DATA PROCESSING AGREEMENT

Last updated: 29 October 2026

1. ABOUT THIS AGREEMENT

1.1 The parties. This Data Processing Agreement (the 'DPA') is made between Brahim Ouasti EI, trading as Inumbra Labs, an individual entrepreneur (entrepreneur individuel) registered in France in the national business register (Registre national des entreprises) under SIREN 538 543 034, intra-community VAT number FR24538543034, and which operates Vetty ('Vetty', 'we', 'us' or 'our'), and the veterinary practice that has accepted the Practice Terms (the 'Practice', 'you' or 'your').

1.2 How it applies. This DPA forms part of the Practice Terms at https://vetty.app/practice-terms, which incorporate it by reference. It applies to Vetty Pro as the Practice Terms define it: the Portal at pro.vetty.app, its Seats, the listing on the Marketplace, and the Consultations, records and reports handled through them. It does not cover Vetty Scribe, which has its own data processing agreement at https://vettyscribe.com/dpa.

1.3 Purpose. This DPA sets out the terms on which Vetty processes personal data on the Practice's behalf, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (the 'GDPR') and by the equivalent rules of the other Data Protection Laws.

1.4 Order of precedence. Where this DPA and the Practice Terms differ on the processing of personal data, this DPA prevails. Where the Standard Contractual Clauses apply under clause 10 and differ from this DPA, the Standard Contractual Clauses prevail.

1.5 Language. This DPA is written in English, and the English text governs. We publish translations into other languages; each is for convenience only.

2. DEFINITIONS

2.1 Terms defined in the Practice Terms (including Client, Consultation, Guest, Marketplace, Member, Participant, Portal, Practice Link, Seat and Veterinarian) have the same meaning in this DPA.

2.2 'Controller', 'processor', 'data subject', 'personal data', 'processing', 'personal data breach' and 'supervisory authority' have the meanings given in the GDPR. Under the other Data Protection Laws, they include the equivalent terms used there, such as 'organisation' and 'data intermediary' under the Singapore law.

2.3 In this DPA:

• Client Copies: the copies that a Client keeps in their own vetty.app account of their intake answers and attachments, of the messages and files exchanged in a Consultation's chat, and of the version of each signed report written for them.
• Data Protection Laws: the GDPR and the French data-protection law; the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the 'UAE PDPL'); the Singapore Personal Data Protection Act 2012 (the 'PDPA'); the Australian Privacy Act 1988, including the Australian Privacy Principles; and the New Zealand Privacy Act 2020; in each case as far as it applies to the processing.
• Practice Records: the personal data described in clause 3.1 and Annex 1.
• Standard Contractual Clauses: the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.
• Sub-processor: a third party that Vetty engages to process Practice Records.

3. ROLES AND SCOPE

3.1 Vetty as processor. The Practice is the controller, and Vetty is the processor, of the Practice Records, which are:

• (a) the Practice's client and patient records in the Portal: the clients and patients it adds or imports, and its notes on clients, patients and appointments;
• (b) the content of each Consultation as it is held for the Practice: the Client's intake answers and attachments; the messages and files exchanged in the chat; the recording of each Participant's microphone, until it is deleted; the record of each Participant's consent or refusal to recording; the transcript; and the draft and signed report, both the clinical note and the version written for the Client;
• (c) the files the Practice adds to appointments; and
• (d) any other personal data that the Practice or its Members enter into the Portal about the Practice's clients and patients.

3.2 Vetty as controller. Vetty is an independent controller, and this DPA does not apply, for owner accounts and marketplace data, as our Privacy Policy at https://vetty.app/privacy-policy describes. This covers:

• (a) the accounts of pet owners on vetty.app, their profiles and the pets they register there;
• (b) the Client Copies;
• (c) bookings, payments, refunds, cancellations, no-shows, reviews and the records of New-Client Fees;
• (d) the Marketplace: the public profiles and listings of Practices and Veterinarians;
• (e) the accounts of Members, their licences and the licence review;
• (f) the security, fraud-prevention, rate-limiting and error records of the service, and consent records for cookies.

3.3 Data held in both roles. Some content exists both in the Practice Records and as a Client Copy: the intake, the chat, and the version of each signed report written for the Client. Vetty holds the Practice's copy as processor under this DPA, and the Client Copy as controller so that the Client keeps access to it. The end of this DPA, or the closing of the Practice, ends the first and not the second. Both are deleted at the end of the period in clause 13.1.

3.4 Details of the processing. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, and the categories of personal data and of data subjects.

4. THE PRACTICE'S INSTRUCTIONS AND OBLIGATIONS

4.1 Documented instructions. The Practice instructs Vetty to process the Practice Records to provide Vetty Pro as the Practice Terms describe, including to record, transcribe and draft reports as clause 7 describes and to retain and delete them as clause 13 describes. The Practice Terms, this DPA, the Practice's use and configuration of the Portal, and any other written instruction the Practice gives and Vetty accepts, are the Practice's complete documented instructions.

4.2 The Practice's obligations. The Practice:

• (a) is responsible for having a lawful basis for the Practice Records and for Vetty's processing of them under this DPA;
• (b) tells its clients how their data is handled, including that a Consultation is recorded and transcribed only with every Participant's consent, that reports are drafted with artificial intelligence and reviewed and signed by the Veterinarian, and that the records are kept with Vetty;
• (c) answers its clients' requests about the Practice Records, with Vetty's assistance under clause 11;
• (d) keeps the records that its regulator and the law require, exporting them where it must keep them longer than Vetty does; and
• (e) gives Vetty only instructions that comply with the Data Protection Laws.

5. VETTY'S OBLIGATIONS

5.1 Instructions. Vetty processes the Practice Records only on the Practice's documented instructions, including with regard to transfers to a third country, unless a law of the European Union or of a Member State to which Vetty is subject requires otherwise. In that case Vetty tells the Practice of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

5.2 Unlawful instructions. Vetty tells the Practice at once if, in its opinion, an instruction infringes the Data Protection Laws. Vetty may suspend the processing concerned until the Practice confirms or changes the instruction.

5.3 Confidentiality. Vetty ensures that every person it authorises to process the Practice Records is bound by an obligation of confidentiality, by contract or by law, and processes them only as needed to provide the service.

5.4 Security. Vetty implements the technical and organisational measures in Annex 3, which are designed to meet Article 32 of the GDPR. Vetty may change them over time, provided that the overall level of protection is not reduced.

5.5 No other use. Vetty does not sell the Practice Records, does not use them for its own purposes, and does not use them, or let any Sub-processor use them, to train artificial intelligence models.

5.6 Assistance. Taking into account the nature of the processing and the information available to it, Vetty assists the Practice in meeting its obligations under Articles 32 to 36 of the GDPR: security, the notification of personal data breaches, data protection impact assessments and prior consultation of a supervisory authority. Vetty provides the information it holds about the processing, such as this DPA and its annexes, and answers reasonable questions.

6. PERSONNEL AND INCIDENT OWNER

Brahim Ouasti is Vetty's privacy contact and is responsible for data protection and incidents at Vetty. He may be reached at privacy@vetty.app. Clause 15.4 sets out his role under the PDPA.

7. RECORDING, TRANSCRIPTION AND AI DRAFTING

7.1 Consent collected for the Practice. Before joining a Consultation, each Participant, Guests included, is asked whether they consent to the recording and transcription of the Consultation's audio. Vetty collects and stores each answer, with the time it was given, on the Practice's behalf. If any Participant declines, the Consultation runs without recording, and no transcript and no draft report are produced.

7.2 What is recorded and when it is deleted. Only each Participant's microphone audio is recorded; video and screen sharing are never recorded. The audio is stored in a private storage area in Frankfurt, Germany, transcribed after the Consultation, and deleted as soon as the transcript is stored. The audio of a Consultation that does not complete is deleted at once, and in any event within 24 hours.

7.3 Transcription. The audio is transcribed by the speech-to-text Sub-processor named in Annex 2. Once Vetty has retrieved a transcript, it asks that Sub-processor to delete its copy of the transcript.

7.4 AI drafting. The draft report is prepared by the AI Sub-processors named in Annex 2 from the transcript, the Client's intake answers and the patient's profile. The Veterinarian reviews, corrects and signs the report, and only a signed report reaches the Client. No decision producing legal effects for a Client, or similarly significantly affecting them, is taken solely by automated means.

7.5 AI providers and training. Vetty has no zero-retention agreement with its AI providers. They may keep inputs for a short period for abuse monitoring under their own terms. None of them may train their models on the Practice Records: Anthropic's commercial terms bar training on customer content; OpenAI does not use data sent through its API for training unless the customer opts in, which Vetty has not done, and keeps abuse-monitoring logs for up to 30 days; and Vetty has opted out of training in its ElevenLabs account's data-use settings.

8. SUB-PROCESSORS

8.1 General authorisation. The Practice gives Vetty general written authorisation to engage Sub-processors. The Sub-processors in place on the date of this DPA are listed in Annex 2, and the Practice authorises them.

8.2 Sub-processor contracts. Vetty engages each Sub-processor under a written contract that imposes data-protection obligations providing the same level of protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. Vetty remains fully liable to the Practice for the performance of each Sub-processor's obligations.

8.3 Changes. Vetty tells the Practice at least 30 days before it adds or replaces a Sub-processor, by email to the Practice's Administrators and by updating Annex 2. Where a change is urgently needed to keep the service secure or running, Vetty may make it sooner and tells the Practice as soon as it can, with its reasons.

8.4 Objection. The Practice may object to a new Sub-processor in writing to privacy@vetty.app within that notice period, on reasonable data-protection grounds. Vetty will consider the objection in good faith and propose a solution where one is reasonably available. If the parties cannot resolve the objection, the Practice may end the Practice Terms by closing the Practice before the change takes effect, and Vetty refunds the unused part of any Subscription period paid in advance.

9. WHERE THE PRACTICE RECORDS ARE PROCESSED

9.1 Storage in the European Union. Vetty is established in France. The Practice Records are stored in the European Union, in Frankfurt, Germany, where Vetty's database, file storage and server functions run.

9.2 Processing outside the European Union. Some Sub-processors process Practice Records outside the European Economic Area, as Annex 2 shows:

• (a) the speech-to-text and AI drafting Sub-processors process them in the United States;
• (b) the email Sub-processor processes names, email addresses and notification content in the United States;
• (c) the video Sub-processor, LiveKit, routes the live audio and video of each Consultation through the LiveKit server nearest each Participant, which may be outside the European Economic Area, and keeps the session records and logs it retains in its project data region, the United States;
• (d) the hosting Sub-processor, Vercel, is established in the United States and delivers the Portal through its worldwide network; and Sub-processors established in the United States, including Supabase, Upstash and PostHog, may reach Practice Records stored in Frankfurt from there, for example to support or maintain their service.

10. INTERNATIONAL TRANSFERS

10.1 Transfers to Sub-processors. Where a Sub-processor processes Practice Records in a country outside the European Economic Area that has no adequacy decision of the European Commission, or reaches them from such a country, the transfer is covered by the EU–US Data Privacy Framework where the Sub-processor is certified under it, otherwise by the European Commission's standard contractual clauses (Module 3, processor to processor) in the Sub-processor's contract with Vetty, together with any supplementary measures the transfer requires. Annex 2 gives the safeguard for each Sub-processor.

10.2 Practices established outside the European Economic Area. Vetty is a processor established in the European Union. Where the Practice is established in a country outside the European Economic Area that has no adequacy decision of the European Commission (at the date of this DPA, the United Arab Emirates, Australia and Singapore, but not New Zealand), and to the extent the GDPR requires it, Module 4 (processor to controller) of the Standard Contractual Clauses applies to the transfer of Practice Records from Vetty to the Practice and is incorporated into this DPA by reference, with these choices:

• (a) Vetty is the data exporter and the Practice is the data importer;
• (b) the optional docking clause (Clause 7) does not apply;
• (c) Clause 17: the clauses are governed by French law;
• (d) Clause 18: disputes are resolved by the courts of Pontoise, France;
• (e) Annex I.A: the parties are those in clause 1.1, with the addresses given there and in the Portal; the data exporter's contact is Brahim Ouasti at privacy@vetty.app, and the Practice's contact is the one held in the Portal; Annex I.B is Annex 1 of this DPA.

10.3 Transfers under other laws. Where the Data Protection Law of the Practice's country restricts the transfer of the Practice Records to Vetty in France or onward to a Sub-processor, the parties agree that this DPA, and where relevant the Standard Contractual Clauses, are the contractual safeguard for that transfer, and clause 15 applies.

11. DATA SUBJECTS' REQUESTS

11.1 Assistance. Taking into account the nature of the processing, Vetty assists the Practice, by appropriate technical and organisational measures and as far as possible, to answer requests from data subjects to exercise their rights over the Practice Records. The Portal lets the Practice see, correct and export the Practice Records. For anything the Portal does not allow, the Practice may write to privacy@vetty.app, and Vetty will help without undue delay.

11.2 Requests made to Vetty. If Vetty receives a request about Practice Records from a data subject, it passes it to the Practice without undue delay and does not answer it itself, except to tell the person that it has been passed on or where the law requires Vetty to answer. A request that concerns data for which Vetty is the controller, including the Client Copies, is answered by Vetty under its Privacy Policy.

12. PERSONAL DATA BREACHES

12.1 Notice to the Practice. Vetty notifies the Practice without undue delay, and in any event within 48 hours of becoming aware of it, of any personal data breach affecting the Practice Records. Notice is given by email to the Practice's Administrators.

12.2 Content of the notice. The notice describes, as far as Vetty then knows: the nature of the breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and to mitigate its effects; and the contact point for more information. Where Vetty cannot give all of this at once, it gives it in stages without further undue delay.

12.3 Who notifies the authorities and the people concerned. The Practice, as controller of the Practice Records, decides on and makes any notification to its supervisory authority and to the data subjects concerned. Vetty gives the Practice the information and help it reasonably needs to do so. Vetty does not notify the Practice's supervisory authority or the Practice's clients about a breach of the Practice Records on the Practice's behalf, unless the Practice asks it to or the law requires it. Where the same breach also affects data for which Vetty is the controller, including the Client Copies, Vetty makes its own notifications: to the CNIL without undue delay and, where the GDPR requires notification, within 72 hours of becoming aware of the breach; to any other competent authority within the time applicable law requires; and to the people affected where the law requires it.

12.4 Containment. Vetty takes reasonable steps to contain the breach, limit its effects and prevent it from happening again. A notice under this clause is not an admission of fault or liability.

13. RETENTION, DELETION AND RETURN

13.1 Retention during the service. On the Practice's instruction in clause 4.1, Vetty deletes the content of each Consultation (the intake, the chat messages and files, the transcript and the report) 5 years after the Client's last Consultation with the Practice. The audio is deleted earlier, as clause 7.2 describes. The Practice's other client and patient records are kept while the Practice's account is open. The Practice may ask Vetty in writing to delete particular Practice Records sooner, and Vetty will do so unless the law requires it to keep them; this does not affect the Client Copies.

13.2 Return. While the Practice is open, an Administrator can download an export of the Practice Records from the practice settings at any time: a ZIP file of the consultation records and signed reports, transcripts as text, and lists of the Consultations, clients, patients and notes. Audio is not included, because it is deleted once transcribed.

13.3 At the end of the service. When the Practice is closed, or the Practice Terms end for any other reason, the person who closed the Practice can download the export for 30 days. At the end of those 30 days, Vetty deletes the Practice Records as clause 16 of the Practice Terms describes, unless the law of the European Union or of a Member State requires Vetty to keep them. By accepting this DPA, the Practice chooses this combination of return and deletion. The Client Copies are not Practice Records and stay in the Client's account until the end of the period in clause 13.1.

13.4 Backups. Deleted data remains in Vetty's backups until they are overwritten, which happens within 30 days. Vetty does not restore deleted data from backups except to recover from an incident.

13.5 Confirmation. On the Practice's written request, Vetty confirms in writing that the Practice Records have been deleted.

14. INFORMATION AND AUDITS

14.1 Information. Vetty makes available to the Practice all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, starting with this DPA and its annexes and its written answers to the Practice's reasonable questions.

14.2 Audits. Where that information is not enough to demonstrate compliance, or where a supervisory authority requires it, Vetty allows for and contributes to audits, including inspections, conducted by the Practice or by an independent auditor it mandates, on these conditions:

• (a) the Practice gives at least 30 days' written notice and a proposed scope;
• (b) no more than one audit takes place in any 12 months, unless a supervisory authority requires another or a personal data breach of the Practice Records has occurred;
• (c) the audit takes place during business hours, without unreasonably disrupting Vetty's operations, and is limited to the processing of the Practice's own Practice Records;
• (d) the auditor is bound by confidentiality, is not a competitor of Vetty, and does not access other customers' data or information whose disclosure would compromise the security of the service;
• (e) each party bears its own costs, and the Practice pays the auditor.

Vetty tells the Practice at once if it considers that an instruction given in an audit infringes the Data Protection Laws.

15. COUNTRY-SPECIFIC TERMS

15.1 How this clause works. The rest of this DPA applies to every Practice. This clause adds what the Data Protection Law of the Practice's country requires in addition. Each party complies with the Data Protection Laws that apply to it.

15.2 European Union. For a Practice established in Cyprus, Spain, Greece, Italy or Portugal, this DPA is the contract required by Article 28(3) of the GDPR, and the Practice's supervisory authority is the authority of its own Member State. Vetty's lead supervisory authority is the French Commission nationale de l'informatique et des libertés (CNIL).

15.3 United Arab Emirates. For a Practice established in the United Arab Emirates, outside the financial free zones that have their own data-protection law, Vetty acts as the Practice's processor under the UAE PDPL. Vetty processes the Practice Records only on the Practice's instructions and for the purposes in Annex 1, applies the measures in Annex 3, notifies the Practice of breaches as clause 12 describes, and deletes the Practice Records as clause 13 describes. The Practice remains responsible for any notification to the UAE Data Office and to data subjects, and for the lawfulness of transferring the Practice Records to Vetty outside the United Arab Emirates.

15.4 Singapore. For a Practice in Singapore, Vetty acts as the Practice's data intermediary under the PDPA. Vetty's Data Protection Officer for the purposes of the PDPA is Brahim Ouasti, at privacy@vetty.app. Vetty protects the Practice Records by reasonable security arrangements, ceases to retain them when they are no longer needed for the purposes in Annex 1, as clause 13 describes, and notifies the Practice without undue delay, and within the 48 hours in clause 12.1, when it has reason to believe a data breach has occurred in relation to them. The Practice remains responsible for assessing whether a breach is notifiable and for notifying the Personal Data Protection Commission and affected individuals within the time the PDPA requires. For the Transfer Limitation Obligation, this DPA binds Vetty, and through their contracts its Sub-processors, to give the Practice Records a standard of protection comparable to that of the PDPA.

15.5 Australia. For a Practice in Australia that is bound by the Privacy Act 1988, Vetty handles the Practice Records consistently with the Australian Privacy Principles that apply to their security, use, disclosure and overseas disclosure, and helps the Practice assess a suspected eligible data breach under the Notifiable Data Breaches scheme within the 30 days that scheme allows. The Practice remains responsible for notifying the Office of the Australian Information Commissioner and affected individuals.

15.6 New Zealand. For a Practice in New Zealand, Vetty holds the Practice Records as the Practice's agent for the purposes of section 11 of the Privacy Act 2020, solely to provide the service, and does not use or disclose them for its own purposes. The Practice remains responsible for notifying a notifiable privacy breach to the Privacy Commissioner and affected individuals.

16. LIABILITY

16.1 The Practice Terms apply. Each party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the exclusions and limits in clause 21 of the Practice Terms, and counts towards the single cap set there. This DPA does not create a second cap.

16.2 Data subjects and authorities. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR or under the other Data Protection Laws, or the rights of data subjects under the Standard Contractual Clauses. Each party bears any fine imposed on it by a supervisory authority.

17. TERM, LAW AND CHANGES

17.1 Term. This DPA takes effect when the Practice accepts the Practice Terms and lasts for as long as Vetty processes Practice Records. Clauses 12, 13, 14 and 16 survive for as long as they are relevant.

17.2 Law and courts. This DPA is governed by French law, and the courts of Pontoise, France, have exclusive jurisdiction, as clause 24 of the Practice Terms provides, except where the Standard Contractual Clauses provide otherwise.

17.3 Changes. Vetty may change this DPA as clause 23 of the Practice Terms describes, with at least 30 days' notice of a material change, except for a change to Annex 2, which follows clause 8.3. No change may reduce the protection this DPA gives the Practice Records below what the Data Protection Laws require.

18. CONTACT

Brahim Ouasti EI, trading as Inumbra Labs
Individual entrepreneur (entrepreneur individuel) registered in France (RNE), SIREN 538 543 034, intra-community VAT number FR24538543034
Privacy contact, data protection and incidents: Brahim Ouasti, privacy@vetty.app

ANNEX 1. DETAILS OF THE PROCESSING

Subject matter. Hosting and handling the Practice Records so that the Practice can hold video Consultations with its clients through Vetty Pro, keep its client and patient records, and receive draft consultation reports for its Veterinarians to review and sign.

Duration. For as long as the Practice uses Vetty Pro, then until the deletion described in clause 13. The audio of a Consultation is kept only until it is transcribed, and at most 24 hours if the Consultation does not complete.

Nature of the processing. Collection, recording, storage, organisation, transcription by speech-to-text, automated drafting by AI models, display to the Practice's Members, transmission of signed reports to Clients, export, and deletion. Live audio and video are transmitted but not stored, except the microphone audio recorded with every Participant's consent.

Purposes. To provide the Consultation and its chat; to collect and record each Participant's consent to recording; to record, transcribe and draft a report for the Veterinarian's review; to deliver the signed report to the Client; to keep, display and export the Practice's client and patient records; and to delete them at the end of the retention period or of the service.

Categories of data subjects.

• the Practice's clients (pet owners), including people it adds or imports to the Portal;
• Guests whom a Client invites to a Consultation;
• the Practice's Members, as far as they appear in the Practice Records (for example as the author or signer of a note or report, or as a voice in a recording).

Animals are not data subjects, but the data about them is linked to their owners.

Categories of personal data.

• identity and contact details of clients: name, email address, phone number, and postal addresses where given;
• patient data linked to the client: the animal's name, species, breed, date of birth, sex, neuter status, weight, microchip number, photo, allergies, medications, chronic conditions and history;
• intake answers and attachments (images);
• chat messages and files (images and PDF documents);
• the audio of each consenting Participant's microphone, their name as shown in the call, and the record of each Participant's consent or refusal to recording, with its time;
• the transcript, with speakers identified by role;
• the draft and signed report, the Veterinarian's notes and the Practice's notes;
• files the Practice adds to appointments.

Special categories. The Practice Records are not intended to contain special categories of personal data. A Consultation may reveal some incidentally, for example a fact about a Client's health mentioned during the call, and Vetty applies the same measures to it. Vetty does not use voices to identify anyone.

Frequency. Continuous, for as long as the Practice uses Vetty Pro.

Competent supervisory authority for Vetty. The Commission nationale de l'informatique et des libertés (CNIL), France.

ANNEX 2. SUB-PROCESSORS

These Sub-processors process Practice Records for Vetty Pro on the date of this DPA. Each is engaged under clause 8. In the last column, 'DPF or SCCs' means the EU–US Data Privacy Framework where the Sub-processor is certified under it, otherwise the standard contractual clauses (Module 3), as clause 10.1 describes.

Stripe is not a Sub-processor under this DPA. The Practice contracts with Stripe directly for its Stripe Account, and Vetty's own use of Stripe data is covered by its Privacy Policy.

ANNEX 3. TECHNICAL AND ORGANISATIONAL MEASURES

Location and hosting. The Practice Records are stored in the European Union, in Frankfurt, Germany, with an established hosting provider whose storage is encrypted at rest.

Encryption in transit. All traffic to vetty.app and pro.vetty.app is served over HTTPS, and browsers are told to use HTTPS only (HTTP Strict Transport Security). Video and audio are carried over encrypted WebRTC connections.

Access control. Database access rules limit each user to the data of their own Practice or their own account, and each new table and function is given explicit access rights. Practice Records are held in private storage. A Member's access to the Practice Records ends at once when they are removed or leave. Administrators control who belongs to the Practice and in which role.

Consultation audio. The audio is kept in a separate private storage area that no user account can reach, only Vetty's servers. Each upload credential is limited to a single file and expires after 6 hours. The audio is deleted once the transcript is stored, and the Participant's name is then cleared from the recording's record. Video and screen sharing are never recorded.

Files. Files are reached through signed links that expire after 6 hours, or through authenticated requests to Vetty's servers. Exports are downloaded only through an authenticated request, never through a public link. The type of each uploaded file is checked from its content, and sizes are limited.

Authentication. Every email address is confirmed with a one-time code before use. Passwords must have at least 8 characters and are stored by the authentication service in hashed form. Members may sign in with Google instead. Sign-up and other sensitive requests are rate-limited.

Operator access. Vetty's operator console can be used only by named operator accounts that Vetty has authorised, and each operator action is written to an audit log.

Payment data. Card data is collected and held by Stripe and never reaches Vetty's servers.

Data minimisation and retention. Audio is deleted once transcribed. The speech-to-text provider's copy of each transcript is deleted once retrieved. Consultation content is deleted 5 years after the Client's last Consultation with the Practice, and the Practice Records 30 days after the Practice is closed, as clause 13 describes. Backups are overwritten within 30 days.

Sub-processors. Each Sub-processor is engaged under a written contract with data-protection obligations, and none may train AI models on the Practice Records.

People. Everyone Vetty authorises to process Practice Records is bound by confidentiality. Brahim Ouasti is responsible for data protection and for handling incidents.