Who we are and who this policy covers
The Optivet AI platform is offered by Optivet Referrals Ltd ("we", "us"), company number [●], registered office [●]. The platform is developed and hosted in part by our technology provider MGV TECH LTD (11 William Penn Way, Chichester, PO19 6ER, United Kingdom), acting as a sub-processor. This policy explains how personal data is handled on the platform under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers staff of subscribing veterinary clinics ("Clinics") who hold user accounts, and any individuals whose personal data a Clinic enters into the platform.
Our two roles
We process personal data in two distinct roles:
- As controller, for the data we need to run the platform as a business: user account data, clinic billing data, security and audit records, and error telemetry. For this data we decide the purposes and means of processing, and this policy is our privacy notice to the people concerned.
- As processor, for the clinical case content a Clinic submits: uploaded images, patient-record fields, feedback notes, and the analysis results generated from them ("Clinic Content"). The Clinic is the controller of Clinic Content; we process it only on the Clinic's documented instructions under the Data Processing Agreement. Questions about Clinic Content should go to the Clinic in the first instance.
What we process, why, and on what lawful basis
As controller:
- User accounts: name, email, bcrypt-hashed password (never the password itself), optional credentials suffix, role (owner, vet, staff, labeler, or platform admin), login activity, terms-acceptance timestamp — operating and securing accounts, proving terms acceptance — Contract (6(1)(b)); legitimate interests in platform security (6(1)(f)).
- Clinic billing data: clinic name, country, plan, quota, subscription status, Stripe customer reference — billing and account management, tax and accounting — Contract (6(1)(b)); legal obligation (6(1)(c)) for tax records.
- Audit events: event type, analysis, clinic and user identifiers, model version, thresholds, timestamps — clinical traceability of every inference, security accountability, regulatory defence — legitimate interests (6(1)(f)) in a reliable clinical audit trail; legal claims.
- Error telemetry: technical error reports (stack traces, release version, clinic and job identifiers) sent to our error-monitoring service when a fault occurs — detecting and fixing faults — legitimate interests (6(1)(f)) in a working, safe service.
As processor: Clinic Content, meaning uploaded fundus images, the free-text patient-record fields a Clinic chooses to populate (patient identifier, breed, age, sex, eye), feedback notes, and the generated analysis results. Images of animals are not personal data, but a Clinic may enter information in free-text fields (for example an owner's name used as a patient reference) that identifies a person. We do not require or validate the content of these fields; the Clinic controls what is entered and is responsible for having a lawful basis for it. Card details are captured and stored by Stripe directly; we never store full card numbers.
Providing account data is a contractual requirement of holding a user account: without a name, email address, and password we cannot create or secure the account or provide access to the Service. A legitimate interests assessment covering the purposes above is held and available on request.
Automated decision-making
The platform's outputs are screening aids read and acted on by a veterinary professional. We make no automated decisions about people that have legal or similarly significant effects within the meaning of UK GDPR Article 22.
Model improvement
We do not use Clinic Content to train or improve our models without the Clinic's separate written agreement. De-identified operational metrics (for example error rates, processing times, and aggregate quality statistics) are used to monitor and maintain the Service.
Retention
- Clinic Content (images, analyses, feedback). Retained for the life of the Clinic's subscription. If a subscription is cancelled, or the Clinic requests account deletion, Clinic Content is erased 90 days later; the window exists so the Clinic can export its records first.
- On a deletion request specifically, we act immediately as well: all of the Clinic's user accounts are deactivated, patient identifiers, breed, and free-text notes are removed from stored analyses and from audit-event payloads, and feedback notes are cleared. The remaining clinical records are then fully erased at the 90-day mark and the user accounts are anonymized.
- Audit events. The audit skeleton (event type, analysis and model identifiers, thresholds, timestamps; never images) is retained for 7 years from creation to support clinical record-keeping and accountability, then deleted. This period is enforced in software and cannot be shortened by configuration. During the life of a subscription, audit records also carry the patient identifiers associated with each analysis; on a deletion request those identifiers are removed from the audit records immediately, and only the skeleton is kept for the remainder of the 7 years.
- Billing records. Retained for as long as required by UK tax and accounting law (normally six years from the end of the relevant financial year), in addition to the periods above.
- Backups. Encrypted database backups are kept on a 14-day rolling window, and deleted storage objects are recoverable for 14 days, after which purged data ages out of backups automatically.
Your rights
If you are a Clinic staff member (or any person whose data we hold as controller), you have the rights UK GDPR gives you: access, rectification, erasure, restriction, portability, and objection, exercisable by contacting us at the address below. We will verify your identity and respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would welcome the chance to resolve any concern first.
For personal data inside Clinic Content, the Clinic is the controller: requests should be directed to the Clinic in the first instance, and we will assist the Clinic as its processor. In practice, a Clinic owner can export all of the Clinic's data and request account and data deletion from within the application (Settings, then Account), without needing our involvement.
Sub-processors and recipients
We use the following providers to run the Service:
- MGV TECH LTD — technology provider: develops and hosts parts of the platform on our behalf, using the onward providers below — United Kingdom.
- Microsoft Azure — application hosting, database, and image storage — United Kingdom (Azure UK South).
- Stripe — subscription billing and payment processing — United States; UK extension to the EU-US Data Privacy Framework and/or the UK International Data Transfer Addendum.
- Resend — transactional email (account and billing notices) — United States; UK International Data Transfer Addendum [● confirm on contract].
- Sentry (Functional Software, Inc.) — error monitoring for the application — [● EU or US data residency selected at account creation]; UK addendum/DPF as applicable.
- GitHub (Microsoft) — deployment automation and scheduled maintenance jobs that connect to our database (data transits job runners; none is stored there) — United States; UK extension to the EU-US Data Privacy Framework.
Primary processing and storage take place in the Azure UK South region. Where a provider processes data outside the UK, we rely on a recognised safeguard (an adequacy regulation, the UK International Data Transfer Addendum, or the UK extension to the EU-US Data Privacy Framework) before any transfer. A current provider list is available on request.
Security
Clinic data is isolated per clinic within the platform and every API request is checked against the caller's clinic. Connections are encrypted in transit (TLS, including certificate-verified connections to the database). Images live in private, non-public storage. Passwords are stored only as bcrypt hashes. Every inference is written to the audit log with the model version and threshold values used. Databases have 14-day point-in-time recovery and storage has 14-day soft delete with versioning; restore procedures are drilled quarterly. Dependencies are audited for known vulnerabilities on every build.
Cookies
The web application sets only the cookies necessary to keep you signed in. We do not set advertising or third-party analytics cookies. Error telemetry is collected without cookies.
Contact
Data protection queries: info@gvptech.eu. If required, a Data Protection Officer or UK representative will be confirmed before this policy is finalized.
Changes to this policy
This policy may be updated from time to time. Material changes will be notified to clinic owners by email in advance of taking effect.