Data Processing Addendum

This addendum forms part of the Terms of Use accepted by the professional or organization using SelfVet. For personal data entered under that customer’s decisions, the customer acts as controller and SelfVet’s operating company as processor. SelfVet’s own purposes, including accounts, security and contracting, follow the Privacy Policy. These obligations apply under the governing data protection laws, including GDPR Article 28 where relevant.

The subject is to provide the contracted veterinary management features. Processing may include collection, organization, retrieval, updates, hosting, document generation, exports and customer-initiated sharing. It covers owners, professionals and other people included in records: identification, contact details, addresses, appointments, financial information and pet-related content. Duration follows service provision and return/erasure procedures, subject to limited lawful retention.

The customer instructs processing through this contract, app settings and actions, and documented support requests. SelfVet will process data on the customer’s behalf only under those instructions, including transfers, unless legally required otherwise; it will then inform the customer beforehand where legally permitted. If it considers an instruction contrary to data protection law, it will inform the customer. The customer retains responsibility for the legal bases, notices to individuals and sharing permissions that fall to it.

Access must be limited to authorized people and what is necessary to provide, maintain and protect the service. People accessing data on the customer’s behalf must be bound by confidentiality commitments or an equivalent statutory duty. SelfVet will not sell customer content or make it available for AI training or website advertising.

SelfVet must adopt and maintain technical and organizational measures appropriate to risk and the contracted services. The environment uses Firebase authentication, cloud data/file services, APIs and HTTPS transmission where applicable. Measures must cover access management and review, confidentiality, credential protection, fixing vulnerabilities and assessing recovery capability. Device storage, exported files and shared links require customer protection. Further relevant information may be requested through support without exposing secrets or compromising security.

The customer generally authorizes technical providers that actually process data on its behalf to enable features, as listed for the purposes in the Privacy Policy. SelfVet must impose equivalent obligations on relevant subprocessors and remains responsible to the customer for its applicable obligations. Material subprocessor changes will be communicated before implementation, with a reasonable opportunity for substantiated objections and assessment of an alternative or ending the affected feature.

SelfVet must ensure transfers governed by data protection law use the mechanisms required for the specific flow, including under the GDPR, and provide information about safeguards upon request. This addendum alone does not replace necessary international transfer clauses or instruments.

Taking account of the processing and available information, SelfVet must assist the customer with individuals’ rights and applicable security, impact assessment and authority consultation obligations. Requests received directly about customer-controlled data will be forwarded to the customer unless legally required otherwise. Support must avoid excessive access or disclosure and respect appropriate identity and authorization checks.

Upon becoming aware of a personal data breach concerning data processed on the customer’s behalf, SelfVet must notify the customer without undue delay and provide available information about its nature, scope, consequences and measures, supplementing it where needed. The customer assesses its notifications to individuals and authorities with SelfVet’s assistance; this support does not remove either party’s own obligations.

At the end of service, SelfVet must, at the customer’s documented choice, return or erase data processed on its behalf and existing copies unless retention is legally required. Requests may be sent through the privacy contact; available app exports may support return. Related documents and attachments, integrations and residual copies must be checked; temporary technical retention must have restricted access, a limited purpose and erasure under the applicable cycle disclosed to the customer.

SelfVet must make available information necessary to demonstrate applicable obligations under this addendum and allow and contribute to legitimate customer or authorized auditor audits and inspections, with proportionate arrangements, confidentiality and protection of other customers. Practical limitations must be justified and cannot exclude legal requirements. The customer must communicate risks and requests through the contact identified in this document.

This addendum is binding together with acceptance of the Terms and remains applicable while processing on the customer’s behalf is subject to its obligations. Version and date appear in this document set. Material changes will be communicated and renewed acceptance requested where necessary. Requests and instructions must be sent to contato@selfvet.app.