Privacy Policy

1. Introduction

Caudl Health ("Caudl", "we", "us") provides software to veterinary clinics and to pet owners. This policy explains what personal information we collect, why we collect it, how we protect it, and the choices you have.

It applies to Caudl Clinic (our web application for veterinary clinics), Caudl Pet (our mobile application for pet owners), and caudl.health. Together, the "Services".

"Personal information" means information about an identifiable individual. In this policy it means information about people — pet owners, veterinarians and clinic staff. Information about an animal is not personal information on its own, but we protect it as though it were, because it is connected to you.

By using the Services you consent to the practices described here. If you do not agree, please do not use the Services.

This policy does not cover your veterinary clinic's own privacy practices. Ask your clinic for their policy.

2. Our role, and your clinic's

Your veterinary clinic is the custodian of your animal's medical record. That responsibility comes from their professional regulatory college and stays with them. We hold and process that record on the clinic's behalf and on their instructions, and we do not use it for our own purposes.

If your request concerns your animal's medical record — visit notes, diagnoses, prescriptions, history — contact your clinic. We will assist them in responding.

For your Caudl account, the Caudl Pet app, our website and our support and business operations, we are the organisation responsible, and you can contact us directly.

3. Information we collect

From veterinarians and clinic staff

Contact and professional details you provide when registering: name, work email, professional licence number and licensing body, province of practice, and an image of your signature for use on prescriptions. Details about your clinic: name, address, contact details, licence number, operating hours and fees.

From pet owners

• Contact information — your name, phone number, and optionally your email address and mailing address.
• Information about your animal — name, species, breed, sex, age, weight and health information.
• Information you provide before or during a visit — the reason for your visit, answers to pre-visit questions, and any photographs, video or documents you choose to send to your clinic.
• Voice recordings, where you use voice input, or where you are present during a consultation that your veterinarian records with your consent. See section 5.
• Consent records — when you consent to register with a clinic, we record that you consented and when, together with your IP address and browser information, so that the consent can be verified.

Collected automatically

• Technical and log information — records of requests to our systems, used to operate and secure the Services.
• Sign-in identifiers issued when you authenticate.
• A device notification token, so we can send you service notifications.

We do not collect payment card details, government identification, precise location, biometric identifiers or advertising identifiers, and we do not use analytics or tracking technologies. See section 10.

4. Why we collect it

We collect and use personal information to:

• create and administer your account, and verify professional credentials;
• provide the Services — appointments, queues, consultation documentation, prescriptions, pre-visit questions and visit summaries;
• send you service notifications, such as when a visit summary is ready;
• provide customer support;
• keep the Services secure and investigate misuse;
• meet our legal, regulatory, tax and accounting obligations, and support clinics in meeting their professional record-keeping obligations; and
• send commercial messages where you have consented (section 11).

We do not use personal information for any other purpose without your consent.

5. Recording of veterinary consultations

Veterinarians using Caudl Clinic may record a consultation so that it can be transcribed and used to prepare the visit record.

Your veterinarian must obtain your express consent before recording, and must do so each time. You may decline, and you may ask that recording stop at any time.

Audio is not stored. It is transmitted for transcription, converted to text, and discarded. Only the text transcript is retained, and it is stored in Canada. Transcription is performed by a service provider located in the United States — see section 8.

Voice input in the Caudl Pet app works the same way: audio is transcribed and discarded, and the resulting text is shown to you before you send it.

6. Artificial intelligence

We use artificial intelligence to transcribe speech and to prepare draft documents, including consultation notes, prescription entries, pre-visit questions and plain-language visit summaries.

A veterinarian reviews and approves clinical content before it is finalised. Draft notes and prescriptions are proposals for the veterinarian to correct and accept. No AI feature in Caudl makes a clinical decision.

Plain-language visit summaries sent to pet owners are generated automatically from records the veterinarian has already approved. Your veterinarian's record is the authoritative version — if anything is unclear or looks wrong, contact your clinic.

We do not use your information to train or fine-tune artificial intelligence models, and our service providers are contractually prohibited from doing so.

We may in future use anonymized information — from which all personal information has been irreversibly removed, so that no individual, animal or clinic can be identified — to improve and develop the Services. If we do, we will update this policy and give notice first, and you may opt out at any time by contacting us.

7. Disclosure of your information

We disclose personal information only as follows:

• To your veterinary clinic. If you register with a clinic through Caudl Pet, your contact details and your animal's details are provided to that clinic so they can create and maintain a record. We ask for your consent before doing this. Once information is in your clinic's record, the clinic's own practices apply to it. We do not disclose your information to any other clinic.
• To service providers who help us deliver the Services, including cloud hosting and storage providers, authentication and notification providers, and speech-to-text and artificial intelligence providers. They receive only what they need, are contractually required to protect it, and may use it only for the purposes we specify.
• Where required by law — in response to a court order, warrant, subpoena or other lawful demand. Where we are permitted to tell you, we will.
• In a business transfer — if Caudl is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to equivalent protection.

We do not sell personal information, and we do not disclose it for advertising or marketing purposes.

Further information about our service providers, including those outside Canada, is available on request — see section 8.

8. Storage location and service providers outside Canada

Personal information in our care is stored in Canada, on Canadian servers operated by our cloud hosting provider in Toronto and Montréal, Ontario and Quebec.

Some processing takes place outside Canada. Consultation audio is transcribed, and consultation text is used to prepare draft documents, by service providers located in the United States. While information is in the United States it is subject to the laws of that country and may be accessible to United States courts, law enforcement and government authorities under their legal processes. Owner contact details are not sent to these providers.

To obtain information about our policies and practices in relation to service providers outside Canada, including which countries are involved and the purposes for which those providers are authorised to process personal information, contact:

Shivank Gupta, Privacy Officer- privacy@caudl.health

This is provided in accordance with section 13.1 of Alberta's Personal Information Protection Act.

9. Safeguards

We protect personal information with security safeguards appropriate to its sensitivity, including encryption in transit and at rest, access controls that limit each account to its own clinic's information, restricted internal access on a need-to-know basis, private storage of documents and files, and monitoring for misuse. Consultation audio is not retained. Health information is treated as sensitive and safeguarded accordingly.

Our security practices are reviewed regularly. A summary is available to clinic customers on request.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the relevant privacy commissioners as required by law, and will keep records of the breach as required.

10. Cookies, tracking and analytics

We do not track you.

Our applications contain no analytics software, no crash-reporting or session-replay tools, no advertising identifiers, no advertising cookies, no tracking pixels and no cross-site or cross-app tracking. We do not respond to Do Not Track signals because we do not conduct the tracking those signals are designed to prevent.

We use only storage necessary for the Services to function — keeping you signed in, remembering your language preference and interface settings, and storing your medication reminders, which never leave your device.

11. Commercial messages

Where you have consented, we may send you product news and offers. Every such message includes an unsubscribe link, in accordance with Canada's Anti-Spam Legislation. Unsubscribing does not stop service messages such as visit summaries, security notices or changes to these terms.

12. Retention

We keep personal information only as long as necessary for the purposes for which it was collected, or as the law requires.

Veterinary medical records are retained for the period your veterinarian's regulatory college requires — in Alberta, a minimum of five years after the last patient contact. We do not destroy clinical records before that period lapses; they are archived instead.

Consultation audio is never stored. Account information is kept while your account is active. Financial records are kept for seven years, as tax law requires. Technical logs are kept for 90 days. When you close your account we delete the information we hold as the responsible organisation within 30 days, except what we must retain by law and the clinical record held for your clinic. Information may persist in encrypted backups until those backups expire on their normal schedule, and remains protected by this policy throughout.

13. Your rights

You may ask us to confirm what personal information we hold about you, how it has been used and to whom it has been disclosed, and to provide you with access to it. You may ask us to correct information that is inaccurate or incomplete, and you may withdraw your consent at any time, subject to legal and contractual restrictions — we will tell you the consequences before acting.

You may also ask us to delete information we hold. Two limits apply: we cannot delete your clinic's medical record on your request, because your veterinarian is required to retain it; and once you send a photograph, document or answer to your clinic it becomes part of the veterinary record.

Send requests to privacy@caudl.health. We will verify your identity before responding, and will respond within 30 days. If we need more time we will tell you why within that period, and advise you of your right to complain. There is no charge for a reasonable request.

For anything in your animal's medical record, contact your clinic — they are the custodian.

If you live in Quebec you have additional rights, including data portability. If you live in British Columbia, the Personal Information Protection Act of that province gives you substantially similar rights. Contact our Privacy Officer to exercise them.

14. Challenging our compliance

Please contact us first at privacy@caudl.health. We take complaints seriously and would rather resolve the matter directly.

If you are not satisfied with our response, you may complain to:

Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca · 1-888-878-4044

Office of the Privacy Commissioner of Canada — priv.gc.ca · 1-800-282-1376

Depending on where you live you may also complain to your provincial commissioner.

15. Children

The Services are intended for adults. You must be at least 18 years of age, or the age of majority where you live. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will update the date above and post the current version at caudl.health/privacy. If we make a material change, we will give notice before it takes effect, and will obtain your consent where the law requires it — including before using information for any new purpose.

17. Contact us

Shivank Gupta — Privacy Officer

Accountable for our compliance with this policy, and the person to whom access requests and questions about service providers outside Canada should be sent.

Email: privacy@caudl.health

Mail: Caudl Health, 24 Seton Terrace SE, Calgary, Alberta T3M 2W1, Canada

Caudl Health is 18125881 Canada Inc. and 2828070 Alberta Corp.

Available in French on request. This policy is governed by the Personal Information Protection and Electronic Documents Act (Canada) and the Personal Information Protection Act (Alberta).