Personal Data Protection Policy

1. Purpose and scope

This Policy sets out practical protection rules for personal data processed by PetsHealth across the public website, mobile application, API/backend, storage, support and administration systems. The data controller is IE Volodymyr Voitsekhivskyi, 20 Bogunska St, apt. 79, 13300 Berdychiv, Ukraine. It complements the Privacy Notice and is based on the actual product architecture, not on a future or planned feature list.

2. Data inventory

• Identity and account data: authentication identifiers, email, phone and profile data.
• Pet and health data: pet profiles, passports, vaccinations, allergies, chronic conditions, documents, photos, health history, events, schedules and reminders.
• Retained legacy service and communication data, where present: location used for service search, clinic interactions, requests, reviews, votes, chats, support, complaints and attached files. These functions are not exposed by the current core client.
• Retained legacy purchase data, where present: product, platform, receipt, transaction and subscription-status information. The current core client does not offer new purchases, and PetsHealth does not store payment-card data.
• Technical data: device, app, network, security, notification, analytics and crash-diagnostic data.
• Public website data: infrastructure request data and the localStorage consent preference. The current site does not collect public form values.

3. Processing controls

Access to application data is authenticated and is intended to be limited by account ownership, sharing permissions and operational roles. The API verifies authenticated requests, and administrative access is restricted to authorised personnel. Data is used for stated product, support, security, reliability, payment and legal purposes and is not sold for advertising.

4. Security measures

No internet transmission or storage system can be guaranteed completely secure. Staff and processors should only access the minimum information needed for their task.

• HTTPS and authenticated API requests for service traffic.
• Provider controls for Firebase, database, file storage, hosting, monitoring and app-store services.
• Role-based operational access and separation between public landing content and private application systems.
• Logging, crash monitoring and incident investigation for reliability and security.

5. User controls and deletion

You can remove individual content using the available application controls and request an account export. Confirming account deletion in the current application starts removal of the account, its owned pet records, access grants and related content; access shared to you does not make another owner’s pet your data to delete. Derived document text is removed through this workflow, while stored files may be marked for asynchronous cleanup. If a step fails, deletion may need to be retried. You may also contact info@petshealth.app for assistance, including records in older systems. Backups and technical, security or legally required records can remain until their applicable retention expires; a deletion request does not instantly rewrite every backup. Firestore managed backups currently retain daily copies for up to 30 days and weekly copies for up to 14 weeks. Provider retention for optional recognition and draft preparation is described below.

6. Processors and international processing

Current service providers include Google Firebase/Google Cloud, Vercel, Apple and Google distribution and identity services, and OpenAI for optional document recognition and medical-record draft preparation. MongoDB Atlas and older infrastructure or diagnostic providers may retain records from earlier versions; this does not mean the current client sends them new analytics. Provider access is governed by applicable agreements and may involve international processing. The recognition and draft-preparation sections describe OpenAI and its retention and transfer arrangements.

7. Requests and incidents

Requests for access, correction, deletion, restriction, objection, portability or consent withdrawal should be sent to info@petshealth.app. We verify requests proportionately and record the action taken. Suspected incidents are assessed, contained, investigated and notified to authorities or affected people where required by applicable law.

8. Children and review

PetsHealth is not directed to children and does not knowingly create child accounts. This Policy is reviewed when the application, infrastructure, providers or processing purposes change. The published version is the current version.

Secretary: chat, files and background tasks

The optional Secretary processes messages, attached files, photos, video and original audio to carry out your requests in PetsHealth. Relevant conversation history, remembered facts and application records needed for the task are sent to the configured model providers. The current service uses OpenAI for conversation and task planning and Google Gemini for transcription and media understanding. These providers are separate from optional usage analytics. Original messages, attachments, transcripts, action history and results are stored in your account. Shortening the model context does not delete the original chat. You can inspect, correct or delete remembered facts and disable automatic memory in the chat’s Memory section; account deletion also covers Secretary data. Server tasks may continue after you close the app. Stop prevents further steps but does not undo actions already completed. Notifications depend on your app and device settings; the result remains in chat. The Secretary organizes documents and performs available app actions; it does not diagnose, assess a veterinarian’s prescriptions or book external appointments.

9. Document recognition controls

Optional recognition uses the OpenAI API from the server; the client does not receive an API key. Authorization is checked before external transfer and before storing each recognized page. Original documents and derived text remain separate. The Privacy Notice describes provider retention, international processing, third-party information, cancellation, deletion and export.