LEGAL // PRIVACY

Privacy Policy

How VetIOS handles clinical data, inference traces, and operator telemetry across the platform mesh.

Data Collection Architecture

VetIOS is designed with a privacy-first clinical mesh. We collect three primary categories of data to facilitate veterinary intelligence:

Clinical Signal Ingress: Inputs provided for inference, including species, breed, symptoms, and vitals. This data is processed through our CIRE (Clinical Intelligence Runtime Engine).
Inference Traces: Metadata regarding model resolution, confidence bands, and performance metrics used for system optimization.
Operator Telemetry: Usage patterns within the console to ensure security, auditability, and platform stability.

Security & Encryption

Traffic is encrypted in transit with TLS 1.2 or later. The database is encrypted at rest by the hosting provider (Supabase). Row-level security scopes clinical rows to their tenant.

Third-Party Disclosure

VetIOS does not sell clinical data. Clinic-submitted data is not used to train model weights, and no pipeline reads tenant databases into training data. Outcome diagnostics are tenant-scoped and preserve the original inference scores. Displayed scores are not adjusted by legacy calibration tuples. Supabase (database, authentication, storage) and Vercel (application hosting) process all platform data; see data residency. Stripe processes billing. Clinical content leaves VetIOS infrastructure only for AI features: images in Ask VetIOS image analysis go to Anthropic, and images for vision inference and assistant text go to an OpenAI-compatible provider. The structured differential engine makes no external model call.

Who controls your data

VetIOS is the controller for VetIOS accounts, login and security telemetry, billing, fraud and security records, website analytics, direct support, and direct PetPass consumer accounts. For identifiable owner and patient information a clinic submits, the clinic is the controller and VetIOS processes it only on the clinic's instructions. These positions are pending counsel review.

Clinic-submitted data enters shared validation, research, federation, or population intelligence only in de-identified or aggregate form and only with the clinic's matching consent: deidentified_training for shared validation and research, network_learning for federation, population_signal for population intelligence. Direct patient and owner identifiers never do.

Where data is stored and processed

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Application processing: Vercel (serverless functions for the web app and API) in Vercel iad1, Washington, D.C., USA (AWS us-east-1) (observed 2026-09-26). Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

How each kind of data is used

This is the canonical data-use model. The support page and trust ledger render the same records.

VetIOS user accountvetios_account+

Name, email, and authentication identity of clinic staff and operators who sign in to VetIOS.

Controller: VetIOS, which decides the purposes and means.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Supabase Auth.
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Account terms.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Sign-in events, rate-limit and abuse signals, credential use, and security incident records.

Controller: VetIOS, which decides the purposes and means.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Not deleted: Security and fraud prevention (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: security investigation; fraud prevention; establishment or defence of legal claims.
Consent: Not consent-based; required to operate the service securely.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Billing recordbilling_record+

Subscription, invoice, and payment status records. Card data is handled by the payment processor, not VetIOS.

Controller: VetIOS, which decides the purposes and means.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Payment details are held by Stripe.
Retention: Kept for 7 years for tax and accounting obligations (pending counsel review).
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Not deleted: Tax and accounting record-keeping obligations (pending counsel review). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: tax; accounting; establishment or defence of legal claims.
Consent: Contract.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Payment processing is handled by Stripe on its infrastructure.

Direct support interactionsupport_interaction+

Emails and messages sent directly to VetIOS support.

Controller: VetIOS, which decides the purposes and means.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: The support mailbox.
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Initiated by the sender.
Cross-border transfer: Stays with VetIOS.

Website analyticswebsite_analytics+

VetIOS runs no website analytics or tracking scripts today. If introduced, VetIOS is the controller.

Controller: VetIOS, which decides the purposes and means.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Not collected.
Retention: Not collected.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Would require consent where the law requires it.
Cross-border transfer: Stays with VetIOS.

Direct PetPass consumer accountpetpass_consumer_account+

An owner account created directly with PetPass, including notification preferences.

Controller: VetIOS, which decides the purposes and means. Counsel to confirm: direct-to-owner PetPass processing may make VetIOS a controller beyond account data.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Supabase Auth and PetPass tables.
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Account terms; notification channels require owner opt-in.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Raw clinical caseraw_clinical_case+

Signalment, presenting signs, history, exam findings, lab values, and images a clinic submits.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Not used to train model weights. No pipeline reads tenant databases into training data.
Secondary use: Shared validation: de-identified derivations only, with deidentified_training consent. Research: de-identified derivations only, with deidentified_training consent. Federation: de-identified derivations only, with network_learning consent. Population intelligence: aggregates only, with population_signal consent.
Erasure: Hard-deleted on request.
Consent: Clinic authorization to submit the case. VetIOS rejects imports that carry direct patient or owner identifiers.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Images and free text sent to AI vision or assistant features are processed by an external model provider.

Patient identifierspatient_identifiers+

Patient names, microchip numbers, and similar direct identifiers.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Clinic authorization.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Not sent to external model providers by design; governance packets and CIRE snapshots exclude them.

Owner identifiers submitted by a clinicowner_identifiers+

Owner names and contact details held in a clinic's records.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Clinic authorization.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Not sent to external model providers.

Inference eventinference_event+

The input signature, ranked differentials, CIRE block, and lineage recorded for each inference.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Append-only; retained as the audit record of each output.
Training use: Not used to train model weights. No pipeline reads tenant databases into training data.
Secondary use: Shared validation: de-identified derivations only, with deidentified_training consent. Research: de-identified derivations only, with deidentified_training consent. Federation: de-identified derivations only, with network_learning consent. Population intelligence: aggregates only, with population_signal consent.
Erasure: Not deleted: Retained as the audit record of a clinical decision-support output that was published or gated (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: audit of published decisions; patient-safety investigation; establishment or defence of legal claims.
Consent: Clinic authorization.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. The structured differential engine makes no external model call. Image inputs are sent to an external model provider.

Outcome eventoutcome_event+

A confirmed diagnosis or outcome attached to a prior inference, with its evidence type.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Append-only; retained as the audit record of calibration and reliability statements.
Training use: Not used to train model weights. No pipeline reads tenant databases into training data.
Secondary use: Shared validation: de-identified derivations only, with deidentified_training consent. Research: de-identified derivations only, with deidentified_training consent. Federation: de-identified derivations only, with network_learning consent. Population intelligence: aggregates only, with population_signal consent.
Erasure: Not deleted: Retained as the audit record of a clinical decision-support output that was published or gated (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: audit of published decisions; patient-safety investigation; establishment or defence of legal claims.
Consent: Per-outcome learning_consent flags plus tenant-level consent scopes.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Derived calibration statisticderived_calibration_statistic+

Per-tenant calibration buckets: outcome counts, Brier score, and calibration error per label, species, and model version.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Append-only; retained for audit of every reliability statement made from it.
Training use: Supports tenant-scoped calibration assessment and CIRE reliability evidence. Eligibility gates apply; a linked outcome does not automatically change displayed confidence or model weights.
Secondary use: Shared validation: aggregates only, with deidentified_training consent. Research: aggregates only, with deidentified_training consent. Federation: aggregates only, with network_learning consent. Population intelligence: never.
Erasure: On request, the link to the tenant or person is removed and the anonymized record is kept.
Consent: Covered by the clinic's use of outcome confirmation.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

External model requestexternal_model_request+

Content sent to a third-party AI model provider: images for vision analysis and text for the assistant.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Transmitted to the provider for the request; the response is stored with the inference.
Retention: At the provider, under that provider's API data terms. VetIOS stores the response like any inference.
Training use: VetIOS does not use these requests to train models. Provider-side use is governed by the provider's API terms.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Hard-deleted on request.
Consent: Clinic use of the vision or assistant feature.
Cross-border transfer: Requests go to the provider's infrastructure (Anthropic; an OpenAI-compatible provider), whose location VetIOS has not verified. VetIOS cannot delete copies held by the provider.

Audit and governance logaudit_log+

Append-only records of governance gates, reliability packets, calibration snapshots, and review queues about clinic-submitted data.

Controller: The clinic (tenant) that submitted the data.
Processor: VetIOS, processing only on the clinic's instructions.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Append-only by database trigger; retained so every published decision stays auditable.
Training use: Never.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: never.
Erasure: Not deleted: Retained as the audit record of a clinical decision-support output that was published or gated (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: audit of published decisions; patient-safety investigation; establishment or defence of legal claims.
Consent: Not consent-based; required for audit.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Federated updatefederated_update+

A masked, de-identified contribution a consenting tenant publishes to a federation round.

Controller: VetIOS, which decides the purposes and means. VetIOS coordinates the aggregate; each contribution is gated on the tenant's network_learning consent.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: Aggregated into a network candidate artifact. The production engine is not retrained from it.
Secondary use: Shared validation: never. Research: never. Federation: this class is that use's output; every contribution required network_learning consent. Population intelligence: never.
Erasure: On request, the link to the tenant or person is removed and the anonymized record is kept.
Consent: Tenant network_learning consent and coordinator enrollment.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Aggregate epidemiology signalaggregate_epidemiology_signal+

Population-level counts and advisories with no clinic, patient, owner, or inference identifiers.

Controller: VetIOS, which decides the purposes and means. VetIOS decides how aggregates are computed and published; contributions are gated on population_signal consent.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).
Retention: Kept until a deletion request is executed. There is no automated retention or purge job.
Training use: No.
Secondary use: Shared validation: never. Research: never. Federation: never. Population intelligence: this class is that use's output; every contribution required population_signal consent.
Erasure: On request, the link to the tenant or person is removed and the anonymized record is kept.
Consent: Tenant population_signal consent for every contribution.
Cross-border transfer: Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Published aggregates are public once at least three clinics contribute.

Research exportresearch_export+

A de-identified dataset file prepared for research or shared validation.

Controller: VetIOS, which decides the purposes and means. VetIOS decides the export; each contributing record is gated on deidentified_training consent.
Processor: VetIOS, with the sub-processors listed in the privacy policy.
Storage: Files outside the production database, handled by the platform team.
Retention: Per export; no automated expiry.
Training use: Offline research models may be trained on curated export files. They are not the production clinical engine.
Secondary use: Shared validation: de-identified derivations only, with deidentified_training consent. Research: this class is that use's output; every contribution required deidentified_training consent. Federation: never. Population intelligence: never.
Erasure: Not deleted: De-identified copies already provided to research recipients cannot be recalled (pending counsel review). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: reproducibility of completed research.
Consent: The contributing tenant's deidentified_training consent and provenance tracking.
Cross-border transfer: Depends on the research recipient; disclosed per export.

Known gaps

No automated retention or purge schedule exists for any data class.
Erasure is executed by the platform team through the erasure ledger; there is no self-service erasure.
Controller and processor positions, retention periods, and legal bases are pending counsel review.
Where external AI model providers process requests has not been verified.

vetios-data-governance-2026-09-26b

Google API Services — User Data Policy

VetIOS uses Google OAuth through Supabase Auth for sign-in only. The integration requests standard OpenID Connect scopes and does not access Google Drive, Calendar, Gmail, Workspace APIs, or any other Google service. VetIOS requests minimum scopes only.

Data Accessed

Email address: The email scope is used as the unique account identifier.
Basic profile: The profile scope provides display name and profile picture for console personalisation.
OpenID sub-claim: The openid scope provides a stable Google-issued ID linking Google identity to the VetIOS Supabase account.

Data Usage

Google user data is used solely for authentication and for no other purpose.
Google user data is never used to train or improve VetIOS AI/ML models and is excluded from all inference, simulation, and outcome datasets.
Google user data is never sold, rented, or shared with third parties for advertising or any other purpose.
Google access tokens are handled by Supabase Auth and are not stored in VetIOS application databases beyond the encrypted Supabase session layer.

Revoking Access

You can revoke VetIOS Google access from your Google Account permissions page at myaccount.google.com/permissions.

To request VetIOS account deletion, contact privacy@vetios.tech.

AI/ML Model Training Exclusion

VetIOS does not use Google user data, including email, profile, or any Google-sourced information, to train, fine-tune, evaluate, or improve any AI or machine learning model. Any VetIOS training or evaluation workflow must use an explicitly approved, provenance-tracked dataset under the applicable consent and licensing controls. Google-sourced identity data is isolated from those workflows.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your Rights & Compliance

As a platform operator or partner, you retain ownership of your clinical inputs. Email privacy@vetios.tech to request export or deletion. The platform team handles requests, with a 30-day target, and records every action in an append-only erasure ledger. Data is hard-deleted where possible and anonymized where identity is unnecessary. Records that must be kept, such as the audit record of a published clinical decision, are restricted: the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to the recorded purposes. There is no automated retention or purge schedule today. Data is kept until a deletion request is executed. Learning uses are consent-scoped per tenant: deidentified_training (shared validation and research), network_learning (federation), and population_signal (population intelligence). Consent can be revoked; revocation does not unwind aggregates already produced.

Contact Privacy Team

For inquiries regarding GDPR, CCPA, or specific clinical data handling policies, please reach out to:

privacy@vetios.tech