Vetty Scribe data processing agreement

1. Definitions

1.1 Words defined in the Terms have the same meaning here. "Controller", "processor", "processing", "personal data", "data subject", "personal data breach" and "supervisory authority" have the meanings the GDPR gives them. In this DPA:

• "Applicable Data Protection Law" means the GDPR, the French Data Protection Act (loi n° 78-17 du 6 janvier 1978), and any other data protection law that applies to the processing of Practice Data, including, where they apply, the Singapore Personal Data Protection Act 2012, the Australian Privacy Act 1988 (Cth), the New Zealand Privacy Act 2020 and the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
• "Client" means a person who brings an animal to the Practice, and anyone else who takes part in a consultation recorded with the Service.
• "Member" means a veterinarian or other member of staff who has an account in the Practice, including its administrators.
• "Practice Data" means the personal data in the Practice Records.
• "Practice Records" means the consultation recordings, the transcripts, the facts extracted from them, the draft and signed reports with their versions and audit trail, the Client and Patient details the Practice enters, and, if the Practice uses the optional report-sending feature described in clause 3.1(d), the record of reports sent to Clients.
• "Patient" means an animal seen by the Practice.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.
• "Service" means Vetty Scribe, as described in the Terms.
• "Sub-processor" means a third party that Vetty engages to process Practice Data.

1.2 Under the Singapore Personal Data Protection Act 2012, Vetty is a "data intermediary" processing Practice Data on behalf of the Practice, which is the "organisation" responsible for it. Where another Applicable Data Protection Law uses other terms for controller and processor, they are read accordingly.

2. Scope and roles

2.1 The Practice is the controller, and Vetty the processor, of Practice Data. Annex 1 describes the processing.

2.2 This DPA does not cover the personal data that Vetty processes as a controller for its own purposes: Members’ accounts and profiles, the Practice’s account, team and billing details, voice samples, writing samples, security logs and support correspondence, and, if the optional report-sending feature is ever used, the Vetty account a Client uses on vetty.app to read a report sent to them. The Vetty Scribe privacy notice at vettyscribe.com/privacy covers that data.

2.3 If this DPA and the Terms conflict on the processing of Practice Data, this DPA prevails. If this DPA and the SCCs conflict, the SCCs prevail.

3. The Practice’s obligations

3.1 The Practice is responsible for its compliance with Applicable Data Protection Law as controller. In particular, it:

• (a) has a lawful basis to collect the Practice Data and to have Vetty process it as this DPA describes;
• (b) tells its Clients, before a consultation is recorded, that it is recorded and transcribed, that the report is drafted with artificial intelligence and reviewed by a veterinarian, and how their data is handled;
• (c) obtains any consent to the recording that the law of the place of the consultation requires, and records no one who has refused or withdrawn consent;
• (d) if it switches on the sending of reports to Clients, an optional feature that is not offered at launch and that Vetty may offer later (clause 9 of the Terms describes it), has a lawful basis to send each report, and enters the correct email address;
• (e) answers its Clients’ requests to exercise their rights over Practice Data;
• (f) keeps the records its veterinary regulator or the law requires, and exports them before they are erased (clause 10); and
• (g) gives instructions that comply with Applicable Data Protection Law.

3.2 The Service asks the Member to confirm before each recording that the Client has consented, keeps that confirmation with its time, and will not let a report be signed without it. That confirmation is the Practice’s statement to Vetty. It does not transfer the Practice’s responsibility under clause 3.1(c) to Vetty.

4. Vetty’s obligations

4.1 Vetty will:

• (a) process Practice Data only on the Practice’s documented instructions, including with regard to transfers outside the European Economic Area, unless the law of the European Union or of a Member State to which Vetty is subject requires otherwise; in that case Vetty will tell the Practice of that legal requirement before processing, unless that law forbids it;
• (b) tell the Practice at once if, in its opinion, an instruction infringes Applicable Data Protection Law;
• (c) ensure that everyone it authorises to process Practice Data is bound by confidentiality;
• (d) take the security measures required by Article 32 of the GDPR, which include those in Annex 3;
• (e) engage Sub-processors only as clause 6 allows;
• (f) assist the Practice as clause 8 describes;
• (g) notify the Practice of personal data breaches as clause 9 describes;
• (h) delete or return Practice Data at the end of the Service as clause 10 describes; and
• (i) make available the information and allow the audits that clause 11 describes.

4.2 Vetty will not sell Practice Data, use it for its own purposes, or use it to train artificial intelligence models.

5. Instructions

5.1 The Practice’s instructions are the Terms, this DPA, the Practice’s configuration and use of the Service, and any other written instruction the parties agree. The Practice instructs Vetty to process Practice Data to provide the Service as Annex 1 describes.

5.2 In particular, the Practice instructs Vetty to have consultation audio transcribed, and reports drafted and checked, by the artificial intelligence providers listed as Sub-processors. None of them may train on Practice Data. Each keeps the inputs it receives for a short period, under its own terms, to monitor for abuse.

5.3 The audio periods are part of these instructions and are fixed: the audio of a consultation whose report has not been signed is deleted 30 days after it was recorded, and the audio of a consultation whose report has been signed is deleted 7 days after the first signature. The transcript and the report are kept as clause 10 describes.

5.4 An instruction that would change the Service, or that goes beyond what the Service does, needs Vetty’s written agreement.

6. Sub-processors

6.1 The Practice gives Vetty general written authorisation to engage Sub-processors. The Sub-processors in use when the Practice accepts this DPA are those listed at vettyscribe.com/subprocessors (Annex 2), and the Practice authorises them.

6.2 Vetty engages each Sub-processor under a written contract that imposes data protection obligations no less protective than this DPA, in particular sufficient guarantees of appropriate technical and organisational measures.

6.3 Vetty will give the Practice at least 30 days’ notice before a new or replacement Sub-processor processes Practice Data, by updating the list at vettyscribe.com/subprocessors and emailing the Practice’s administrators.

6.4 The Practice may object to the change on reasonable data protection grounds, in writing to privacy@vetty.app, within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it before the change takes effect, the Practice may cancel its Vetty Scribe subscription or close the Practice, as the Terms describe.

6.5 Where a Sub-processor must be replaced urgently to keep the Service secure or available, Vetty may make the change with shorter notice. It will notify the Practice as soon as possible, and the Practice keeps its right to object under clause 6.4.

6.6 Vetty remains liable to the Practice for the performance of each Sub-processor’s obligations.

7. International transfers

7.1 Vetty stores Practice Data in the European Union, in Frankfurt, Germany.

7.2 Some Sub-processors process Practice Data in the United States, or may reach it from there, as Annex 2 shows. Where a Sub-processor processes or reaches Practice Data in a country without an adequacy decision of the European Commission, the transfer is covered by the EU–US Data Privacy Framework where the Sub-processor is certified under it, otherwise by the SCCs (Module Three, processor to processor) in Vetty’s contract with that Sub-processor, together with the supplementary measures in Annex 3. The Practice authorises these transfers.

7.3 Where the Practice is established outside the European Economic Area in a country without an adequacy decision, and the GDPR treats Vetty’s making Practice Data available to the Practice as a transfer, the parties agree to Module Four (processor to controller) of the SCCs, which are incorporated into this DPA by reference. For that purpose Vetty is the data exporter and the Practice the data importer, Annex 1 gives the description of the transfer, the optional docking clause does not apply, and the SCCs are governed by French law with disputes before the courts of France.

7.4 Where another Applicable Data Protection Law restricts transfers out of the Practice’s country, Vetty will transfer Practice Data only as that law allows, including under contractual safeguards that give the data a standard of protection comparable to that law.

8. Assistance

8.1 Requests from data subjects. The Service lets the Practice see Practice Data, correct a report by amending it, and delete a consultation’s audio. Vetty will export Practice Records on request (clause 10.1), and will erase a consultation’s transcript and report, or a Client’s details, on the Practice’s written instruction. If Vetty receives a request from a data subject about Practice Data, it will pass it to the Practice without undue delay and will not answer it except on the Practice’s instructions or where the law requires. Taking into account the nature of the processing, Vetty will help the Practice by appropriate technical and organisational measures, so far as possible, to answer such requests.

8.2 Other duties. Taking into account the nature of the processing and the information available to it, Vetty will help the Practice to meet its duties under Articles 32 to 36 of the GDPR: security, the notification of breaches, data protection impact assessments and prior consultation of a supervisory authority.

8.3 Requests for assistance go to privacy@vetty.app.

9. Personal data breaches

9.1 Vetty will notify the Practice of a personal data breach affecting Practice Data without undue delay, and in any event within 48 hours of becoming aware of it, by email to the Practice’s administrators.

9.2 The notice will describe, so far as Vetty knows them, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Where Vetty cannot give all of this at once, it will give it in stages without further undue delay.

9.3 Vetty will take reasonable steps to contain the breach and limit its effects, and will keep a record of it. Brahim Ouasti handles every incident for Vetty and is the contact point, at privacy@vetty.app.

9.4 The Practice decides whether to notify its supervisory authority and the data subjects, and does so. Vetty will not notify them about a breach of Practice Data unless the law requires it or the Practice asks. Where the same breach also affects personal data for which Vetty is the controller, Vetty notifies the CNIL within 72 hours of becoming aware of it where the GDPR requires notification, and any other authority within the time applicable law requires.

9.5 A notice under this clause is not an admission of fault or liability.

10. Deletion and return

10.1 While the Practice is open, it may delete a consultation at any time. That removes its audio at once and hides it from the Practice’s lists; its transcript and report stay with the Practice Records until the Practice is closed, unless the Practice instructs Vetty in writing to erase them sooner. The Practice may also ask for an export of its records by writing to support@vettyscribe.com. The export link lasts 7 days. If the subscription is cancelled or lapses, Vetty deletes no Practice Records, apart from audio under clause 5.3; they stay until the Practice is closed.

10.2 The Service ends for the Practice when it is closed, by an administrator or because its last member leaves. For 30 days after closing, the person who closed it can download an export: a file containing every signed report, the transcripts as text, and lists of the consultations, Clients, Patients and notes. The export does not include audio.

10.3 After those 30 days, Vetty erases the Practice Records: the consultation audio, consultations, transcripts, and reports with their versions and audit trail; the Clients and Patients and the notes on them; the report templates, letterhead and logo; and the exports. If the optional report-sending feature has been used, a Client account on vetty.app created for it is erased at the same time, unless the Client has signed in to it or confirmed it, or another practice or a booking refers to it.

10.4 By closing the Practice, the Practice chooses return through the export followed by deletion, as Article 28(3)(g) of the GDPR allows. Vetty keeps no copy of erased Practice Records, except where the law of the European Union or of France requires it to keep them, and except in its providers’ encrypted backups until they are overwritten, which happens within 30 days.

10.5 On the Practice’s written request, Vetty will confirm in writing that the erasure has been done.

11. Information and audits

11.1 On request, Vetty will make available to the Practice the information needed to show that it meets Article 28 of the GDPR and this DPA, including a description of its security measures and the Sub-processors’ own compliance documents where they publish them.

11.2 Where that information is not enough, Vetty will allow and contribute to audits, including inspections, by the Practice or by an independent auditor it mandates who is bound by confidentiality and is not a competitor of Vetty. The Practice will give at least 30 days’ written notice, and audit no more than once in any 12 months, unless a supervisory authority requires an audit or a personal data breach of Practice Data has occurred. Audits take place during business hours, in a way that does not disrupt the Service or give access to other customers’ data, and at the Practice’s cost.

11.3 Vetty will make the Sub-processors’ audit reports and certifications available where their terms allow, in place of an audit of the Sub-processor.

12. Liability

12.1 Each party’s liability arising out of or in connection with this DPA is subject to the exclusions and the limitation of liability in the Terms. Claims under this DPA and the Terms share one aggregate cap: the fees the Practice paid for Vetty Scribe in the 12 months before the event that gave rise to the claim.

12.2 Nothing in this DPA limits a party’s liability to data subjects under Article 82 of the GDPR, or any liability that the law does not allow to be limited.

13. Term, changes and governing law

13.1 This DPA applies for as long as Vetty processes Practice Data, and ends when the Practice Records have been erased under clause 10. Clauses 9, 10 and 12 survive for as long as they need to.

13.2 Vetty may change this DPA as the Terms allow for changes to the Terms, or to comply with Applicable Data Protection Law or a decision of a supervisory authority. A change will not reduce the overall protection of Practice Data.

13.3 This DPA is governed by French law, and its disputes go to the courts the Terms name, unless clause 7.3 or Applicable Data Protection Law requires otherwise.

Annex 1. Details of the processing

• Subject matter: providing Vetty Scribe to the Practice.
• Nature and purpose: recording consultations in the Member’s browser and uploading them; storing them; transcribing the audio; extracting the clinical facts, drafting the report in the chosen template, checking the draft against the transcript, and, where used, translating it or adapting it to the veterinarian’s writing style, all with artificial intelligence; displaying, editing, signing and versioning reports; exporting; and deleting. If Vetty later offers, and the Practice switches on, the optional sending of signed reports to Clients, the processing will also include sending them by email with access on vetty.app.
• Duration: for as long as the Practice has an account, and then until the erasure under clause 10.
• Frequency: continuous, whenever Members use the Service.
• Categories of data subjects: Clients, and anyone else whose voice a recording captures; Members, as they appear in Practice Records (their voice, edits and signature).
• Categories of personal data: Clients’ names and email addresses; the audio of the consultation and everything said in it; transcripts; Patients’ names, species, breed, sex and age, and their health and treatment, which relate to the Client; the veterinarian’s notes, reports and signature; consent confirmations with their time; and, if the optional report-sending feature is used, the record of reports sent to Clients.
• Special categories of data: none are intended. A recording may capture such data where someone mentions it, for example a Client’s own health. The Practice should avoid recording it where it is not needed. Voices are transcribed, not used to identify anyone.
• Retention: audio as clause 5.3 describes; everything else as clause 10 describes.
• Transfers: to the Sub-processors in Annex 2, for the processing that Annex 2 gives for each, with the safeguards in clause 7.
• Competent supervisory authority for the SCCs: the French Commission nationale de l’informatique et des libertés (CNIL).

Annex 2. Sub-processors

The list of Sub-processors, with each one’s legal entity, service, the data it receives, its location and the transfer safeguard, is at vettyscribe.com/subprocessors. That list, as updated under clause 6, forms this Annex.

Annex 3. Technical and organisational measures

Hosting and encryption

• The database and file storage are hosted in Frankfurt, Germany, and the application’s server functions run there too.
• Data is encrypted in transit between users, the Service and the Sub-processors, and encrypted at rest in the database and file storage.

Access control

• Row-level security rules in the database keep each Practice’s data separate, and limit a consultation to the veterinarian who recorded it and the Practice’s administrators. A veterinarian’s own report templates are visible only to that veterinarian.
• Consultation audio, voice samples and exports are held in private storage buckets and reached only through authenticated requests checked against the same rules. An export is downloaded only through an authenticated request by the person who asked for it, never through a public link.
• The transcription provider receives audio through a signed link that expires after one hour.
• Every action in Vetty’s administration console is checked against a list of authorised operators, and licence, billing and waiver decisions are recorded in an audit log.
• Access by Vetty staff is limited to the people who need it to run or support the Service, who are bound by confidentiality.

Authentication and abuse prevention

• Members sign in with a password of 8 to 72 characters after confirming their email address with a six-digit code, or with Google.
• Sign-up is limited to five attempts per hour from one network address, and sign-in and other requests are rate limited.

Minimisation and deletion

• Consultation audio is deleted automatically: 30 days after recording if the report is unsigned, and 7 days after the first signature if it is signed.
• The transcription provider’s copy of each transcript is deleted once Vetty has retrieved it and finished processing the consultation.
• Vetty calls OpenAI, when it is selected, with the storage of responses switched off, and has opted out of training in its ElevenLabs account.
• Writing samples are de-identified before they are stored.
• Vetty Scribe sends no email to Clients at launch; if the optional report-sending feature is offered later, those emails will contain no clinical content and no attachment. Push notifications to Members name the Patient only, and their content is encrypted so that the push service cannot read it.

Integrity and accountability

• A recording cannot start without the Member’s confirmation that the Client consented, and a report cannot be signed without it.
• Each report keeps its versions and an audit trail of the events on the consultation, including signing and amendment.
• The raw result from the transcription provider is kept with the record as the evidence behind the transcript.

Availability and resilience

• Audio is saved in the recording device’s browser storage before it is uploaded, so that a dropped connection does not lose a consultation.
• The database and file storage are backed up by the hosting provider, and backups are overwritten within 30 days.

Incidents and Sub-processors

• Brahim Ouasti owns incident response and notifies the Practice within 48 hours (clause 9).
• Each Sub-processor is engaged under a written contract with data protection obligations (clause 6).