Privacy policy

1 · Who is responsible for what

Vet Management holds data about three kinds of people, and responsibility is not the same for all three. This is the most important distinction in this document.

Your account is our responsibility. Your email, name, language and role are handled by AlphaLedgerCo as controller.

Your clients and their animals are YOUR responsibility. Pet owners never agreed to anything with us — their relationship is with you. You decide what is stored and why; we only process it on your instructions. Informing your clients, and obtaining their consent where required, is yours to do. We provide the tools.

We never use your clinic’s data for anything of ours. We do not analyse it, do not pool it with other clinics, do not sell it and do not share it for advertising.

2 · What we store

About you and your team: email, display name, language, role (owner or staff) and the date an account is disabled. Nothing else about your profile: we never ask for your phone, address or ID.

About internal chat messages: the text you write to each other, any photos you attach, who wrote it, in which conversation, when, who takes part in it and how far each person has read. Chat photos live in a private store and are served through links that expire in an hour; there is no public address for them. It is a work tool for the clinic, not a private channel: whoever runs the clinic can read their team’s conversations, and the chat screen says so. We do not use them for anything of our own, the AI advisor never reads them, and they never leave your clinic.

About pet owners: whatever you enter — name, ID document, address, phones, email, emergency contact, preferred payment label (the word “card”, never the card) and your notes.

About animals: record, health, vaccines, dewormings, feeding, medication, medical history, stays and any photos you upload. Photos live in a private store and are served through links that expire after one hour; there is no public address for them.

About money: price list, logged services, invoices, lines and payments. Amounts are set by the server from your own price list, never by the browser.

3 · What we do NOT store

No card data at all. There is no column for a card number, holder, expiry, security code or bank account anywhere in the 27 tables of the system. When you log a payment “by card”, what is stored is that word.

No passwords. Authentication is handled by our identity provider; our database has no password field and no hash of one.

No location and no device fingerprinting. We do not ask for browser location, we do not store IP addresses in the database, and we do not identify you by your device. The closest things are data you type yourself: your clinic’s time zone and any addresses you record.

No analytics, no tracking, no third-party cookies. No Google Analytics, no Meta, no measurement tool of any kind. We use exactly two of our own: your session, and the language you pick. That is why this app never asks you to accept cookies — there is nothing to accept.

Even the lettering is ours. Fonts are served from our own domain, so your clinic’s browser never talks to a third-party server just to open the app.

4 · Who else sees it

Exactly four providers, plus one only if you choose it. This list was derived from the code, one by one.

Supabase — database, sign-in and photo storage. Everything above lives there.

Vercel — hosting. Like any server, it sees the IP address and headers of each request in order to answer it. We have not installed their measurement tools.

Resend — email. It receives the recipient address and the text: vaccine and treatment reminders with the animal’s name and date, and the daily report.

Groq — the AI adviser. Only if you use it, and it deserves its own section.

Google — only if you choose “Continue with Google” to sign in. If you use email and password, Google is not involved at all.

5 · Exactly what the AI adviser sees

This section is deliberately long. An AI adviser that says “it sees nothing” while it sees something is the kind of sentence that destroys trust at once.

What DOES go to the provider: your clinic’s name, the names of the animals in today, up to ten with an overdue vaccine, counts, up to six earlier turns of the conversation, and your question exactly as you write it. If the person asking is the clinic owner, four already-aggregated, already-formatted amounts go too.

What NEVER goes: pet owners’ names, phones, emails, addresses or ID documents. Only how many there are. No medical history, and none of the notes you write.

If you are staff rather than owner, no money figures go at all. Not because the model is asked not to mention them — because it does not receive them. The protection is the absence of the data.

Whatever you type in the question travels as written. If you put a client’s name or phone number there, it goes. Keep that in mind.

The adviser writes, it does not calculate: every figure you see is computed by the program beforehand, and any answer containing a number that was not in the data we sent is discarded before you see it.

6 · How long we keep it

Plainly: until someone deletes it. There is no automatic process that removes anything after a period, and we are not going to invent one in this document to sound better.

With ONE exception, and it is deliberate: internal chat messages are deleted after twenty-four months (two years). Medical records and invoices must be kept; a work message from four years ago serves no purpose and is a liability. Two years cover any question about a past case. The deletion is done by the database itself, not by a promise.

When you archive an owner or a patient they stop appearing in the app, but the record stays in the database — precisely because a medical history and an invoice should not be able to vanish without trace.

If you need data genuinely erased, write to support@alphaledgerco.com and we will do it within 30 days at most.

7 · How it is protected

Each clinic only sees its own data, and not because we were careful while coding. The database itself enforces it: every table carries a rule that only exposes rows belonging to clinics you are a member of, and that rule applies even to the database owner. A disabled member stops seeing anything immediately.

Logs cannot be altered. Medication, feeding, service, invoice line and payment entries only accept additions; nobody with a session can edit or delete them, not even the clinic owner. Fixing a mistake is done by recording the correction, as in a ledger.

Authorship and timestamps are set by the server, not the browser: who recorded something and when is not a value that can be sent from outside.

Inside a clinic, its whole team can see all of its records. That is a product decision, not an oversight: in a veterinary clinic anyone on the team may need any patient’s history — whoever takes the animal in at seven is not who treated it last week — and putting doors there would get in the way of the work without protecting anyone. What is recorded, and cannot be altered, is who writes: every dose, invoice and appointment carries the name of whoever did it and a timestamp set by the server.

The internal chat has one more door, and it is the only one in the app. A conversation is read by the people in it and by whoever runs the clinic; the rest of the team cannot. And whoever joins an existing conversation sees what is written from that moment on, never what came before. It does not rest on us coding carefully: the database itself enforces it.

Between different clinics, isolation is absolute. None sees anything of another’s, and that does not rest on us coding carefully: the database itself enforces it across every table, even against us.

8 · What we do NOT do yet

This is here because a client who finds it out on their own will stop believing the rest of the document.

There is no automatic export. If you need your data, ask and we will provide it.

Our invoices are internal receipts, with sequential numbering. They are not certified electronic invoicing for any country.

9 · Your rights

You can ask us for access to your data, correction, erasure or a copy. Write to support@alphaledgerco.com and we answer within 30 days at most.

If a pet owner asks you for any of those rights, the request is yours to answer — you are the controller of that data — and we will help with anything technical.

And for your clients you have the button. On an owner’s record, whoever runs the clinic can erase their personal data: name, ID, address, phones, email, emergency contact and notes disappear from everywhere they were, including an emergency contact left on a stay and their address in the notification log. You have to type their name to confirm and record the reference for the request, and it cannot be undone.

What is NOT erased, and why. Their animals’ medical history, your invoices and the record of who collected the animal stay — with nobody’s name on the record, but the register intact. This is not an exception we invented: the right to erasure yields to the duty to keep the record of acts that had consequences. If someone claims tomorrow that their animal was handed to the wrong person, that line is the only answer your clinic has.

10 · Changes

If we change something significant we change the date above and tell you inside the app. We do not make changes that apply retroactively to data already collected.