Privacy Notice

This Privacy Notice describes how Odren Ltd processes personal data of users of the VETZY service, including pet owners, veterinarians, pet professionals, business partners and visitors of vetzy.io. It also describes the role of Ephelia SwissTech SA, the wallet provider, when payments are used inside the chat. This Privacy Notice forms part of the VETZY Terms and Conditions and must be read together with them. Where defined terms are used and not defined here, they have the meaning set out in the Terms and Conditions.

VETZY is operated by Odren Ltd. Wallet services within the chat are operated by Ephelia SwissTech SA. Both companies act as independent data controllers for the purposes set out in this Notice.

Group context. Odren Ltd is part of the Odren Group. Ephelia SwissTech SA is part of the Ephelia Group. The two groups cooperate operationally and may share personal data within their respective perimeters, as further described in section 6.

Contact

For privacy questions and to exercise your rights, contact us:

• Email: privacy@vetzy.io
• Postal mail: Odren Ltd, Data Protection, 7 Manchester Square, London, England, W1U 3PQ, United Kingdom
• For wallet-related processing only: Ephelia SwissTech SA, Data Protection, Via Nassa 3A, 6900 Lugano, Switzerland

We do not have a statutory obligation to appoint a Data Protection Officer under the UK GDPR or the EU GDPR. We have however appointed a privacy lead within Odren who is responsible for this Notice and for the handling of your requests.

This Notice applies to anyone who interacts with VETZY:

• Pet Owners who chat with VETZY on WhatsApp, Telegram or any other supported channel.
• Professional Users (veterinarians, clinics, groomers, trainers, sitters, dog-sport coaches, pet hotels, behaviourists).
• Business Users (pet food, pet pharma, supplement, insurance and adjacent companies).
• Master Franchisees and Regional Partners.
• Visitors of vetzy.io and any related sub-domain or page.
• People who contact us through forms, email or social channels.

Where this Notice references the User, it applies to all of the above unless a specific category is named.

We process the following categories of personal data, depending on how you interact with VETZY.

3.1 Pet Owner data

3.2 Professional User and Business User data

3.3 Wallet and KYC data processed by Ephelia SwissTech SA

When you use the in-chat payment functionality, Ephelia SwissTech SA opens a Customer Wallet in your name. For that purpose Ephelia SwissTech SA processes, as an independent data controller, the following data, in accordance with the SwissTech Terms:

• Identity data: full name, date and place of birth, nationality, residential address, identity-document details and copies.
• Tax data: tax residence and tax identification number where applicable.
• Beneficial-owner data: for legal entities, identity of ultimate beneficial owners, ownership structure, authorised representatives.
• Source-of-funds and source-of-wealth declarations, supporting documentation.
• Politically Exposed Person (PEP) status, sanctions and adverse-media screening results.
• Wallet operational data: FIAT and Crypto Wallet balances, transactions, wallet addresses, conversion records, card data through Wallester AS where applicable.

Odren shares with Ephelia SwissTech SA only the data strictly necessary to enable the wallet relationship. Ephelia SwissTech SA may also collect data directly from you during the wallet onboarding. The full processing description is in the SwissTech Terms at epheliagroup.com/terms/ephelia-swisstech-sa.

3.4 Website, app and analytics data

When you visit vetzy.io we also process technical data: IP address, browser, device, operating system, language, pages viewed, referrer, time on page, events triggered, cookie identifiers (only after consent, where required). The Cookie Policy at vetzy.io/cookies lists each cookie, its purpose and retention.

3.5 Data we do not collect

We do not collect childrens data: VETZY is restricted to users aged 18 or older. We do not perform voice-biometric identification on Pet Owners. We do not collect raw payment-card data (handled by the wallet provider and its partners under PCI-DSS). We do not knowingly process special categories of personal data within the meaning of article 9 of the UK GDPR and the EU GDPR, save where strictly necessary and lawful.

We obtain personal data through several channels:

• Directly from you, when you chat with VETZY, submit a form, register as a Professional or Business User, sign up to a paid plan, contact support or visit our website.
• From the messaging platforms (WhatsApp Business Platform, Telegram Bot Platform) through which you reach VETZY, in accordance with their respective terms and privacy notices.
• From Ephelia SwissTech SA for wallet status, transaction confirmations and KYC outcomes, where you have authorised a Customer Wallet.
• From public sources, professional registries and partner databases (for example veterinary registration authorities, business registries, sanctions and PEP databases).
• From service providers we use to operate the Service, such as cloud providers, AI providers, mapping providers, customer-support tools and anti-fraud tools.

We process personal data only where we have a lawful basis under article 6 of the UK GDPR and the EU GDPR, or under the equivalent provisions of the Swiss Federal Act on Data Protection (FADP).

Where processing relies on consent, you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We share personal data only as described below, and only where there is a lawful basis to do so.

6.1 Odren Group and Ephelia Group

You acknowledge that your personal data may be shared with, and processed by, any company within the Odren Group and any company within the Ephelia Group, in any country in which those groups operate, for the purposes of:

• operating and administering the Service;
• opening, operating and reconciling the Customer Wallet (Ephelia SwissTech SA in particular);
• customer service, fraud prevention and abuse prevention;
• regulatory compliance;
• group reporting, analytics and audit;
• cross-product personalisation and product improvement;
• training and evaluation of artificial-intelligence systems used by group products;
• marketing of group products and services (subject to applicable opt-in or opt-out rights);
• payment processing, billing and accounting.

Each intra-group transfer is governed by an intra-group data-sharing agreement and, where necessary, by Standard Contractual Clauses approved by the European Commission or the UK Information Commissioners Office, with supplementary measures where required.

6.2 Service providers (processors)

We use third-party service providers acting on our written instructions and bound by data-processing agreements. The main categories are:

• Cloud infrastructure (hosting, storage, databases).
• AI providers (large language models, speech-to-text, embeddings, vector stores), under terms that prohibit retraining on Customer data unless specifically permitted by this Notice.
• Messaging platforms (WhatsApp Business Platform, Telegram Bot Platform).
• Payment service providers and wallet partners (Ephelia SwissTech SA as wallet provider, Currencycloud, Clear Junction, Wallester AS as Wallester partner).
• Identity verification, AML and sanctions-screening providers.
• Mapping, geolocation and routing providers.
• Customer support tools, ticketing, knowledge-base and CRM platforms.
• Analytics, attribution, marketing and email-delivery providers.

6.3 Independent controllers

In some cases the recipient acts as an independent data controller, not as our processor:

• Ephelia SwissTech SA for the opening and operation of the Customer Wallet.
• Professional Users (vets, groomers, trainers, sitters and others) for the appointments you book with them.
• Business Users (brands, insurers) for marketing campaigns you actively engage with, only where you have consented.
• Master Franchisees and Regional Partners for activities in their territory, when expressly notified to you.
• Regulators, courts, law-enforcement bodies and competent authorities where we are legally required to disclose data.

6.4 Anonymised data, sale to third parties

You expressly acknowledge and accept that we may anonymise, de-identify, aggregate or otherwise transform personal data so that the resulting data set no longer permits, by any reasonably available means, the identification of any individual User or pet. Such anonymised and aggregated data is not personal data under the UK GDPR, the EU GDPR or the Swiss FADP. We may sell, license, share, publish or otherwise commercialise such anonymised and aggregated data with and to third parties, including pet food brands, pet pharma companies, insurers, retailers, researchers, regulators, public authorities, investors and any other party we choose, for purposes including market intelligence, benchmarking, analytics, product development, scientific research and commercial monetisation.

Recipients of anonymised data are contractually prohibited from attempting to re-identify any individual User or pet, from combining the data with other data sets for that purpose, and from using the data in breach of applicable law. The revenues of such commercialisation belong to Odren and are not shared with Users.

6.5 Corporate transactions

In the event of a merger, acquisition, reorganisation, sale of assets or insolvency proceeding, personal data may be transferred to the relevant successor or acquirer. We will require the recipient to honour the commitments made in this Notice.

We process personal data primarily in the United Kingdom, the European Economic Area and Switzerland. We may, however, transfer personal data outside these territories where this is necessary to provide the Service or to comply with our obligations, including to countries that do not provide an equivalent level of protection.

We implement appropriate safeguards, in particular:

• Standard Contractual Clauses approved by the European Commission (Decision 2021/914) or by the UK Information Commissioner\u2019s Office (UK International Data Transfer Agreement / UK Addendum).
• Adequacy decisions where they apply (such as the UK-Switzerland adequacy framework).
• Supplementary technical and organisational measures, including encryption in transit and at rest, pseudonymisation, access controls and contractual restrictions on government access.

Where Ephelia SwissTech SA processes data in Switzerland, the Swiss FADP applies, and where data flows from the EU to Switzerland, the Swiss adequacy decision applies.

You may request a copy of the safeguards used for a specific transfer by emailing privacy@vetzy.io.

We retain personal data for as long as it is necessary for the purposes for which it was collected. The main retention rules are summarised below. Where multiple rules apply, we apply the longest applicable period.

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction, in line with industry standards.

• Encryption of data in transit (TLS) and at rest where supported.
• Strong access controls, role-based access, multi-factor authentication for staff.
• Logging, monitoring, intrusion detection and incident-response procedures.
• Vendor due diligence and contractual safeguards on processors.
• Pseudonymisation and minimisation, especially when data is used for AI training.
• Backups and disaster-recovery plans tested periodically.
• Wallet operations follow the security framework of Ephelia SwissTech SA and its regulated partners.

No system is perfectly secure. We notify the competent supervisory authority and, where required, affected individuals, in case of a personal-data breach likely to result in a risk to rights and freedoms, within the deadlines set by applicable law.

We use artificial intelligence to deliver the Service. To make VETZY more accurate, safer and more useful, we may use personal data, including chat content and pet data, to train, fine-tune, evaluate and improve our AI systems and those of other Odren Group and Ephelia Group products. We apply the following safeguards:

• Where possible, we pseudonymise or anonymise data before use in training pipelines.
• We exclude special categories of data, payment data, KYC data and content that could re-identify individuals.
• We bind our AI providers contractually not to use Customer data to train their own foundation models, unless this Notice expressly permits it.
• We document the categories of training data used and maintain a register in line with the EU AI Act expectations on general-purpose AI.
• Where required by law, we offer you an effective means to object to or opt out of training. To exercise this right, email privacy@vetzy.io with the subject AI training opt-out.

VETZY itself is not a clinical decision-support system, a medical device or a high-risk AI system as defined by the EU AI Act. It is positioned as an information, discovery, booking and commerce concierge. Clinical questions are routed to a licensed veterinarian inside the chat.

You have the following rights in respect of your personal data, subject to conditions and exceptions provided by law:

• Access (article 15 GDPR): obtain confirmation of whether we process your data and a copy of that data.
• Rectification (article 16 GDPR): ask us to correct inaccurate or incomplete data.
• Erasure/right to be forgotten (article 17 GDPR): ask us to delete your data, subject to retention obligations.
• Restriction (article 18 GDPR): ask us to suspend processing in defined circumstances.
• Portability (article 20 GDPR): receive your data in a structured, commonly used machine-readable format and, where technically possible, ask us to transmit it to another controller.
• Object (article 21 GDPR): object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Withdraw consent: at any time for processing that is based on consent.
• Automated decisions (article 22 GDPR): not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not take such decisions on you.
• Lodge a complaint with a supervisory authority (see section 13).

To exercise any right, contact us at privacy@vetzy.io. We will respond within one month from receipt of a valid request, extendable by two further months for complex requests. We may need to verify your identity before responding. The exercise of your rights is free of charge in most cases, except for manifestly unfounded or excessive requests. Rights concerning wallet-related processing should be exercised directly with Ephelia SwissTech SA at the contact set out in the SwissTech Terms. We will forward requests we receive to them where appropriate.

We use cookies and similar technologies on vetzy.io for strictly necessary, functional, analytics and marketing purposes. The full list, including categories, purposes, third parties and retention periods, is in the Cookie Policy at vetzy.io/cookies. You can manage your preferences at any time through the cookie banner.

We may send you direct-marketing communications about products and services of the Odren Group, the Ephelia Group and selected commercial partners. You can unsubscribe at any time from the link included in each communication, or by emailing privacy@vetzy.io. Withdrawal does not affect the lawfulness of marketing carried out before withdrawal.

You have the right to lodge a complaint with a supervisory authority. Without prejudice to other administrative or judicial remedies, you can complain in particular to:

• United Kingdom: Information Commissioners Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk.
• European Union: the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. The full list is at edpb.europa.eu/about-edpb/board/members_en.
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.

We would appreciate the opportunity to address your concerns directly before you do so. Contact us at privacy@vetzy.io.

VETZY is not intended for children. Users must be at least 18 years old, or the age of legal majority in their country of residence if higher. We do not knowingly process personal data of children. If you believe a child has provided personal data to us, contact privacy@vetzy.io and we will delete the data without undue delay.

VETZY uses AI to deliver answers, rank results, recommend products and route queries. This processing involves a degree of automated reasoning and profiling, for example to identify the most relevant veterinary specialist near you or to assess whether a query should be escalated to a licensed vet.

These operations do not produce legal or similarly significant effects on you within the meaning of article 22 of the UK GDPR and the EU GDPR. A licensed veterinarian remains in the loop for any clinical question. You can always request human review by asking for it in the chat, or by writing to privacy@vetzy.io.

We may update this Notice to reflect changes to the Service, to our processing operations or to applicable law. The most recent version is always published at vetzy.io/privacy. For material changes that adversely affect you, we will give you at least 30 days\u2019 prior notice through the Service, by email or through a banner on vetzy.io.

For any question about this Notice, your data or your rights:

• Email: privacy@vetzy.io
• Postal mail: Odren Ltd, Data Protection, 7 Manchester Square, London, England, W1U 3PQ, United Kingdom
• For wallet-related processing: Ephelia SwissTech SA, Data Protection, Via Nassa 3A, 6900 Lugano, Switzerland

We do our best to respond clearly, promptly and free of charge.