Privacy, in plain words.

The short version

• Your clinic owns its data. Client, pet and medical records belong to the clinic. We process them only to run Vetlyn for that clinic.
• We don’t sell personal data, and we don’t use clinic records for advertising.
• Each clinic is walled off. Database row-level security means one clinic can never read another clinic’s records.
• You can take everything with you. Clinics can export CSV files and a full JSON backup at any time.
• No analytics or advertising cookies are used today. See our cookie policy.

Who we are

Vetlyn (“Vetlyn”, “we”, “us”) provides an online practice management system for veterinary clinics, available at vetlyn.co, including Pawzaar at vetlyn.co/pawzaar. We are a team based in Pakistan, serving clinics in Pakistan, the Gulf, the United Kingdom and elsewhere.

You can reach us about anything in this policy at hello@vetlyn.co.

Clinic data vs. our data

Data protection law distinguishes between a controller (who decides why and how personal data is used) and a processor (who handles it on the controller’s instructions). Vetlyn plays both roles, for different data:

When the clinic is the controller

Everything a clinic enters into Vetlyn about its own clients, their animals and its own staff (client contact details, pet profiles, medical records, invoices, consent forms, employee records and so on) is clinic data. The clinic is the controller and Vetlyn is its processor. We use clinic data only to provide the service to that clinic, to keep it secure, and to give support when the clinic asks us to.

If you are a pet owner and want to see, correct or delete information a clinic holds about you, please contact the clinic directly. If you contact us instead, we’ll pass your request to the clinic and help them respond.

When Vetlyn is the controller

We are the controller for information about people who visit our website, contact us, subscribe to our product notes, or hold a Vetlyn user account (account details such as your name, email address and role), and for the technical logs we use to keep the service running.

Clinics that need a written data processing agreement can request one by emailing hello@vetlyn.co.

What we collect

Account information

• Your name, email address and password. Passwords are handled by our authentication provider and stored only in hashed form. We never see them.
• Which clinic(s) and branches you belong to, your role (owner, admin, vet, nurse or reception) and team invitations you send or receive.

Clinic data (processed for the clinic)

• Clients and patients: owner names, phone numbers, email and postal addresses; pet names, species, breed, age, microchip and other profile details.
• Clinical records: appointments, SOAP notes, vitals, prescriptions, vaccinations, referrals and referral letters, consent forms and signatures, and file attachments such as lab results or images.
• Operations: boarding stays and care logs, grooming, invoices, payments, coupons, expenses, services and prices, inventory, vendors and purchase orders.
• Staff: employee details, shifts and, where the clinic enters them, salaries.
• Imports: client lists a clinic uploads by CSV.

Things you send us

• Contact form: your name, email, and optionally phone, clinic name and country, plus the topic and message you write.
• Product notes: your email address if you subscribe to our monthly email.
• Support conversations: emails you send us and anything you choose to share in them.

Technical information

• Our hosting and database providers record standard request logs (IP address, browser and device type, the page or API requested, timestamps and error details). We use these to keep Vetlyn secure and to fix problems.
• The essential cookies and browser storage described in our cookie policy.

We don’t use third-party analytics, advertising trackers or social media pixels.

AI Scribe and dictation

AI Scribe lets a vet dictate notes. Today it uses the speech recognition built into your web browser. That means the audio is handled by your browser, not by Vetlyn. In Google Chrome, for example, speech is sent to and processed by Google under Google’s own terms and privacy policy; other browsers may behave differently.

• Vetlyn does not receive or store the audio recording.
• We only receive the text once the vet reviews it and places it into the SOAP fields of a record, where it is saved like any other clinic data.
• Clinics that prefer not to use browser speech recognition can simply type notes instead.

If we change how dictation works (for example, by adding our own transcription service), we will update this policy and the sub-processor list before the change goes live.

When a vet asks the AI to draft a SOAP note or an owner note, or asks a question in “Ask your clinic”, the text involved and the clinic records needed for the answer are sent to Anthropic, which runs the AI model, and the result comes straight back to the clinic. A vet always reviews a draft before it is saved. Vetlyn can switch AI features off for every clinic at any time.

Reminders and messaging

Vetlyn helps staff send vaccine, appointment and payment reminders by preparing a WhatsApp, SMS or email message. When a staff member clicks a reminder, it opens in the app on their own device (for example WhatsApp or their email program), and they send it from their own account. Vetlyn does not send these messages itself, and the message is then handled by that messaging provider under its own terms.

Account emails, such as sign-up confirmation, password reset and team invitations, are sent through our authentication provider, Supabase.

How we use data

• To provide Vetlyn: storing and displaying records, scheduling, billing, reminders, reports, exports and backups.
• To create and secure accounts, authenticate users and enforce each user’s role and clinic access.
• To answer contact-form messages, demo requests and support questions.
• To send product notes to people who subscribed (you can unsubscribe at any time).
• To keep the service secure, detect abuse, debug errors and plan capacity.
• To meet legal obligations, such as tax records once paid plans launch.

We do not use clinic data to train AI models, and we do not sell or rent personal data to anyone.

Legal bases

Where laws such as the EU or UK GDPR apply, we rely on the following legal bases for the data we control:

For clinic data, the clinic decides the legal basis for its own processing (for example, providing veterinary care to its clients).

Sharing and sub-processors

We share personal data only with the service providers that help us run Vetlyn, and only as much as they need. They are bound by contracts that require them to protect the data and use it only to provide their service to us.

We may also disclose information if required by law or a valid legal request, to protect the rights, safety or property of our users or others, or as part of a merger or acquisition (in which case we will tell affected clinics and this policy will continue to apply). We will tell clinics before adding a new sub-processor that handles clinic data by updating this page.

International transfers

Our main database is hosted in the European Union (Frankfurt, Germany). Some providers listed above operate globally, and our own team, based in Pakistan, may access data when it is needed to provide support a clinic has asked for or to fix a problem. This means personal data may be accessed from or transferred to countries outside the one you live in, including Pakistan and the United States, which may not have the same data protection laws as yours.

Where the law requires it, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses (and the UK addendum) offered in our providers’ data processing terms, and we limit staff access to what the task in hand needs.

Retention

• Clinic data is kept for as long as the clinic’s account is active. Clinics can delete individual records, export everything, or ask us to close the account. After closure, we delete clinic data from the live system, and remaining copies in our providers’ routine backups expire on their rolling schedule.
• Account information is kept while your account exists. You can ask us to delete your account at any time by emailing hello@vetlyn.co.
• Contact messages are kept for as long as we need them to deal with your enquiry and any follow-up, and then deleted.
• Product notes subscriptions are kept until you unsubscribe or ask us to remove you.
• Technical logs are kept for short periods set by our hosting and database providers.
• Billing records (once paid plans launch) are kept for as long as tax and accounting law requires.

Security

No system is perfectly secure, but these are the protections Vetlyn actually has in place today:

• Clinic isolation: every table that holds clinic data is protected by Postgres row-level security, so a signed-in user can only read and change records belonging to clinics they are a member of.
• Role-based access: each team member has a role (owner, admin, vet, nurse or reception) that limits what they can see and do. Salary information is visible only to owners and admins.
• Private files: attachments are kept in private storage and opened through signed links that expire after a short time, rather than public URLs.
• Encrypted connections: all traffic to Vetlyn uses HTTPS. Our database provider also encrypts stored data at rest.
• Hashed passwords managed by our authentication provider. We never store or see plaintext passwords.
• Your own copy: clinics can download CSV exports and a full JSON backup whenever they like.

If we become aware of a breach affecting personal data, we will notify affected clinics without undue delay so they can meet their own obligations, and notify regulators and individuals where the law requires.

Found a security issue? Please email hello@vetlyn.co and we’ll respond quickly.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that is wrong or incomplete;
• ask us to delete your data;
• restrict or object to certain processing, including any processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where we rely on consent (for example, product notes);
• complain to your local data protection authority (for example, the ICO in the UK or your EU supervisory authority).

To use any of these rights, email hello@vetlyn.co. We may need to confirm your identity first, and we aim to respond within one month. If your request concerns clinic data (for example, your pet’s medical history), we will refer it to the clinic, which as controller decides how to respond. We’ll help them do so.

Children

Vetlyn is a tool for veterinary professionals and is not directed at children. We do not knowingly collect personal data from children under 16 through our website or accounts. If you believe a child has given us personal data, please contact us and we will delete it. Clinics may record a minor as a pet owner or contact where that is appropriate for their practice; that data is clinic data and the clinic is responsible for it.

Changes to this policy

We will update this policy as Vetlyn grows, for example when paid plans launch or if we add new sub-processors. We’ll change the “last updated” date at the top, and for material changes we’ll let account owners know by email or in the app before the change takes effect.

Contact us

Questions, requests or concerns about privacy: hello@vetlyn.co, WhatsApp us on +92 308 8839304, or use our contact form. Please send formal data requests by email so we have a written record. Related documents: Terms of service and Cookie policy.