What VetIOS can prove, and what it cannot yet

Name, email, and authentication identity of clinic staff and operators who sign in to VetIOS.

Controller

VetIOS, which decides the purposes and means.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Supabase Auth.

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Account terms.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Sign-in events, rate-limit and abuse signals, credential use, and security incident records.

Controller

VetIOS, which decides the purposes and means.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Not deleted: Security and fraud prevention (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: security investigation; fraud prevention; establishment or defence of legal claims.

Consent

Not consent-based; required to operate the service securely.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Subscription, invoice, and payment status records. Card data is handled by the payment processor, not VetIOS.

Controller

VetIOS, which decides the purposes and means.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Payment details are held by Stripe.

Retention

Kept for 7 years for tax and accounting obligations (pending counsel review).

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Not deleted: Tax and accounting record-keeping obligations (pending counsel review). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: tax; accounting; establishment or defence of legal claims.

Consent

Contract.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Payment processing is handled by Stripe on its infrastructure.

Emails and messages sent directly to VetIOS support.

Controller

VetIOS, which decides the purposes and means.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

The support mailbox.

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Initiated by the sender.

Cross-border transfer

Stays with VetIOS.

VetIOS runs no website analytics or tracking scripts today. If introduced, VetIOS is the controller.

Controller

VetIOS, which decides the purposes and means.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Not collected.

Retention

Not collected.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Would require consent where the law requires it.

Cross-border transfer

Stays with VetIOS.

An owner account created directly with PetPass, including notification preferences.

Controller

VetIOS, which decides the purposes and means. Counsel to confirm: direct-to-owner PetPass processing may make VetIOS a controller beyond account data.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15). Supabase Auth and PetPass tables.

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Account terms; notification channels require owner opt-in.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Signalment, presenting signs, history, exam findings, lab values, and images a clinic submits.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Not used to train model weights. No pipeline reads tenant databases into training data.

Secondary use

Shared validation: de-identified derivations only, with deidentified_training consent. Research: de-identified derivations only, with deidentified_training consent. Federation: de-identified derivations only, with network_learning consent. Population intelligence: aggregates only, with population_signal consent.

Erasure

Hard-deleted on request.

Consent

Clinic authorization to submit the case. VetIOS rejects imports that carry direct patient or owner identifiers.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Images and free text sent to AI vision or assistant features are processed by an external model provider.

Patient names, microchip numbers, and similar direct identifiers.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Clinic authorization.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Not sent to external model providers by design; governance packets and CIRE snapshots exclude them.

Owner names and contact details held in a clinic's records.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Clinic authorization.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Not sent to external model providers.

The input signature, ranked differentials, CIRE block, and lineage recorded for each inference.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Append-only; retained as the audit record of each output.

Training use

Not used to train model weights. No pipeline reads tenant databases into training data.

Secondary use

Shared validation: de-identified derivations only, with deidentified_training consent. Research: de-identified derivations only, with deidentified_training consent. Federation: de-identified derivations only, with network_learning consent. Population intelligence: aggregates only, with population_signal consent.

Erasure

Not deleted: Retained as the audit record of a clinical decision-support output that was published or gated (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: audit of published decisions; patient-safety investigation; establishment or defence of legal claims.

Consent

Clinic authorization.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. The structured differential engine makes no external model call. Image inputs are sent to an external model provider.

A confirmed diagnosis or outcome attached to a prior inference, with its evidence type.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Append-only; retained as the audit record of calibration and reliability statements.

Training use

Not used to train model weights. No pipeline reads tenant databases into training data.

Secondary use

Shared validation: de-identified derivations only, with deidentified_training consent. Research: de-identified derivations only, with deidentified_training consent. Federation: de-identified derivations only, with network_learning consent. Population intelligence: aggregates only, with population_signal consent.

Erasure

Not deleted: Retained as the audit record of a clinical decision-support output that was published or gated (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: audit of published decisions; patient-safety investigation; establishment or defence of legal claims.

Consent

Per-outcome learning_consent flags plus tenant-level consent scopes.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Per-tenant calibration buckets: outcome counts, Brier score, and calibration error per label, species, and model version.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Append-only; retained for audit of every reliability statement made from it.

Training use

Used for tenant-local calibration of displayed confidence and for CIRE reliability_state. It does not change model weights.

Secondary use

Shared validation: aggregates only, with deidentified_training consent. Research: aggregates only, with deidentified_training consent. Federation: aggregates only, with network_learning consent. Population intelligence: never.

Erasure

On request, the link to the tenant or person is removed and the anonymized record is kept.

Consent

Covered by the clinic's use of outcome confirmation.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Content sent to a third-party AI model provider: images for vision analysis and text for the assistant.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Transmitted to the provider for the request; the response is stored with the inference.

Retention

At the provider, under that provider's API data terms. VetIOS stores the response like any inference.

Training use

VetIOS does not use these requests to train models. Provider-side use is governed by the provider's API terms.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Hard-deleted on request.

Consent

Clinic use of the vision or assistant feature.

Cross-border transfer

Requests go to the provider's infrastructure (Anthropic; an OpenAI-compatible provider), whose location VetIOS has not verified. VetIOS cannot delete copies held by the provider.

Append-only records of governance gates, reliability packets, calibration snapshots, and review queues about clinic-submitted data.

Controller

The clinic (tenant) that submitted the data.

Processor

VetIOS, processing only on the clinic's instructions.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Append-only by database trigger; retained so every published decision stays auditable.

Training use

Never.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: never.

Erasure

Not deleted: Retained as the audit record of a clinical decision-support output that was published or gated (pending counsel review of the exact legal basis). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: audit of published decisions; patient-safety investigation; establishment or defence of legal claims.

Consent

Not consent-based; required for audit.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

A masked, de-identified contribution a consenting tenant publishes to a federation round.

Controller

VetIOS, which decides the purposes and means. VetIOS coordinates the aggregate; each contribution is gated on the tenant's network_learning consent.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

Aggregated into a network candidate artifact. The production engine is not retrained from it.

Secondary use

Shared validation: never. Research: never. Federation: this class is that use's output; every contribution required network_learning consent. Population intelligence: never.

Erasure

On request, the link to the tenant or person is removed and the anonymized record is kept.

Consent

Tenant network_learning consent and coordinator enrollment.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified.

Population-level counts and advisories with no clinic, patient, owner, or inference identifiers.

Controller

VetIOS, which decides the purposes and means. VetIOS decides how aggregates are computed and published; contributions are gated on population_signal consent.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Data at rest: Supabase (Postgres, Auth, Storage) in AWS Europe (Ireland), eu-west-1 (observed 2026-09-15).

Retention

Kept until a deletion request is executed. There is no automated retention or purge job.

Training use

No.

Secondary use

Shared validation: never. Research: never. Federation: never. Population intelligence: this class is that use's output; every contribution required population_signal consent.

Erasure

On request, the link to the tenant or person is removed and the anonymized record is kept.

Consent

Tenant population_signal consent for every contribution.

Cross-border transfer

Requests are processed in United States and data is stored in Ireland (EU), so clinical data submitted to VetIOS crosses between those jurisdictions. Content sent to external AI model providers is processed on their infrastructure, whose location VetIOS has not verified. Published aggregates are public once at least three clinics contribute.

A de-identified dataset file prepared for research or shared validation.

Controller

VetIOS, which decides the purposes and means. VetIOS decides the export; each contributing record is gated on deidentified_training consent.

Processor

VetIOS, with the sub-processors listed in the privacy policy.

Storage

Files outside the production database, handled by the platform team.

Retention

Per export; no automated expiry.

Training use

Offline research models may be trained on curated export files. They are not the production clinical engine.

Secondary use

Shared validation: de-identified derivations only, with deidentified_training consent. Research: this class is that use's output; every contribution required deidentified_training consent. Federation: never. Population intelligence: never.

Erasure

Not deleted: De-identified copies already provided to research recipients cannot be recalled (pending counsel review). On request, the identity link is removed, the payload is minimized, the legal basis is recorded, and processing is limited to: reproducibility of completed research.

Consent

The contributing tenant's deidentified_training consent and provenance tracking.

Cross-border transfer

Depends on the research recipient; disclosed per export.