Data processing agreement

This agreement applies when a veterinary clinic (“the Clinic”) uses TailPlan (“TailPlan”, Limassol, Cyprus) and shares personal data of its clients with us. The Clinic accepts it before uploading any client data. It forms part of the terms under which the Clinic uses TailPlan and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

1. Roles

The Clinic is the controller of its clients’ personal data. TailPlan is the processor and processes that data only on the Clinic’s documented instructions, which are given by the Clinic’s use and settings of TailPlan and by this agreement.

One exception is the shared pet card described in section 5: when a pet owner links their pet’s card to more than one TailPlan clinic, TailPlan is the controller of that card layer, on the owner’s consent.

2. What we process and why

• Purpose: building care plans for the Clinic’s patients, issuing the Clinic’s Wallet cards, sending reminders and messages on the Clinic’s behalf, preparing audits and reports for the Clinic.
• Data subjects: the Clinic’s clients (pet owners) and the Clinic’s staff who use TailPlan.
• Personal data: owner name, phone numbers, email address, preferred language, Telegram chat link if the owner connects it; pet name, species, breed, sex and neutering status, birth date, microchip number, treating vet, and dates of preventive procedures; replies owners send to reminders; message delivery records and opt-outs; staff names and email addresses.
• Not processed: special categories of personal data, clinical notes, diagnoses or payment card data of pet owners.
• Duration: for as long as the Clinic uses TailPlan, plus the deletion period in section 9.

3. Our obligations

• We process the data only for the purposes above and on the Clinic’s instructions. If we believe an instruction breaks the law, we tell the Clinic.
• Everyone at TailPlan with access to the data is bound by confidentiality.
• We do not sell the data or use it for our own marketing.

4. Security

We apply appropriate technical and organisational measures under Article 32 GDPR, including: encryption of data in transit; encryption of owners’ names, contact details, microchip numbers and messages in the database with a separate key for each clinic; separation of each clinic’s data at database level; individual staff accounts with role-based access and two-step verification; private, unguessable links for owner pages; regular backups; and access to production data limited to what is needed to run and support the service.

5. Shared pet card across TailPlan clinics

A pet owner may link their pet’s card to up to five TailPlan clinics, so the pet keeps one card. Only the owner can start a link; a clinic can never pull a card.

• Roles. TailPlan is the controller of the card layer: the card itself, the list of clinics the owner linked, the owner’s consents, and which clinic sends which reminder. Each clinic stays the controller of its own client and patient records, and TailPlan remains its processor for them.
• Instruction to share. The Clinic instructs TailPlan, when an owner links a card to another clinic, to make available a minimal record from the Clinic’s data to the card layer: generic procedure name, date and whether it is done or due, and the pet’s name, species and microchip number for matching. TailPlan stops using it as soon as the link ends: when the owner removes the clinic, when the Clinic ends the relationship, on erasure, or when the Clinic closes its account.
• What other clinics see. Other linked clinics see such records only as “Done at another clinic” with the date and procedure. They never see the Clinic’s name, notes, products, prices, vets, bookings, messages, or the owner’s contact details as held by the Clinic. Only the owner sees the list of their clinics.
• Link requests. A link request is the owner’s request for service. The Clinic answers each request within 2 working days of its opening hours, either by accepting it or by marking it “Not our patient / wrong clinic” with a reason the owner sees. If the Clinic does not answer, we remind it and may follow up.
• No poaching. The Clinic must not use links or shared records to market to owners about other clinics, to approach another clinic’s clients, or to copy shared records outside TailPlan.
• Closing and deletion. When the Clinic closes its account or ends its relationship with a client, only the Clinic’s own link ends; the owner keeps the card with their other clinics. If an owner deletes the card, TailPlan deletes the card layer and passes an erasure request to each linked clinic.
• Retention. TailPlan keeps the card layer for 36 months after its last activity, and the record of the owner’s consents for 36 months, then deletes them.
• Incidents. For a personal data breach affecting the card layer, TailPlan as controller notifies the authority and affected owners where the law requires it, and informs the linked clinics.

6. Sub-processors

The Clinic gives general authorisation for TailPlan to use the sub-processors below. We bind each of them by contract to data protection obligations equivalent to this agreement. We will announce any new sub-processor on this page at least 30 days before it starts processing Clinic data, and the Clinic may object and terminate if it does not agree.

Telegram is not a sub-processor: an owner who chooses to receive reminders in Telegram connects the bot themselves, and Telegram handles those messages under its own terms with the owner. Reminders sent there contain only the clinic name, pet name, procedure and date.

7. International transfers

Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

8. Helping the Clinic

• Data subject requests: we help the Clinic answer requests for access, correction, deletion, restriction, portability and objection. Opt-outs received in messages are applied across all channels automatically.
• Personal data breaches: we notify the Clinic without undue delay and in any case within 48 hours of becoming aware of a breach affecting its data, with the information the Clinic needs to meet its own obligations.
• Assessments: we provide information the Clinic reasonably needs for a data protection impact assessment or consultation with a supervisory authority.
• Audits: we make available the information needed to demonstrate compliance with this agreement and allow for reasonable audits, with 30 days’ written notice.

9. End of service

When the Clinic stops using TailPlan, we stop processing its data, and within 30 days we delete it, including from active systems, unless law requires us to keep it. On request before deletion, we return the data to the Clinic in a common format. Backups are overwritten within their normal rotation.

10. Contact

Questions about this agreement: info@tailplan.vet.