Privacy Policy

1. Who controls your data

Vetsy is the data controller for the clinical and contact information described in this notice. You can reach us at hello@myvetsy.co.uk for any privacy question, request or complaint.

We process personal data under the UK GDPR and the Data Protection Act 2018. Our lawful bases are provision of veterinary care (contract), our legal duty to keep clinical records, and our legitimate interest in running a safe clinical service.

2. What we collect

Contact details: your name, mobile number and email where you give them. Pet details: name, species, breed, age, weight, allergies, medications and clinical history.

Clinical content: the messages you send to triage, the notes and SOAP records our clinicians write, appointment outcomes, and any photographs you choose to attach.

Operational data: appointment times, booking references, payment status and references, and audit records of who accessed or changed a clinical record.

3. Photographs and private media storage

Clinical photographs are stored privately. They are never placed in a public folder and there is no permanent public URL for them.

When a clinician or you need to view a photograph, the platform issues a short-lived signed link that expires. Access to clinical media is logged in our audit ledger.

4. How long we keep clinical records

Veterinary clinical records are kept to meet RCVS record-keeping expectations and our professional obligations. Records are retained for a minimum of seven years, and longer where a case is complex, ongoing or subject to a complaint.

Signed clinical records are immutable: they cannot be edited after sign-off. Corrections and later information are added as dated, attributed addenda so the clinical history stays intact.

Records created before the current platform went live are archived and reviewed under our retention schedule rather than deleted casually.

5. Sharing

We share clinical information only where it is needed for your pet's care: with the consulting veterinary surgeon, a practice you are referred to, an emergency provider you attend, or a pharmacy dispensing a prescription.

We use service providers for hosting, private file storage and messaging. They act on our instructions under contract. We do not sell your data and we do not share it for advertising.

6. No marketing spam

We do not add you to marketing lists because you booked a consultation or used triage. Any service email we send is transactional: a booking confirmation, a care summary you asked for, or a clinical follow-up.

We do not send promotional messages to client mobile numbers.

7. Your rights

You have the right to be informed, to access your data, to correct inaccurate data, to erasure where no legal retention duty applies, to restrict processing, to object, and to data portability.

Clinical records are subject to a legal retention duty, so an erasure request will usually be met by restricting access rather than deleting the clinical history. We will explain what we can and cannot do in response to your request.

To exercise any right, email hello@myvetsy.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

8. Security

Clinical data is held in access-controlled systems. Clinical entities are readable only by authorised staff accounts, and every clinical action is written to an audit ledger.

Client-facing links are capability links: the token in the link is the only credential, it is stored only as a hash, and it can be revoked. Treat your pass link like a password.

9. International transfers

Our platform providers may process data outside the UK. Where they do, transfers rely on the UK International Data Transfer Addendum or an adequacy decision, with contractual security commitments.

10. Changes

If we change how we handle clinical data, we will update this notice and change the date below. Material changes affecting existing clients will be explained in the consultation or by email.