Data and GDPR
Your clients’ data stays yours
TailPlan works with personal data of pet owners, so we built it around the GDPR from the first line. Here is what that means in practice.
Roles
Your clinic is the data controller: you decide which owners we contact and why. TailPlan is the data processor: we act only on your instructions, under a data processing agreement (DPA) that you accept before any data is shared. One exception: if an owner links their pet’s card to several TailPlan clinics, TailPlan is the controller of that shared card, on the owner’s consent. Other clinics never see your clinic’s name or your records, only “Done at another clinic” with a date and procedure.
What we store
Only what reminders need: owner name and phone or email, pet name, species, breed, birth date, microchip number if you add it, and the dates of preventive procedures. We do not need clinical notes, diagnoses or payment data.
Owners’ choices
Every message has a one-tap opt-out that applies to all channels. Owners can delete their card themselves; the request then reaches your clinic for your records. Owners can ask for their data through your clinic, and we help you answer within the legal deadlines.
When you leave
Reminders stop the same day. We delete your clients’ data within 30 days and confirm the deletion in writing.
Security measures
The basics, done properly.
- Encrypted connections (HTTPS/TLS) everywhere
- Owners’ names, contact details, microchip numbers and messages are encrypted in the database with a separate key for each clinic; the shared card has its own key
- Each clinic’s data is separated at the database level, so one clinic can never see another’s
- Staff accounts per person, with roles for vets and reception, and two-step verification
- Owner pages use private, unguessable links
- A list of our sub-processors (hosting, messaging, email import, support assistant) is part of the DPA
Want to read the DPA first?
Our data processing agreement is public. You accept it before uploading any client data.