Privacy Policy
Last updated: [DRAFT — set on finalization]
This Privacy Policy describes how dogear (“dogear,” “we,” “us”) handles information in connection with the dogear service (the “Service”). dogear provides infrastructure that lets veterinary clinics exchange records with owner authorization.
1. Our role
For the veterinary records and related information that clinics submit, dogear acts as a service provider processing that information on behalf of, and under the instructions of, the clinics that use the Service. Each clinic is responsible for its own collection, use, and disclosure of that information, and for obtaining any required consent or authorization from pet owners. If you are a pet owner, the clinic that requested your records is your point of contact regarding that information.
2. Information we process
- Account information — clinic name, address, phone, email, staff accounts, and settings.
- Records and request content — the patient, owner, and clinic details entered into a request, and the record documents a responding clinic uploads.
- Authorization records — the consent artifact and related metadata that authorize a release.
- Usage and technical data — log data, IP address, device/browser information, and audit events, used to operate and secure the Service.
3. How we use information
We use information solely to provide, maintain, secure, and improve the Service — routing requests, delivering records with authorization, generating summaries, sending transactional notices, and keeping an audit trail. We do not sell your information, and we do not use record content for advertising.
4. Service providers (subprocessors)
We use the following providers to operate the Service; they process information only to provide their function to us:
- Supabase — database, authentication, and file storage (records at rest).
- Vercel — application hosting and request handling.
- Anthropic — AI processing of received documents to generate summaries (see Section 5).
- Inngest — orchestration of the summarization job.
- Resend — transactional email delivery (recipient address and a link; no record content).
- Fly.io — malware scanning of uploaded files.
- Telnyx — fax transmission, where the fax channel is used.
5. Automated summarization and AI
When a records request is fulfilled, dogear generates a structured summary of the received documents using the Anthropic API (models claude-sonnet-5 and claude-haiku-4-5), orchestrated by Inngest. These providers process record content solely to produce the summary for the requesting clinic and are contractually prohibited from using it to train their models. Model versions are pinned and logged, and each summary records which model produced it. The source documents are always retained and available; the summary is an aid, not a replacement. Requests that never reach the fulfilled state, or whose authorization has lapsed, are never sent for processing.
Our AI provider may retain limited content for a short period for trust, safety, and legal-compliance purposes, and may retain content flagged for such purposes for a longer period where permitted or required by law. We do not promise deletion beyond what our providers’ configurations allow.
6. Security
We use reasonable technical measures to protect information, including encryption in transit, row-level access controls, malware scanning of uploads, single-use authorization links, and an audit trail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Retention
We retain information for as long as needed to provide the Service and as directed by the relevant clinic, and thereafter as required for legal, audit, or legitimate business purposes. [Specific retention periods to be set by counsel.]
8. A note on regulatory scope
Veterinary records are generally not subject to HIPAA, and dogear is not a HIPAA-covered entity or business associate. State veterinary-records and client-confidentiality laws may apply; clinics are responsible for their obligations under those laws.
9. Children
The Service is not directed to children and is intended for use by veterinary professionals.
10. Changes
We may update this Policy by posting a revised version. Material changes will be indicated by updating the date above.
11. Contact
Questions about this Policy: [contact email].