Privacy Policy

This Privacy Policy is issued by the viggoVet group of companies. The specific entity responsible for your personal data (the “controller”) depends on your location and is identified in our Legal Entities document (the “Entities Document”). In this Policy, “viggoVet”, “we”, “us”, and “our” refer to that responsible entity and to the viggoVet group as a whole.

This Policy works together with our Terms of Use, Cookie Policy, and, for business customers, our Data Processing Addendum (DPA). If there is any conflict on a data-protection matter, a signed DPA prevails over this Policy for Service Data (defined below).

Our privacy commitment

We believe privacy is a fundamental right, not a feature. We collect only the minimum personal information needed to operate our business and provide our services. We have four firm commitments:

• We never sell your personal data, and we never use it for third-party advertising. We have no advertising business.
• We do not use your data internally for our own purposes beyond providing, securing, and supporting the services you use.
• We never train artificial intelligence models on your personal data or on the data you entrust to us. Any analysis we perform to operate and improve our infrastructure uses only anonymised, aggregated data (see “Artificial intelligence and analytics” below).
• You own your data. We store it in encrypted databases located according to your region, and you remain in control of it.

Scope, structure, and our two roles

This Policy applies to the viggoVet websites, mobile and web applications, the base platform, our own clinical and AI modules, our APIs, SDK, and MCP interfaces, and any application we publish in third-party marketplaces, in each case where they link to this Policy. If a specific product has its own privacy notice, that notice applies to that product in addition to this Policy.

We handle personal data in two different roles, and your rights and our responsibilities differ between them:

• As a controller (Part I). For information about visitors, prospects, and account holders that we collect and decide how to use ourselves (for example website, account, billing, and marketing data), we are the controller.
• As a processor (Part II). For the data that a customer (for example a veterinary practice) puts into the platform about its own patients, clients (pet owners), and staff (“Service Data”), the customer is the controller and viggoVet is the processor. We act only on the customer’s instructions under the DPA.

Part III sets out principles and rights that apply to both roles.

Key terms

• Personal data / personal information: information relating to an identified or identifiable individual.
• Service Data: data that a customer or its users submit to, store in, or generate through the platform about the customer’s own patients, clients, staff, and operations. Service Data is owned and controlled by the customer.
• Customer: the organisation or individual professional (for example a clinic, hospital, group, university, or an individual veterinarian operating a workspace) that has an account and on whose behalf we process Service Data.
• Pet owner / client: an individual who uses our pet-owner client app to communicate with, and obtain services from, a clinic. Data about pet owners that a clinic holds is Service Data controlled by that clinic.
• Controller / processor / sub-processor: have the meanings given under applicable data-protection law (for example the GDPR).
• Third-party module: an application, integration, or module built by an independent developer using our SDK, API, or MCP interfaces and made available (free or paid) through our platform or marketplace.

Part I, Information viggoVet collects and controls

Information you provide to us

• Account sign-up: your name, email, phone number, organisation name, country, and password.
• Forms and events: information you submit to download content, register for webinars, contact us, or request support.
• Payments: billing contact details, payment method type, and partial card data (such as the last four digits and expiry). Full card details are handled directly by our PCI-compliant payment processors and are not stored by us.
• Testimonials: if you authorise it, we may publish a testimonial with your name. You can update or remove it at any time by contacting the contact form at viggo.vet/legal/contact.
• Communications: records of your interactions with our sales and support teams, which may be recorded or analysed to improve quality and for training.

Information we collect automatically

• Device and connection data: IP address, browser type, time zone, operating system, device type, and referring URL.
• Cookies and similar technologies: used to recognise you, keep you signed in, measure performance, and improve the experience. We do not use intrusive cross-site advertising trackers. See our Cookie Policy for details and controls.
• Usage analytics: logs of feature usage, configuration, performance, and errors, used to operate and improve the services.

Information from third parties

• Federated login: if you sign in with Google, Microsoft, or LinkedIn, we receive basic account details such as your name and email.
• Referrals and partners: resellers, referrers, or event organisers may share your contact details where you interact with them in connection with viggoVet.
• Public channels: feedback, comments, or reviews you post publicly about us may be collected.

How we use this information

We use the information in Part I to: provide and maintain your account and support; send essential service communications; notify you about updates, security, and (where permitted) relevant offers; run surveys and collect feedback; measure, secure, and improve our services and user experience; detect and prevent fraud and misuse; provide relevant content and recommendations; and comply with law and enforce our terms.

Legal bases (EEA/EU, UK, and Switzerland)

Where data-protection law requires a legal basis, we rely on one or more of the following: performance of a contract; our legitimate interests (such as securing and improving our services), balanced against your rights; compliance with a legal obligation; and your consent, where we ask for it. You can withdraw consent at any time without affecting prior processing. Where we rely on legitimate interests, we make those interests clear at the point of collection.

Artificial intelligence and analytics

viggoVet builds clinical and AI features into the platform. We want to be unambiguous about how this interacts with your data:

• We do not use your personal data or your Service Data to train, fine-tune, or develop AI or machine-learning models. This applies to both our own models and any third-party models.
• We do not sell, share, or disclose your data for others’ AI training.
• Operational analytics use anonymised, aggregated data only. To run and improve our infrastructure we analyse technical and usage signals such as aggregate feature usage, system load, storage size, latency, and error rates. This analysis is performed on data that has been anonymised or aggregated so that it does not identify you, your patients, or your clients.
• AI features operate on your data only to produce outputs for you. When you use an AI feature, it processes the relevant data solely to generate the result you asked for, under your control, and does not feed any cross-customer or general-purpose model.

Your choices

• Marketing: opt out of non-essential emails at any time using the unsubscribe link.
• Cookies: manage non-essential cookies through our cookie controls or your browser; some features may not work if disabled.
• Optional profile data: fields such as a photo or time zone are optional and can be removed.

Who we share controlled information with

• Our staff: only personnel with a legitimate business need, under confidentiality obligations.
• Service providers (sub-processors): vetted providers such as hosting, analytics, payment processing, and email delivery, bound by written confidentiality and data-protection terms and permitted to use the data only to provide services to us.
• Group entities: other members of the viggoVet Group, as described in the Entities Document, under intra-group safeguards.
• Legal, safety, and corporate transactions: as described in Part III.

We do not sell personal data under any circumstances.

Part II, Information viggoVet processes on your behalf (Service Data)

When you or your organisation use the services, you entrust us with Service Data, which may include information about your patients, your clients (pet owners), your staff, and your operations. For this data the customer is the controller and viggoVet is the processor. We process Service Data only on the customer’s documented instructions and under the DPA.

Ownership and control

You own and control your Service Data. Through the platform you can access it, share it via integrations you choose, export it, and request its deletion. We do not access Service Data except as needed to provide, secure, and support the services, or as you instruct.

Data residency and encryption

We store Service Data in encrypted databases located according to the customer’s region, so that data stays within the appropriate regional environment wherever feasible (for example, Swiss, EU, US, and UAE/MENA environments). Service Data is encrypted in transit and at rest. Access is restricted on a need-to-know basis, logged, and audited. Specific hosting locations for your account are described in your order or the DPA.

How we use Service Data

We process Service Data only to provide the features you use and on your instructions. For example, invoicing features use the client and patient details you enter, and messaging features use the contact lists you provide. We do not mine, profile, sell, rent, or share Service Data for our own purposes, and (as stated in Part I) we never use it to train AI models. Any internal analytics use only anonymised, aggregated technical data.

Device permissions and notifications

• Mobile device data: with your permission, some mobile apps may access your device camera, microphone, contacts, files, or location, strictly for the feature you are using. You can revoke this at any time in your device settings.
• Push notifications: if enabled, notifications are delivered via services such as Apple Push Notification service or Google Firebase. You can disable them in your app or device settings.

Third-party modules, SDK, API, and MCP

viggoVet is a modular platform. On top of our base platform we offer our own clinical and AI modules, and we provide an open SDK, API, and MCP interface so that independent developers can build their own modules and make them available to you, free or for purchase, through our platform or marketplace. The following terms govern third-party modules and are important to your rights and responsibilities:

• You decide what to enable. A third-party module can access your Service Data only if you choose to install, enable, or purchase it.
• You authorise and are responsible for the data sharing. By enabling or purchasing a third-party module, you instruct viggoVet to share the Service Data that the module requires with that developer, and you are responsible for that sharing, including ensuring you have a lawful basis and any necessary consents.
• The developer is independent. Each third-party developer is a separate company that acts as an independent controller or as your processor under terms agreed directly between you and that developer. You should review the developer’s own terms and privacy policy before connecting a module.
• viggoVet is not responsible for third-party modules. To the fullest extent permitted by law, viggoVet is not responsible or liable for how third-party developers collect, use, store, secure, transfer, or disclose data, or for their compliance with law. We provide the platform, distribution, and interfaces only, and we do not control third-party modules. Your use of a third-party module is at your own risk and is governed by your agreement with the developer.
• Our own modules. Modules built and provided by viggoVet are covered by this Policy and the DPA in the same way as the base platform; this section concerns modules built by independent third parties.

This allocation of responsibility is reflected in, and supplemented by, our Terms of Use and the DPA.

Other sharing of Service Data

• Sub-processors: we use vetted sub-processors (for example hosting and infrastructure) to deliver the services, under data-protection terms. A current list is available on request or as set out in the DPA, and we give notice of changes as required.
• Our staff and contractors: access is limited, logged, and audited, and used only for support, troubleshooting, migration, or similar service tasks.
• Collaboration features: where you use them, your name and profile photo may be visible to others you collaborate with.

Pet owners and the client app

We offer a pet-owner client app for appointment booking, messaging, and clinic services. In some cases the app is provided under viggoVet’s brand, and in others a clinic offers it under its own brand using our technology. In both cases the clinic is the controller of the clinical and client records it holds about you, and viggoVet acts as the clinic’s processor for those records. Where you create an app login, viggoVet may act as a controller for limited account and technical data (such as your credentials, device information, and app diagnostics) needed to run the app securely. If you are a pet owner, please direct requests about your records to your clinic; we will support the clinic in responding. Use of the app is also governed by the separate Pet Owner App Terms.

Data subject requests for Service Data

If you are an individual (for example a pet owner or staff member) and believe your data is processed through a viggoVet customer’s account, please contact that organisation, which is the controller. We will support our customer in responding to your request as required by law.

Retention of Service Data

We retain Service Data for as long as the account is active. When you delete data or close your account, we remove it from active systems within the period stated in your agreement (and in any event without undue delay), and from encrypted backups within the following backup cycle, after which it is securely deleted or anonymised. Some data may be retained where required by law.

Part III, General privacy principles and your rights

Security and breach notification

We apply industry-standard technical, administrative, and physical safeguards, including encryption in transit and at rest, access controls, logging, and regular review. No system is perfectly secure, but if a personal-data breach occurs that is likely to affect you, we will notify the relevant authorities and, where required by law, affected individuals or customers without undue delay. For business customers, breach-notification timelines are set out in the DPA.

International data transfers

Your data may be processed in countries where viggoVet Group entities or our sub-processors operate. Where we transfer personal data across borders, we use appropriate safeguards such as Standard Contractual Clauses, the UK Addendum, the Swiss addendum, or equivalent mechanisms, alongside the regional data-residency measures described in Part II. To request a copy of the relevant safeguards, contact the contact form at viggo.vet/legal/contact. The responsible Group entity for your region is set out in the Entities Document.

Data Processing Addendum (DPA)

Business customers who need a signed DPA for regulatory compliance can request one at the contact form at viggo.vet/legal/contact. The DPA governs our processing of Service Data and includes confidentiality, security, sub-processing, transfer, and breach-notification terms.

Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without a lawful basis. Where our features generate suggestions or drafts, a human user remains in control of clinical and business decisions. Where applicable law gives you rights in relation to automated decision-making, we honour them.

Children’s data

Our services are intended for businesses and professionals and are not directed to children. We do not knowingly collect personal data from anyone under 16, and will delete such data if we become aware of it. If a customer processes data relating to children through the platform, the customer is solely responsible for compliance with applicable law.

Your rights by region

EEA/EU, United Kingdom, and Switzerland (GDPR, UK GDPR, Swiss FADP). You have rights to access, rectification, erasure, restriction, data portability, and objection (including to direct marketing), and the right to withdraw consent. You may lodge a complaint with your supervisory authority (for example, in Switzerland the Federal Data Protection and Information Commissioner; in the EEA your national authority; in the UK the Information Commissioner’s Office).

United States, including California (CCPA/CPRA and similar state laws). Subject to your state’s law, you may have rights to know, access, delete, and correct personal information, to opt out of “sale” or “sharing” and of targeted advertising, and to limit use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for incompatible purposes. We will not discriminate against you for exercising your rights. You may use an authorised agent where the law permits.

United Arab Emirates (Federal Decree-Law No. 45 of 2021, PDPL). You have rights to be informed, to access, to rectification and erasure, to restrict or object to processing, to data portability, and to object to automated processing, subject to the conditions and exemptions in the PDPL and its implementing regulations. ViggoVET LLC-FZE is the responsible entity for the UAE.

Saudi Arabia (Personal Data Protection Law, PDPL, overseen by SDAIA). You have rights to be informed, to access and obtain a copy of your data, to request correction, and to request destruction of your data, subject to the PDPL and its regulations. Cross-border transfers are handled in accordance with PDPL requirements.

Australia (Privacy Act 1988 and the Australian Privacy Principles). You may request access to and correction of your personal information and may complain to us and then to the Office of the Australian Information Commissioner. We handle eligible data breaches under the Notifiable Data Breaches scheme.

Canada (PIPEDA and provincial laws). You may request access to and correction of your personal information, withdraw consent subject to legal or contractual limits, and complain to the Office of the Privacy Commissioner of Canada.

To exercise any right, contact the contact form at viggo.vet/legal/contact. We will verify your identity, respond within the timeframe required by the applicable law, and will not charge a fee except where the law allows. If your data is Service Data held for a customer, we will direct your request to that customer as controller.

Other terms

• Do Not Track: because there is no common industry standard, our services do not currently respond to browser “Do Not Track” signals. We honour recognised opt-out preference signals where required by law.
• External links and social widgets: our sites may link to or embed third-party content (for example social media buttons) that can collect data such as your IP address and page visits. Those third parties’ privacy policies apply; review them before interacting.
• Public posts: information you post on public forums or blogs may be visible to others. We are not responsible for data you choose to share publicly. To request removal of a post, contact the contact form at viggo.vet/legal/contact.
• Legal disclosures: we may disclose personal data or Service Data to comply with applicable law, a valid legal request, or a lawful government or court order, and will limit any such disclosure to what is required.
• Fraud prevention and protection of rights: we may use or share data to prevent fraud, enforce our terms, and protect the rights, property, or safety of our users, the public, or viggoVet.
• Business transfers: if a viggoVet entity is involved in a merger, acquisition, financing, or sale of assets, data may be transferred as part of that transaction, subject to this Policy. We will notify you of any change of controller as required by law.

Changes to this Policy

We may update this Policy from time to time. We will post the new version with an updated effective date, and we will give at least 30 days’ notice of material changes by email or service notification. Continued use of the services after a change takes effect constitutes acceptance of the updated Policy, where permitted by law.

How to contact us

For any privacy question, request, or complaint, contact us at the contact form at viggo.vet/legal/contact (privacy and data protection) or the support centre at support.viggo.vet(general support). The controller responsible for your region, and our Data Protection Officer contact, are identified in the Entities Document.

This Privacy Policy is provided in English. If we provide a translation, the English version prevails in case of conflict, to the extent permitted by applicable law.