Privacy policy
Last updated: 05.10.2026
This policy explains how VetLink processes personal data of clinic staff and pet owners in the portal, in line with GDPR, Brazil’s LGPD, Argentina’s Ley 25.326, and equivalent rules in Latin America.
Controller
- Name
- VetLink
Operator contact details are set in the platform environment (`PRIVACY_OPERATOR_*`).
Cookies
We use a session cookie (`vetalia-session`) to keep you signed in and the `XSRF-TOKEN` cookie to protect forms from CSRF. We do not use third-party advertising cookies.
Who is who
The veterinary clinic is the controller of owner and patient data. The VetLink platform is a processor on behalf of the clinic and a controller for staff account data.
What we collect
Login accounts (name, email, hashed password), owner contact details, pet medical records, inventory and billing records, and technical session data (IP, access time).
Purposes
To provide the CRM, the owner portal, reminders, clinic subscription billing, and support. We do not sell personal data.
Data processors (subprocessors)
The platform uses the processors listed below for infrastructure and integrations. The clinic is the controller of owner data; before enabling notification channels or billing, it should assess cross-border transfers (GDPR, LGPD, Ley 25.326).
Processors may be located outside the clinic’s country (including the US and EU). Only data needed for the stated purpose is transferred.
| Processor | Purpose | Data categories | Location | When used |
|---|---|---|---|---|
| Hosting provider (Beget / cloud infrastructure) | Application hosting, database, and backups | All CRM and portal data, uploaded files, access logs | Russia / deployment region | Always (platform operation) |
| Stripe, Inc. | Clinic SaaS subscription payments to the platform | Payer email and name, amount and currency, payment identifiers; card data is processed by Stripe — VetLink does not store it | US / EU (depends on Stripe account) | When `BILLING_GATEWAY=stripe` and clinic subscription checkout |
| Telegram (Telegram Messenger Inc.) | Notifications to the clinic or owner via Telegram Bot API | Chat ID, message text, and when needed name and contact from the CRM | UAE / Telegram global infrastructure | When the clinic connects Telegram in notification settings |
| Twilio Inc. | SMS and WhatsApp notifications to owners | Phone number, message text, clinic name | US / Twilio processing region | When the clinic enables SMS or WhatsApp via Twilio |
Retention
Data is kept while the account or clinic contract lasts, plus any extra period required by applicable law.
Rights
You may request access, correction, deletion, or objection. In the portal, owners can download a copy of their data, submit a deletion request, and update contact details in their profile. The clinic processes requests manually; for everything else, contact the clinic or the platform operator. See the “Data processors (subprocessors)” section below for the list of processors.