Privacy Policy

ElloVet is a multi-tenant SaaS platform for veterinary clinics and their clients. Each clinic that subscribes to ElloVet acts as a data controller for the data it enters about its staff, patients and pet owners. ElloVet acts as a data processor on behalf of those clinics, and as a controller for the data we collect directly (account registration, billing, usage logs, communications).

To contact us about privacy matters, email privacy@ellovet.com.

• To create and manage your account and authenticate you securely.
• To provide the platform features — appointments, medical records, billing, inventory, and the pet-owner portal.
• To send you service notifications: appointment reminders, vaccination due alerts, invoice receipts, and account security emails.
• To process subscription payments and send billing receipts to clinic administrators.
• To maintain tamper-evident audit logs of clinical and financial actions, as required for veterinary record-keeping.
• To monitor platform performance, investigate errors, and prevent fraudulent or abusive use.
• To comply with legal obligations applicable to us or to the clinics we serve.

We do not use your data for advertising, and we do not sell or rent personal data to any third party.

We share data only in the following circumstances:

• Within your clinic: Staff members with appropriate roles can access patient records and owner data belonging to their clinic. Access is controlled by the role-based permission system.
• Between clinics (with consent only): A pet owner's medical record can be shared with a second clinic only after explicit digital consent is granted by the owner. Every cross-clinic access is logged.
• Service providers: We use Stripe (payments), SendGrid (email), and WhatsApp Business API (notifications). These providers process data only on our behalf, under data processing agreements, and may not use the data for their own purposes.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights, property, or safety of ElloVet, our users, or others.

All data is stored in a PostgreSQL database hosted on secured infrastructure. Data is encrypted in transit (TLS) and sensitive fields (API keys, integration credentials, MFA secrets) are encrypted at rest using AES-256 (Fernet).

Clinic data is strictly isolated — a query from one clinic can never return records belonging to another. Role-based access control ensures that staff can only see data their role permits. Every login, record access, and data change is recorded in append-only audit logs that cannot be altered.

Despite these measures, no system is 100% secure. Please use a strong, unique password and enable multi-factor authentication (MFA) on your account.

We retain your account data for as long as your account is active. If you close your account or your clinic subscription ends, we retain data for a further 90 days to allow for reactivation or data export, after which it is deleted or anonymised.

Medical records may be subject to longer statutory retention requirements under applicable veterinary regulations. In such cases we will retain the minimum data required for compliance and inform the relevant clinic.

Audit logs are retained for a minimum of 7 years and cannot be deleted, as they form a legally required record of clinical and financial actions.

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and personal data (subject to retention obligations above).
• Export your data in a machine-readable format.
• Object to or restrict certain types of processing.
• Withdraw consent where processing is based on consent (e.g. cross-clinic record sharing).

To exercise any of these rights, email privacy@ellovet.com. We will respond within 30 days. We may need to verify your identity before acting on your request.

Pet owners can revoke cross-clinic consent at any time from the sharing settings in the pet-owner portal.

ElloVet uses only functional cookies necessary to operate the service: a secure, httpOnly session cookie for authentication, and a theme preference cookie. We do not use advertising cookies or third-party tracking scripts on the platform.

This marketing website does not use analytics or advertising cookies. The only cookie set is a session cookie if you click "Sign in" and authenticate.

ElloVet is not directed at children under 16. We do not knowingly collect personal data from children. Pet records may include data about pets owned by households with children, but the account holder must be an adult.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify clinic administrators by email if the changes are material. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or complaints, contact us at privacy@ellovet.com. If you believe we have not resolved your concern, you have the right to lodge a complaint with the data protection authority in your jurisdiction.