Privacy Policy

1. Who we are

PetCareSuite is a cloud-based veterinary practice management platform developed and operated by Valkon Solutions. In this policy “we”, “us”, and “our” refer to Valkon Solutions. Our contact address is contact@valkonsolutions.com.

We act as a data processor on behalf of each veterinary clinic (the “clinic” or “data controller”) that subscribes to PetCareSuite. The clinic is responsible for the personal data of their clients and patients that is entered into the platform.

2. What data we collect

We collect and store the following categories of information:

• Account data: name, email address, and password (hashed) of clinic staff and administrators who register on PetCareSuite.
• Clinic data: practice name, address, phone number, VAT number, and logo uploaded by the clinic.
• Client and patient data: pet owner names, phone numbers, email addresses, and animal health records entered by the clinic into the platform.
• Billing data: invoice amounts, payment methods, and subscription status. We do not store full card numbers — payments are processed by Stripe.
• Usage data: log files, IP addresses, browser type, and pages visited, collected automatically for security and performance monitoring.
• SMS data: phone numbers and message logs associated with automated appointment and vaccination reminders sent via Twilio.

3. How we use your data

We use the data we collect to:

• Provide, maintain, and improve the PetCareSuite platform.
• Process subscription payments and manage billing.
• Send automated SMS reminders on behalf of the clinic to their clients (only when enabled by the clinic).
• Send transactional emails such as password resets and account confirmations.
• Monitor platform security and investigate unauthorised access.
• Comply with legal obligations, including tax and fiscal reporting requirements.

We do not sell personal data to third parties. We do not use client or patient data for advertising.

4. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract: processing necessary to perform the subscription agreement with the clinic.
• Legitimate interests: security monitoring, fraud prevention, and platform improvement.
• Legal obligation: retention of financial records as required by Cyprus tax law.
• Consent: where a clinic's client has consented to receiving SMS reminders.

5. Data sharing and sub-processors

We share data only with trusted sub-processors required to operate the platform:

• Supabase — database hosting and authentication (EU region).
• Vercel — application hosting and edge delivery.
• Stripe — payment processing. Stripe's privacy policy applies to card data.
• Twilio — SMS delivery for automated reminders.
• OpenAI / Anthropic — AI Clinical Notes generation (visit data is sent only when the clinician uses the AI Scribe feature; no data is used for model training).

All sub-processors are bound by data processing agreements.

6. Data retention

We retain account and clinic data for the duration of the subscription and for up to 12 months after cancellation, after which it is permanently deleted unless a longer retention period is required by law. Invoice and Z-report records are retained for 7 years to satisfy Cyprus tax obligations. Backups are purged on a 30-day rolling cycle.

7. Data security

All data is transmitted over HTTPS/TLS. Database access is restricted by row-level security policies. Passwords are hashed using bcrypt and are never stored in plain text. Access to production infrastructure is limited to authorised Valkon Solutions personnel and is protected by multi-factor authentication.

8. Your rights

Under GDPR and applicable data protection law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data (subject to legal retention requirements).
• Object to or restrict certain processing activities.
• Receive a portable copy of your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at contact@valkonsolutions.com. We will respond within 30 days.

9. Cookies

PetCareSuite uses only strictly necessary cookies required for authentication (session tokens) and security (CSRF protection). We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under EU law.

10. International transfers

Our primary data storage is within the European Union (Supabase EU region). Where data is processed outside the EU (e.g. Twilio SMS routing, Vercel edge nodes), we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, notify clinic administrators by email.

12. Contact

For questions, data requests, or complaints, please contact us at: contact@valkonsolutions.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Commissioner for Personal Data Protection of Cyprus.