Privacy Policy
Last updated: April 14, 2026
VetFlow (“we,” “us,” or “our”) is committed to protecting the privacy of individuals who interact with our platform. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information. We operate in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian privacy law.
1. Accountability
VetFlow is responsible for personal information under its control and has designated a privacy officer accountable for compliance with PIPEDA principles. Questions, concerns, or requests regarding this policy may be directed to:
VetFlow Privacy Officer
Email: privacy@vetflow.ca
2. What Information We Collect
We collect only the information necessary to provide our pre-visit intake service. This falls into two categories:
2.1 Intake Form Submissions (Pet Owner Information)
When a pet owner completes an intake form on behalf of a veterinary clinic using VetFlow, we collect:
- •Owner full name
- •Owner phone number
- •Owner email address (optional)
- •Pet name, species, breed, age, and sex
- •Reason for visit (e.g., wellness check-up, illness, injury)
- •Reported symptoms, onset, frequency, and severity
- •Free-text notes provided by the owner for the veterinarian
- •Triage assessment generated automatically by our system based on submitted data
- •Date and time of submission
- •The clinic slug (identifier) associated with the submission
2.2 Clinic Account Information
When a veterinary clinic creates an account with VetFlow, we collect:
- •Clinic name and contact email
- •Clinic phone number
- •Unique clinic identifier (slug) used in intake URLs
- •Branding preferences (primary colour, logo URL)
- •Billing information (processed and stored by Stripe — we do not store card numbers)
2.3 Technical Information
We may collect minimal technical information required to operate the service, including session identifiers for authenticated clinic users. We do not collect IP addresses beyond what our hosting provider (Vercel) captures in standard server logs, and we do not build behavioural profiles.
3. Why We Collect This Information
We collect personal information solely for the purposes identified at the time of collection. The primary purposes are:
- →To transmit pet owner intake submissions to the correct veterinary clinic so staff can prepare for the upcoming visit
- →To generate an automated triage assessment (urgency level, symptom flags, and preparation suggestions) to assist clinic staff
- →To allow clinic staff to manage, review, and update the status of submissions via the VetFlow dashboard
- →To provide, maintain, and improve the VetFlow platform and its features
- →To process subscription billing for clinic accounts
- →To respond to support inquiries and provide customer service
- →To comply with applicable law and enforce our Terms of Service
We do not sell personal information to third parties. We do not use intake form data for marketing, advertising, or any purpose beyond operating the service.
4. Consent
We obtain consent for the collection, use, and disclosure of personal information in a manner appropriate for the circumstances.
- •Pet owners provide express consent by checking the consent checkbox on the final step of the intake form before submitting.
- •Clinic users provide consent by creating an account and accepting our Terms of Service.
You may withdraw consent at any time by contacting us at privacy@vetflow.ca, subject to legal or contractual restrictions. Withdrawal of consent may affect our ability to provide the service.
5. Limiting Collection
We collect only the personal information necessary for the purposes identified. We do not collect information indiscriminately. Fields such as email address and pet breed are optional and not required to complete an intake submission.
6. How Information Is Stored and Protected
We implement safeguards appropriate to the sensitivity of the information:
- •All data is stored in encrypted PostgreSQL databases hosted on Supabase infrastructure located in the United States.
- •Data in transit is protected by TLS/HTTPS encryption.
- •Access to submission data is restricted to authenticated clinic users who own the relevant clinic account, and to VetFlow staff for support purposes.
- •Authentication is managed through Supabase Auth with secure session tokens.
- •We apply the principle of least privilege: staff access is limited to what is necessary for their role.
7. Who Has Access to Your Information
Access to personal information collected through intake forms is strictly limited:
- •The veterinary clinic for whom the intake form was completed receives full access to their clinic's submissions via the VetFlow dashboard.
- •VetFlow staff may access submission data solely for the purpose of providing technical support or resolving issues reported by a clinic.
- •Third-party service providers (described below) receive access only as necessary to operate the technical infrastructure of the platform.
We do not share, sell, rent, or disclose personal information to any other party without express consent, except as required by law.
8. Data Retention
We retain personal information only as long as necessary for the purposes for which it was collected:
- •Intake form submissions are retained for 2 years from the date of submission, after which they are automatically and permanently deleted unless the clinic has submitted a written request for extension.
- •Clinic account information is retained for the duration of the active subscription and for 90 days following account termination, after which it is deleted.
- •Billing records are retained as required by applicable accounting and tax law (typically 7 years).
9. Accuracy
We rely on pet owners and clinic staff to provide accurate, complete, and up-to-date information. If you believe information held about you is inaccurate, you may contact us to request a correction at privacy@vetflow.ca.
10. Your Rights — Access and Deletion
Under PIPEDA, you have the right to:
- •Request access to the personal information we hold about you
- •Request correction of inaccurate or incomplete information
- •Request deletion of your personal information (subject to legal retention obligations)
- •Withdraw consent to our collection and use of your information
- •Lodge a complaint with the Office of the Privacy Commissioner of Canada
To exercise any of these rights, contact us at privacy@vetflow.ca. We will respond to requests within 30 days.
11. Cookies
VetFlow uses minimal cookies strictly necessary to operate the service:
- •Session cookies: Used to maintain authenticated clinic user sessions. These expire when the browser is closed or after the session timeout period.
We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. Pet owners completing intake forms are not tracked between sessions.
12. Third-Party Services
We use the following third-party service providers to operate VetFlow. Each has been evaluated for their privacy and security practices:
Supabase
Database and authentication
Stores all intake form submissions and clinic account data in encrypted PostgreSQL databases. Servers located in the United States.
Stripe
Payment processing
Handles all subscription billing for clinic accounts. VetFlow does not store credit card numbers. Stripe is PCI DSS compliant.
Vercel
Application hosting and deployment
Hosts the VetFlow web application. Standard server-side logs (including IP addresses) are processed by Vercel as part of normal operations.
13. Children's Privacy
VetFlow is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information. If you believe a child under 13 has submitted information through our platform, please contact us immediately at privacy@vetflow.ca.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify clinic account holders by email at least 30 days before the changes take effect and update the “Last updated” date at the top of this page. Continued use of the service after changes take effect constitutes acceptance of the revised policy.
15. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Privacy Officer:
VetFlow Privacy Officer
Email: privacy@vetflow.ca
You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.