require one. Section 14.4 sets out his role under the law of Singapore. For anything other than privacy, write to support@vetty.app.

2. DEFINITIONS

In this policy:

• 'Consultation' means a video consultation between an Owner and a Practice booked or arranged through Vetty, including the chat, files and report that go with it.
• 'Guest' means a person an Owner invites to join a Consultation through a link, without an account.
• 'Member' means a veterinarian or member of staff who uses Vetty Pro for a Practice.
• 'Owner' means a person who uses vetty.app to book a Consultation for an animal in their care, or for whom a Practice creates a client account.
• 'Practice' means a veterinary practice, or an independent veterinarian, that uses Vetty Pro.
• 'Practice Records' means the clinical records a Practice keeps through Vetty Pro: its notes on clients, patients and appointments, the patient records it creates or imports, the files it adds to appointments, and for each Consultation the audio recording, the transcript, the clinical note and the signed report.
• 'Vetty Pro' means the practice portal at pro.vetty.app, the seats Practices subscribe to for it, and the listing of Practices and veterinarians on vetty.app.

3. OUR TWO ROLES

3.1 Where we are the controller. For most of what this policy describes, we decide why and how personal data is used, so we are the controller. That covers your account and profile, your pets' profiles, your bookings and payments, the running of each video call (who joins and when), your own copies of your intake answers, of your chat messages and files and of each consultation report written for you, your reviews, Members' accounts, licences and listings, Practices' subscriptions and fees, and the security and improvement of the service.

3.2 Where we are a processor. For the Practice Records, which include the Practice's copy of each Consultation's intake, chat, recording, the record of each participant's consent or refusal to recording, transcript and report, the Practice is the controller and we process them on its behalf and on its instructions, under our Data Processing Agreement at https://vetty.app/data-processing-agreement. This policy describes that processing so that you know what happens to your data, but the Practice decides it and answers for it. If you are a client of a Practice and have a question or request about its records, ask the Practice; if you write to us, we will pass your request to the Practice and help it answer you.

4. WHAT WE COLLECT AND WHERE IT COMES FROM

4.1 If you are an Owner

• Account and profile: your name, email address, password (stored only as a hash), phone number and, if you add them, your WhatsApp number, delivery address and billing address, your profile photo, the country you state, preferred language, time zone, time format and notification preferences. If your account has no country yet, we ask you once to choose it, suggesting the country we derive from your IP address (section 4.5.5). If you sign in with Google, Google gives us your name, email address and profile picture; we never receive your Google password or contacts. When you register with an email address, we send a one-time code to it to confirm that it is yours.
• Your pets: name, species, breed, date of birth, sex, neuter status, weight, microchip number, photo, allergies, chronic conditions, medications, surgical history, diet, environment and behaviour notes, vaccinations, and documents you upload.
• Bookings: the Practice and veterinarian you choose, the date and time, the pet, the reason for the visit and its concern category, the status of each appointment, and whether you were already a client of that Practice (section 7.2).
• Intake: your answers to the pre-consultation questions (the main concern, how long it has lasted, how it started and is changing, appetite, energy, water intake, history and recent medications), up to six photos, and a snapshot of your pet's chronic conditions, allergies and medications at that time.
• The call: when each participant joined and left, the recording consent each participant gave or refused and when (section 5), and, where everyone agreed, the audio recording and its transcript.
• Chat: the messages and files (images and PDF documents) you and the Practice exchange about a Consultation.
• Reports: the version of each signed report written for you.
• Payments: your payment is processed by Stripe on the Practice's own Stripe account. We receive the payment status, amount and currency, the brand and last four digits of a saved card, refund details and Stripe's identifiers. We never see or store your full card number.
• Reviews: the rating and text you leave, shown publicly with the name on your profile, and any public reply from the veterinarian.
• Notify-me requests: if you ask to be told when Vetty opens where you live, your email address, country, city, language, the page you were on and your browser's user agent.
• Support: what you write to us, and our replies.

4.2 If a Practice adds you as its client

A Practice can record you as its client in Vetty Pro, with your name and email address, so that it can book Consultations for you and send you reports. When it does, we create a client account for you from what the Practice entered, without emailing you at that moment. You hear from us when the Practice books a Consultation for you or sends you a signed report, and you can then sign in to the account. The Practice is the source of this data and is responsible for telling you that it keeps your records with Vetty.

4.3 If you are a Guest

The Owner shares an invitation link with you; the link works for 24 hours. We collect the name you enter, your recording consent and when you gave or refused it, when you joined and left, and, if everyone agreed to recording, your audio and its transcript, which become part of the Consultation's records. We hold no account for you.

4.4 If you are a Member

• Your name, email address, password (hashed), photo, job title and role in the Practice; if you are a veterinarian, your professional profile (species you treat, languages, specialties and biography), your availability, your report settings and the writing samples you give for the report style.
• Your veterinary licence and, for the Practice, its trade licence: the documents, numbers, issuing authorities, issue and expiry dates and country. The documents are never shown publicly. The number, the issuing authority, the country and a badge showing that we have reviewed the document are shown on the public profile.
• The Practice's details: name, country, city, address, phone number, email address, booking links, logo, photos, opening hours, prices and holiday closures.
• The names and email addresses of the people a Practice invites, and of the people who ask to join it. When an administrator has a verified email address at the Practice's own domain, that domain becomes the Practice's join domain.
• Billing for Vetty Pro: the billing contact, billing address and tax identification number collected at Stripe Checkout, the Practice's legal name, address and VAT number, subscriptions and their invoices, the new-client fees charged and the monthly invoices for them.
• The audio of your microphone in a Consultation, where every participant agreed to recording.
• Payouts are set up with Stripe, which collects the identity and bank details it needs under its own privacy policy.

4.5 Collected automatically

4.5.1 Server logs and security. When you use the service, our hosting provider and our servers record your IP address, browser and device type, the pages and resources requested and the time. We use your IP address, or your account identifier when you are signed in, to limit the rate of requests and protect the service from abuse.

4.5.2 Analytics, only with your consent. If you accept analytics cookies, our analytics provider, PostHog, records the pages you view and leave, errors in the page and the steps of the onboarding flow, under a random identifier. It is not linked to your account. Session replay is switched off: we do not record your screen or what you type.

4.5.3 Service events, without cookies. Our servers send PostHog a record of key events, such as a booking opened, a payment taken, a subscription changed, a notification failed or an error occurred. These records are linked to the internal identifier of the account involved, not to your name, and carry the technical details of the event or error. They involve no cookie and nothing stored on your device.

4.5.4 Security reports. When a page breaks one of our browser security rules, your browser sends a report to PostHog with the page address, the blocked address and your user agent; PostHog sees your IP address. These reports are sent whatever your cookie choice.

4.5.5 Language and country. We read your browser's language setting to choose the language of the site, and we remember the country you pick. We derive an approximate country from your IP address, and use it only to suggest your country when we ask you to state it, and, while you are signed out or have not stated a country, to choose which Practices to show you, including those featured on the home page. Once you have stated your country, the Marketplace uses that country, not your IP address. We do not collect your precise location and do not use GPS.

4.6 Sensitive data

We do not ask for special categories of personal data, such as data about your health, religion or ethnic origin. What participants say in a recorded Consultation is transcribed; if someone mentions their own health or another person's, it will appear in the transcript, which we protect as this policy describes. We do not use anyone's voice to identify them. Information about an animal's health is not personal data about you, but we protect it in the same way.

4.7 What you must give us

You need an email address and a password, or a Google account, to create an account; booking needs a pet, a reason for the visit and a payment; joining a call needs a name. Without them we cannot provide that part of the service. Recording is never required: if you refuse it, the Consultation goes ahead without it (section 5).

5. RECORDING AND TRANSCRIBING VIDEO CONSULTATIONS

5.1 Only with consent. Before you join a video Consultation, we ask whether you agree to the audio of the Consultation being recorded and transcribed. Every participant is asked, including the veterinarian and any Guest, and we store each answer with the time it was given. The audio is recorded only if every participant agrees. If anyone refuses, the Consultation runs without any recording, transcript or AI-drafted report.

5.2 What is recorded. Only each participant's microphone. Video and screen sharing are never recorded.

5.3 How the audio is handled. Each participant's audio is stored in a private storage area in Frankfurt, Germany, that only our service can read. After the Consultation, it is sent to our transcription provider (section 6) through a link that expires after one hour. Once the transcript is stored, we delete the audio and ask the provider to delete its copy of the transcript. If a Consultation does not complete (for example it is cancelled or nobody attends), its audio is deleted without being transcribed, at the latest 24 hours after the call's last activity.

5.4 Who decides. We collect and store the consent; the recording, the transcript and the report form part of the Practice Records (section 3.2). You may withdraw your consent after the Consultation by writing to the Practice or to privacy@vetty.app. Withdrawal does not affect what was done before it; we delete any audio that still exists, and the Practice decides, as controller, what happens to the transcript and report in its records.

6. HOW WE USE ARTIFICIAL INTELLIGENCE

6.1 Transcription. ElevenLabs converts the consultation audio into text, with timings. We label each speaker from the call itself, not from their voice.

6.2 Drafting the report. Anthropic's Claude models draft the report from the transcript, the intake answers, the pet's profile and the Practice's report settings, in four steps: extracting the facts, composing the clinical note, checking the draft against the transcript, and writing a version for the Owner in the Owner's preferred language. We may switch report drafting to OpenAI instead; it would receive the same data.

6.3 A veterinarian decides. The draft is only a draft. The veterinarian reviews, corrects and signs both versions, and only a signed report reaches the Owner. Reports in Vetty Pro are drafted with artificial intelligence and reviewed by a veterinarian; the signed report is the veterinarian's.

6.4 What the providers may keep and do. Each provider processes the data only to provide its service to us. Our AI providers may keep inputs for a short time for abuse monitoring under their terms; OpenAI keeps such logs for up to 30 days. None of our AI providers may use your data to train its models: Anthropic's commercial terms bar training on customer content, OpenAI does not use data sent through its API for training unless the customer opts in, and we have opted out of training in our ElevenLabs account.

7. PURPOSES AND LEGAL BASES

7.1 We use personal data for the following purposes, on the legal bases shown. 'Contract' means that the processing is necessary to perform our contract with you or to take steps you ask for before entering into it (GDPR Article 6(1)(b)); 'legal obligation' means Article 6(1)(c); 'legitimate interest' means Article 6(1)(f); 'consent' means Article 6(1)(a).

7.2 Where we rely on legitimate interest, we have weighed it against your interests and rights, and you may object as section 12 explains. You can ask us for our assessment. Where we rely on consent, you may withdraw it at any time; withdrawing does not affect what was done before.

7.3 Decisions made automatically. Some outcomes follow automatically from rules set out in our terms: the refund due when a Consultation is cancelled, based on the time of the cancellation; whether an Owner or a veterinarian missed a Consultation, based on the call's join records; the expiry of a booking request a veterinarian has not answered; and whether a booking carries the new-client fee. These rules are needed to perform the contract and are applied the same way to everyone. If you disagree with an outcome, write to support@vetty.app: a person will review it, and you may give your view and contest it. We make no other decision about you by automated means alone that has a legal or similarly significant effect on you, and every consultation report is reviewed and signed by a veterinarian.

8. WHO RECEIVES YOUR DATA

• The Practice and veterinarian you book. They see your name, email address, phone number, delivery and billing addresses if you have added them, your pet's profile, the reason for the visit, your intake answers and photos, the number of your earlier appointments with them, your messages and files, the transcript and the report.
• Guests you invite see and hear the Consultation they join.
• The public. Reviews are shown with the name on the reviewer's profile. Veterinarians' and Practices' public profiles, including licence numbers, issuing authorities and countries, are public.
• Within a Practice, administrators see its team and its records. Through the join domain, a Practice's name, city, country and logo are shown to people with a verified email address at that domain, and the name and email address of a person who asks to join are shown to the Practice's administrators.
• Stripe, which processes Consultation payments on the Practice's own account and Vetty Pro subscriptions on ours, and acts under its own privacy policy for its own legal duties, such as fraud prevention and anti-money-laundering checks.
• Our service providers, listed in section 9, which process data on our instructions.
• Authorities, courts and professional advisers, where the law requires it or to establish, exercise or defend legal claims.
• A successor, if our business is sold or transferred, which will be bound by this policy.

We do not sell personal data, and we do not share it with advertisers or data brokers.

9. OUR SERVICE PROVIDERS AND WHERE THEY PROCESS DATA

9.1 Each provider below processes personal data under a written contract, only on our instructions and only for the purpose stated. The last column gives the safeguard for any transfer outside the European Economic Area (EEA), as section 10.2 explains.

9.2 We will update this list at least 30 days before we add or replace a provider that processes Practice Records, and before we add or replace any other provider that processes your data.

10. INTERNATIONAL TRANSFERS

10.1 We are established in France and we store your data in the European Union, in Frankfurt, Germany. Some providers in section 9 process data outside the European Economic Area, mainly in the United States. In particular, the video call's media passes through the LiveKit server nearest each participant, which may be in another country, and LiveKit keeps call logs and session data in the United States.

10.2 Each transfer to a provider outside the EEA, including any access from the United States to data we store in the EEA, is covered by the 'Transfer Safeguard': the EU–US Data Privacy Framework where the provider is certified under it, otherwise the European Commission's standard contractual clauses, with the additional measures they require. Section 9.1 shows which providers this covers: Vercel, LiveKit, ElevenLabs, Anthropic, OpenAI, Resend, Stripe, Google, Mapbox and Unsplash, and any access to our stored data by Supabase, Upstash or PostHog from the United States. You can ask us for a copy of the safeguards that apply to a transfer at privacy@vetty.app.

10.3 Section 14 explains how these transfers meet the laws of the United Arab Emirates, Australia, New Zealand and Singapore.

11. HOW LONG WE KEEP YOUR DATA

11.1 We keep personal data only as long as the purpose requires, as follows.

11.2 When you delete your Owner account. Deleting your account removes at once your name, phone number, country and photo from your profile, replaces the email address on it, and signs you out of the device you used. Your sign-in record in our authentication system keeps your email address for the same period as the restricted archive in section 11.1. The Consultation content stays with the Practice for the period in section 11.1, because it is part of the Practice's records. The other records are kept for the periods shown and then deleted.

11.3 When a Practice closes. Its records are kept for 30 days so that it can export them, and are then erased. We keep what the law and you need: the Practice's name and country, its billing records, the appointment records without the Practice's clinical text, and your own side of each Consultation, including your intake, your messages and files and your copy of the report, each for the period in section 11.1.

11.4 Members. A Member who deletes their account in Vetty Pro has 30 days in which they can sign in and keep it. After that we erase their login, profile and photo, licence submissions and documents, notifications, onboarding answers and join requests, report settings and writing samples. Where a Practice's records refer to a veterinarian's profile, the profile is kept with the name only, and the records and reports they wrote stay with the Practice. Their name, email address and country go into the restricted archive in section 11.1.

12. YOUR RIGHTS

12.1 Under the GDPR you have the right to:

• access your personal data and receive a copy of it;
• rectify inaccurate or incomplete data;
• erase your data, in the cases the GDPR provides;
• restrict processing while a question is resolved;
• portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller;
• object at any time to processing based on our legitimate interest, on grounds relating to your situation, and at any time to direct marketing;
• withdraw consent at any time, where we rely on it;
• obtain human review of an automated outcome (section 7.3);
• give instructions on what happens to your data after your death, under French law;
• complain to a supervisory authority (section 13).

12.2 Much of this you can do yourself: update your profile and your pets in your account settings, change your notification and cookie choices, and delete your account. Members can delete their account, and Practice administrators can export the Practice's records and close the Practice, in Vetty Pro.

12.3 For anything else, email privacy@vetty.app. We answer within one month, which we may extend by two further months for a complex request; we will tell you within the first month if we do. We may ask you to confirm your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

12.4 For the Practice Records, the Practice is the controller (section 3.2). We pass your request to it without delay and help it answer.

13. COMPLAINTS

13.1 If you are unhappy with how we handle your data, please tell us first at privacy@vetty.app, so that we can try to put it right.

13.2 You may also complain to a supervisory authority at any time. Our lead supervisory authority is the French Commission nationale de l'informatique et des libertés (CNIL), https://www.cnil.fr. In the European Union you may also complain to the authority of the country where you live or work or where the issue arose, for example:

• Cyprus: the Commissioner for Personal Data Protection, https://www.dataprotection.gov.cy;
• Greece: the Hellenic Data Protection Authority, https://www.dpa.gr;
• Italy: the Garante per la protezione dei dati personali, https://www.garanteprivacy.it;
• Portugal: the Comissão Nacional de Proteção de Dados, https://www.cnpd.pt;
• Spain: the Agencia Española de Protección de Datos, https://www.aepd.es.

13.3 Section 14 names the authorities in the United Arab Emirates, Australia, New Zealand and Singapore.

14. COUNTRY-SPECIFIC INFORMATION

14.1 United Arab Emirates

14.1.1 If you are in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the 'PDPL') also applies. You have the rights it gives you: to receive information about the processing, to access and receive your data, to have it corrected or erased, to restrict or stop its processing, and to object to decisions made by automated processing alone. You exercise them with us as section 12 describes.

14.1.2 Your data leaves the United Arab Emirates to be processed in the European Union and, for some providers, in the United States and the other countries named in section 10. The GDPR protects it throughout, and the safeguards in section 10.2 give the contractual protection the PDPL expects for a transfer abroad.

14.1.3 You may complain to the UAE Data Office.

14.2 Australia

14.2.1 If you are in Australia, we handle your personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (the 'APPs'). You may ask to access your personal information and to correct it (APPs 12 and 13), as section 12 describes; we respond within a reasonable period, normally within 30 days. You may deal with us under a pseudonym when you browse the site, but not when you book, because the Practice needs to know who its client is.

14.2.2 Disclosure overseas (APP 8). We disclose personal information to recipients outside Australia: to our own systems in Germany and to the providers in section 9, in Germany, the United States and, for video call media, the country of the LiveKit server nearest each participant. Before doing so we take reasonable steps, by contract, to make sure those recipients handle it in line with the APPs.

14.2.3 Complaints. Write to us first at privacy@vetty.app; we will reply within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC), https://www.oaic.gov.au.

14.3 New Zealand

14.3.1 If you are in New Zealand, the Privacy Act 2020 also applies. You may ask to access your personal information and to correct it, as section 12 describes; we will tell you our decision on an access request within 20 working days, as the Act requires.

14.3.2 Disclosure overseas. We disclose personal information to recipients outside New Zealand, in the countries named in section 10 and section 14.2.2. We do so under contracts that require them to protect it in a way comparable to the Privacy Act 2020, or with the safeguards in section 10.2.

14.3.3 Complaints. Write to us first at privacy@vetty.app. If you are not satisfied, you may complain to the Office of the Privacy Commissioner, https://www.privacy.org.nz.

14.4 Singapore

14.4.1 If you are in Singapore, the Personal Data Protection Act 2012 (the 'PDPA') also applies. Our Data Protection Officer is Brahim Ouasti, who can be reached at privacy@vetty.app.

14.4.2 You may ask to access your personal data and to learn how it has been used or disclosed in the past year, and ask us to correct it. We respond within 30 days or, if we cannot, tell you within that time when we will. You may withdraw your consent to any processing based on consent by giving us reasonable notice; we will tell you what the withdrawal means, for example that a Consultation cannot be recorded or that we can no longer provide part of the service.

14.4.3 Transfers outside Singapore. We transfer personal data to the countries named in section 10, under contracts that require the recipients to give it a standard of protection comparable to the PDPA.

14.4.4 Complaints. Write to our Data Protection Officer first. If you are not satisfied, you may complain to the Personal Data Protection Commission (PDPC), https://www.pdpc.gov.sg.

15. SECURITY AND PERSONAL DATA BREACHES

15.1 We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access control with row-level security in our database, private storage for consultation audio that only our service can read, links to files that expire, rate limiting, logging, a record of every administrative action on licences, and the deletion of audio once it is transcribed. Our providers are bound by contract to protect the data they process for us.

15.2 No system is perfectly secure. Brahim Ouasti is responsible for handling any security incident. If a personal data breach affects data we control, we notify the CNIL without undue delay and, where the GDPR requires notification, within 72 hours of becoming aware of it; we notify any other competent authority within the time applicable law requires; and we tell the people affected where applicable law requires it, for example where the breach is likely to put their rights at high risk. If a breach affects Practice Records, we notify the Practice without undue delay and within 48 hours of becoming aware of it, and the Practice, as controller, notifies its regulator and its clients.

16. CHILDREN

The service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18; a parent or guardian books for a younger person from their own account. If you believe we hold data about a child, email privacy@vetty.app and we will delete it.

17. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies that are strictly necessary, preferences you set, and, only with your consent, analytics cookies. Our Cookie Policy at https://vetty.app/cookie-policy lists each of them, explains how the cookie banner and your choices work, and describes the records we keep of your choice. You can change your choice at any time from "Cookie settings" in the site footer or in your account settings.

18. MARKETING

Any marketing email we send includes an unsubscribe link. Service messages about your account, bookings, Consultations and reports, and for Practices about billing, are not marketing. Three notices cannot be switched off, because they protect you from loss: that a payment was taken but the slot was lost, that a Practice has been closed and its records will be erased, and that an account is scheduled for deletion and how to keep it.

19. CHANGES TO THIS POLICY

We may update this policy. The date at the top shows when the current version was published. For a material change we will tell you by email or in the app before it takes effect. Earlier versions are available on request.

20. CONTACT

Brahim Ouasti EI, trading as Inumbra Labs
Individual entrepreneur (entrepreneur individuel) registered in France (RNE), SIREN 538 543 034, intra-community VAT number FR24538543034
Privacy contact: Brahim Ouasti, privacy@vetty.app
Support: support@vetty.app