Privacy Notice

This Privacy Notice describes how Odren Ltd processes the personal data of the people who use VETZY:

• pet owners;
• veterinary clinics, grooming salons and boarding kennels, and the people who manage them;
• franchise partners;
• visitors of vetzy.io and app.vetzy.io.

This Privacy Notice forms part of the VETZY Terms and Conditions and must be read together with them. Where defined terms are used and not defined here, they have the meaning set out in the Terms and Conditions.

VETZY is operated by Odren Ltd, the data controller for the processing described in this Notice.

Group context. Odren Ltd is part of the Odren Group and cooperates operationally with the Ephelia Group. Personal data is shared within these groups only as described in section 6.1.

Contact

For privacy questions and to exercise your rights, contact us:

• Email: privacy@odrengroup.com
• Postal mail: Odren Ltd, Data Protection, 7 Manchester Square, London, England, W1U 3PQ, United Kingdom

We do not have a statutory obligation to appoint a Data Protection Officer under the UK GDPR or the EU GDPR. We have however appointed a privacy lead within Odren who is responsible for this Notice and for the handling of your requests.

This Notice applies to anyone who interacts with VETZY:

• Pet Owners who chat with VETZY on the web chat at app.vetzy.io, on WhatsApp or on Telegram, or who use their account at app.vetzy.io, including people who chat on the website as guests without signing in.
• Clinic Users:
  • veterinary clinics, grooming salons and boarding kennels listed in the VETZY directory;
  • the people who claim a clinic or add a new one;
  • the people who manage a clinic through the VETZY clinic portal.

  In this Notice, "clinic" means any of these businesses, unless a section says otherwise.

• Master Franchisees and Regional Partners, and people who apply to become one.
• Visitors of vetzy.io, app.vetzy.io and any related page.
• People who contact us through forms, email, the support pages or social channels.

Where this Notice references the User, it applies to all of the above unless a specific category is named.

We process the following categories of personal data, depending on how you interact with VETZY.

3.1 Pet Owner data

3.2 Health record and sharing with clinics, groomers and boarding kennels

What the record contains. Each animal has a health record.

• You can add documents to it from your account at app.vetzy.io, or by sending photos in the chat.
• The assistant reads photos of a vaccination booklet or pet passport to fill in the animal's details and vaccinations, which you can correct.
• A veterinary clinic where you have booked through VETZY can add its own documents for your animal. They appear in the record at once and you are told. You can download or forward them, but not delete them.

Who sees it. You decide which clinics see the record:

• You can send the whole record to a veterinary clinic, or a veterinary clinic can ask for it and you approve with one tap.
• A grooming salon or a boarding kennel receives only the vaccination booklet: the vaccinations and antiparasitic treatments recorded for your animal and the photos of its vaccination booklet or passport. It never receives prescriptions, test results, reports or other documents.
• The first time you ask a boarding kennel for a stay for an animal, the kennel needs its vaccination booklet: VETZY asks you for photos of it if it has none, and sends the booklet to the kennel with your request once you agree in the chat. Without the booklet, the request cannot be sent through VETZY.
• A clinic that is not yet on VETZY receives the record, or the vaccination booklet, by email through a private link, together with an invitation to claim its listing in the VETZY directory.
• You can stop a clinic receiving new documents at any time. What it received until then stays available to it while your account exists.
• A clinic always sees the documents it added itself.

3.3 Ratings of clients by clinics

What a rating is. After a visit booked through VETZY, the clinic may rate you as a client, with a score from 1 to 5 and a short comment.

Who sees it. The clinic chooses who sees the rating:

• you and the clinics; or
• the clinics only.

In both cases it is visible only to the clinics where you have booked through VETZY.

Moderation. Ratings that contain offensive words are refused, and VETZY can hide a rating.

Your rights. Every rating about you, including those visible to clinics only, is included when you download your data (section 11). You can ask us to correct or remove a rating, and you can object to this processing (section 11).

3.4 Clinic User data

3.5 Website, app and cookies

When you visit vetzy.io, our hosting provider processes the technical data needed to deliver the pages: IP address, browser, device and pages requested. Statistics on vetzy.io use analytics technologies subject to your prior consent. Non-essential cookies and tracking technologies must not be activated before you consent. The Cookie Policy at vetzy.io/legal/cookies lists each cookie, its purpose and retention.

The VETZY app at app.vetzy.io uses only strictly necessary cookies: your sign-in session and your chosen language. It uses no analytics or advertising cookies.

If you chat on the website as a guest, without signing in, your conversation is kept under a temporary guest account in your browser and moves into your account when you sign in.

3.6 Data we do not collect

• Children: we do not collect children's data. VETZY is restricted to users aged 18 or older.
• Voice: we do not process voice messages and do not perform voice-biometric identification.
• Payment cards: we do not collect payment-card data. Subscription payments of clinics are handled by Stripe.
• Special categories: we do not knowingly process special categories of personal data within the meaning of article 9 of the UK GDPR and the EU GDPR, save where strictly necessary and lawful.

Information about your animals' health is not health data about you, but we protect it as confidential.

We obtain personal data through several channels:

• Directly from you: when you chat with VETZY, add documents, book a visit, write a review, claim or add a clinic, use the clinic portal, subscribe to a plan, contact support or visit our websites.
• From the messaging platforms through which you reach VETZY (WhatsApp Business Platform, Telegram Bot Platform), in accordance with their respective terms and privacy notices.
• From clinics: documents they add to your animal's record, ratings they write about you, and visits they confirm, move or cancel.
• From Google and claimed listings: the listings of veterinarians, groomers and dog boarding facilities that have not claimed their listing only display information that is publicly available on Google: VETZY does not store those data. VETZY collects and retains their listing data only once the provider claims its listing, using the information the provider supplies. This Notice explains the distinction between displaying unclaimed listings and collecting and retaining data after a listing is claimed. A veterinarian, groomer or dog boarding facility can request correction or removal of its listing by writing to support@vetzy.io.
• From the calendar a clinic connects: busy times and event titles.
• From service providers we use to operate the Service, such as cloud, AI, mapping and email providers.

We process personal data only where we have a lawful basis under article 6 of the UK GDPR and the EU GDPR, or under the equivalent provisions of the Swiss Federal Act on Data Protection (FADP).

Where processing relies on consent, you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We share personal data only as described below, and only where there is a lawful basis to do so.

6.1 Odren Group and Ephelia Group

People and companies of the Odren Group and of the Ephelia Group who work on VETZY may access personal data, only for these purposes:

• operating and administering the Service;
• customer support;
• security and the prevention of fraud and abuse;
• accounting and audit.

Each intra-group transfer is governed by an intra-group data-sharing agreement and, where necessary, by Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner's Office, with supplementary measures where required.

6.2 Service providers (processors)

We use third-party service providers acting on our written instructions and bound by data-processing agreements. The main categories are:

• cloud infrastructure (hosting, databases, file storage);
• AI providers (language models that read messages and photos and write answers), under terms that prohibit training on our data;
• messaging platforms (WhatsApp Business Platform, Telegram Bot Platform);
• email delivery, reception and forwarding;
• payment services for clinic subscriptions;
• mapping (converting clinic addresses, and the places you search for, into map coordinates).

The providers used by VETZY today are:

6.3 Independent controllers

In some cases the recipient acts as an independent data controller, not as our processor:

• Clinics.
  • Visits and stays: when you book a visit or request a stay, the clinic receives your name, phone number, email address (if you have one on your account), your animal and the reason for the visit. The clinic may confirm, move or cancel the visit; VETZY tells you by email and in your chat.
  • Health record: a veterinary clinic also receives the documents of the health record you share with it; a grooming salon or a boarding kennel receives only the vaccination booklet (section 3.2).
  • Messages: a boarding kennel can ask you questions about a stay; it receives the answers you give in the chat.
  • Reviews and ratings: it sees the reviews you write about it, and the ratings other clinics gave you when you are also its client (section 3.3).
• Clinics not yet on VETZY that receive your animal's record or vaccination booklet through a private link, at your request.
• The calendar provider a clinic connects (for example Microsoft, Apple or Google). It receives the visits VETZY writes into the clinic's calendar, under the clinic's own agreement with that provider.
• Other users: your reviews are public on the clinic's page, with your first name and the initial of your surname.
• Master Franchisees and Regional Partners, for activities in their territory, when expressly notified to you.
• Authorities: regulators, courts, law-enforcement bodies and competent authorities, where we are legally required to disclose data.

6.4 Anonymous statistics

We may produce anonymous, aggregated statistics, for example the number of visits booked per region. We use them to run VETZY and to report on it, including to the franchise partners. Such statistics do not allow anyone to identify you or your animals.

6.5 Corporate transactions

In the event of a merger, acquisition, reorganisation, sale of assets or insolvency proceeding, personal data may be transferred to the relevant successor or acquirer. We will require the recipient to honour the commitments made in this Notice.

We process personal data primarily in Switzerland, where VETZY's database is located, the European Economic Area and the United Kingdom. We may, however, transfer personal data outside these territories where this is necessary to provide the Service, including to countries that do not provide an equivalent level of protection.

We implement appropriate safeguards, in particular:

• Standard Contractual Clauses approved by the European Commission (Decision 2021/914), or by the UK Information Commissioner's Office (UK International Data Transfer Agreement / UK Addendum);
• adequacy decisions where they apply, such as the adequacy decisions concerning Switzerland and the United Kingdom;
• supplementary technical and organisational measures, including encryption in transit and at rest, access controls and contractual restrictions on government access.

Several providers listed in section 6.2 are based in the United States: Anthropic, Twilio, Meta, Resend, Cloudflare, Stripe and Google. These transfers rely on:

• the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where the provider is certified;
• otherwise, Standard Contractual Clauses or the UK International Data Transfer Agreement.

You may request a copy of the safeguards used for a specific transfer by emailing privacy@odrengroup.com.

We retain personal data for as long as it is necessary for the purposes for which it was collected. The main retention rules are summarised below. Where multiple rules apply, we apply the longest applicable period.

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction, in line with industry standards:

• encryption of data in transit (TLS) and at rest;
• access controls and role-based access for staff. Our support operators see only what they need to answer requests.
• health-record documents kept in private storage and opened only through links valid for one hour;
• calendar passwords and access tokens stored encrypted;
• logging, monitoring and incident-response procedures;
• vendor due diligence and contractual safeguards on processors;
• backups and disaster-recovery plans.

Google user data. When a clinic connects Google Calendar, VETZY protects the data it receives from Google (the account's email address, the list of its calendars, and the times and titles of its events) as follows:

• it travels only over encrypted connections (TLS);
• the token that gives VETZY access to the calendar is kept encrypted in a separate secrets store that only VETZY's servers can read; it is never shown on any screen or sent to a browser;
• event times and titles are kept in VETZY's database in Switzerland, encrypted at rest; database access rules let only the people who manage that clinic see them, and they are never shown to pet owners or given to the AI assistant;
• only authorised staff can access the production systems, and only to run, support and secure the Service;
• event times and titles are replaced at every synchronisation, and they are deleted, together with the token, as soon as the clinic disconnects the calendar.

No system is perfectly secure. In case of a personal-data breach likely to result in a risk to rights and freedoms, we notify the competent supervisory authority and, where required, the affected individuals, within the deadlines set by applicable law.

VETZY uses an AI model, currently Claude by Anthropic, for these tasks:

• understanding your messages and writing its answers;
• reading the photos of booklets and documents you send;
• helping our support team with summaries and draft replies, which a person checks before anything is sent.

No training on your data. We do not use your chats, your animals' data or your documents to train AI models. Our AI provider is contractually bound not to use them to train its own models. If this changes, we will update this Notice in advance and give you an effective way to object.

What VETZY is not. VETZY is not a clinical decision-support system, a medical device or a high-risk AI system as defined by the EU AI Act. It is an information, discovery and booking assistant.

• VETZY does not replace a veterinarian: for clinical questions it tells you to contact one, and helps you find and book one.
• Answers written by AI can contain errors: check important information with your veterinarian.

You have the following rights in respect of your personal data, subject to conditions and exceptions provided by law:

• Access (article 15 GDPR): obtain confirmation of whether we process your data and a copy of that data.
• Rectification (article 16 GDPR): ask us to correct inaccurate or incomplete data.
• Erasure/right to be forgotten (article 17 GDPR): ask us to delete your data, subject to retention obligations.
• Restriction (article 18 GDPR): ask us to suspend processing in defined circumstances.
• Portability (article 20 GDPR): receive your data in a structured, commonly used machine-readable format and, where technically possible, ask us to transmit it to another controller.
• Object (article 21 GDPR): object to processing based on legitimate interests, including profiling and ratings written about you by clinics, and to direct marketing at any time.
• Withdraw consent: at any time, for processing that is based on consent.
• Automated decisions (article 22 GDPR): not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not take such decisions on you.
• Complaint: lodge a complaint with a supervisory authority (see section 13).

On your account page at app.vetzy.io you can do two things yourself:

• download all your data in one file, including the ratings clinics wrote about you, even those visible to clinics only;
• delete your account.

A person who manages a clinic must first hand the clinic over, by writing to support.

By email. To exercise any other right, contact us at privacy@odrengroup.com.

• We will respond within one month from receipt of a valid request, extendable by two further months for complex requests.
• We may need to verify your identity before responding.
• The exercise of your rights is free of charge in most cases, except for manifestly unfounded or excessive requests.

The Cookie Policy at vetzy.io/legal/cookies lists the cookies used on vetzy.io and app.vetzy.io, with their categories, purposes, providers and retention periods. app.vetzy.io uses only strictly necessary cookies. On vetzy.io, statistics and non-essential cookies and tracking technologies require your prior consent. You must be able to accept or reject them and withdraw your consent at any time. Strictly necessary cookies do not require consent.

Pet Owners. We do not send marketing messages to Pet Owners. The emails and chat messages you receive from VETZY concern your visits, your animals' reminders, the health record and your requests.

Clinic Users. We may send Clinic Users news about VETZY and its plans by email. You can unsubscribe at any time from the link included in each email, or by writing to privacy@odrengroup.com.

You have the right to lodge a complaint with a supervisory authority. Without prejudice to other administrative or judicial remedies, you can complain in particular to:

• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk.
• European Union: the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. The full list is at edpb.europa.eu/about-edpb/board/members_en.
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.

We would appreciate the opportunity to address your concerns directly before you do so. Contact us at privacy@odrengroup.com.

VETZY is not intended for children. Users must be at least 18 years old, or the age of legal majority in their country of residence if higher. We do not knowingly process personal data of children. If you believe a child has provided personal data to us, contact privacy@odrengroup.com and we will delete the data without undue delay.

How the AI is used. VETZY uses AI to answer your messages, to find the clinics that fit your request, and to suggest when you should contact a veterinarian.

Order of search results. Clinics that take bookings through VETZY, which pay a subscription for this, appear before the other clinics in every search, on the website and in the chat. Within each group, clinics that declare the species you are looking for come first, then results are ordered by distance from you (when you share your position) and by name.

Ratings of clients. These are written by the clinics' staff, not by VETZY (section 3.3). Clinics may take them into account when they handle your booking requests. You can object to this processing and ask us to correct or remove a rating (section 11).

No significant automated decisions. These operations do not produce legal or similarly significant effects on you within the meaning of article 22 of the UK GDPR and the EU GDPR. VETZY gives general information only: any clinical decision belongs to the veterinarian you choose. You can always request human review by writing to privacy@odrengroup.com.

We may update this Notice to reflect changes to the Service, to our processing operations or to applicable law. The most recent version is always published at vetzy.io/legal/privacy. For material changes that adversely affect you, we will give you at least 30 days' prior notice through the Service, by email or through a banner on vetzy.io.

For any question about this Notice, your data or your rights:

• Email: privacy@odrengroup.com
• Postal mail: Odren Ltd, Data Protection, 7 Manchester Square, London, England, W1U 3PQ, United Kingdom

We do our best to respond clearly, promptly and free of charge.