Data handling
The clinic is the controller of its clinical data and Veteros processes it on the clinic’s behalf. Prompts sent to AI models carry the species and breed, not owner names. Live clinic data never enters our development environments.
How we handle your clinic’s data
What is implemented, what is still being validated, and what we will not claim. This page is a summary, not legal advice, and it will change as our programme matures.
How we handle your clinic’s data
Encryption
Visit audio, documents and stored secrets are encrypted with AES-256-GCM before they are stored. The application is served over HTTPS with secure, HttpOnly session cookies. Encryption keys can be rotated; moving the root keys into a managed key service is still to do.
Clinic isolation
Every request runs with the clinic organisation taken from the signed-in session, and row-level security is enforced on every table, backed by database constraints that stop one clinic’s records pointing at another’s. This has been tested extensively in development and is being validated on the production database platform.
Role-based access
Six roles (owner, admin, veterinarian, relief veterinarian, technician and front desk) decide what each person can see and do. Only veterinarians can sign notes. Two-step sign-in is available and can be required by the organisation.
Recording consent
Each clinic chooses no consent step, a notice, or explicit consent recorded before the visit, with a versioned English and Arabic consent script. Withdrawing consent deletes the audio and stops drafting. The consent wording is with legal review.
AI sub-processors
Audio and text are processed by Google’s Gemini models (Gemini API paid service or Vertex AI). Under those paid terms Google does not use the data to train its models, and Veteros never uses clinic data to train models either. Accepting those terms on our production billing account is in progress. Files sent for processing are deleted after the call.
Data retention
Retention is set per clinic. By default audio is kept for 30 days and transcripts for 365 days; generated export files are deleted after 7 days. Automatic deletion of transcripts at the end of their retention period is still being completed.
Export and deletion
Clinics can export their data (JSON and CSV, with PDFs of signed notes) and handle access, correction, deletion and consent-withdrawal requests with built-in privacy tools. Offboarding includes a 30-day grace period.
Security practices
An append-only audit log records access and changes, with periodic access reviews. Passwords are hashed with scrypt and session tokens stored only as hashes. A breach register with a 72-hour clock supports notification duties. The app is hosted on Vercel with its functions in Frankfurt, Germany, and the database runs on Supabase in Frankfurt (eu-central-1).
Sub-processors
Google LLC (Gemini API paid service or Vertex AI)
Transcription and drafting
Data: Visit audio, transcripts, note text, record documents
Creem
Payments, as merchant of record
Data: Billing contact and subscription details
Vercel Inc.
Hosting the application (functions in Frankfurt, Germany)
Data: Everything the application processes, in transit and in memory
Supabase
The database (Frankfurt, Germany, eu-central-1)
Data: Records, notes, accounts and audit history
Cloudflare R2
Encrypted audio and document storage
Data: Audio and documents, encrypted by Veteros before storage
Resend
Email delivery
Data: Recipient address and message
Mixpanel
Product analytics (EU data residency)
Data: Pseudonymous ids, role, plan and feature use
Compliance progress
SOC 2
Veteros is preparing for a SOC 2 Type II audit. No audit has taken place yet, and there is no report to share.
GDPR and UAE PDPL
Veteros is designed to support clinics with their GDPR and UAE PDPL obligations through consent, export, deletion and audit features. That does not by itself make any clinic compliant, and it is not legal advice.
Legal documents
Our privacy notice, terms of use and cookies notice are published on this site, linked in the footer of every page. Questions about them: support@veteros.com.
Security or privacy questions? Write to support@veteros.com.
Privacy questions
Is clinic data used to train AI models?
Veteros does not use clinic data to train models. Audio and text are processed by Google’s Gemini models under paid-service terms that exclude training on the data. We are finalising those terms on our production account, and the Trust page will be updated when that is complete.
How is clinic data protected?
Audio and documents are encrypted with AES-256-GCM before they are stored, the application is served over HTTPS, each clinic’s data is separated at the database level, and an append-only audit log records access. Details, and what is still being validated, are on the Trust page.
How does recording consent work?
Each clinic chooses its consent step: none, a notice, or explicit consent recorded before the visit, with an English and Arabic consent script. If a client withdraws consent, the recording is deleted and no draft is written. Follow the law where your clinic operates.
Are you SOC 2 certified?
No. Veteros is preparing for a SOC 2 Type II audit. No audit has taken place yet, so there is no report to share. Our privacy features are designed to support clinics with GDPR and UAE PDPL obligations; that is not a statement of legal compliance.
Does Veteros diagnose or recommend treatment?
No. Veteros structures what the veterinarian said during the consultation. It does not diagnose, suggest treatment or give medical advice, and medical or pricing questions from clients are always for your team.