1. Who does what: the role model
The GDPR distinguishes the controller, who decides why and how personal data is used, from the processor, who handles data on the controller’s instructions. Knowing who is which tells you who answers your request, who must report an incident and who decides how long data is kept.
| Party | Role | For which data |
|---|---|---|
| The pet parent | Data subject | The person the data is about. |
| The veterinary clinic | Controller | Its client file and the medical record of the animals it treats: appointments, consultations, prescriptions, vaccinations, documents, invoices, reminders, its public page and its shop orders. |
| The pet-care provider | Controller | Its bookings, client notes and public profile. |
| My solutions SARLS | Processor | The records above, which we host and process only on the professional’s instructions. |
| My solutions SARLS | Controller | User accounts, the pet-parent health record, the community, messaging, verification codes, website statistics, security logs and support. |
| Our service providers | Sub-processors | Hosting, e-mail, text messages, AI features, calendar connection — only what each needs, and only on our instructions. |
2. Pet parents
A pet parent can hold an account with us. From that account they book with the professionals they choose. When they book, the details needed for the appointment are passed into the professional’s own space on the platform; from that moment the professional is the controller of that copy, and we process it for the professional.
Your data can therefore exist in two places: in your own account, for which we are responsible, and in the file of each professional you have dealt with, for which that professional is responsible.
When you delete your account, we erase or anonymise the account we control. We cannot delete, on our own initiative, the records a clinic is required to keep; we help you contact the professionals concerned so that you can exercise your rights with each of them.
3. Clinics and pet-care providers
A professional is the controller of the data in its own space. It decides which information it needs, who in its team can see it and how long it is kept, and it is responsible for informing its clients. For that data we act as processor under the data-processing terms in section 5.
Where a professional connects a tool of its own to the platform — for example a calendar account — that tool is the professional’s own provider, acting on the professional’s instructions. The professional is responsible for its agreement with that provider and for limiting what is synchronised to what is necessary.
4. How data reaches the platform
- Online, by the pet parent — an account, a booking, a message or an order made on the platform.
- Through the professional — the pet parent telephones or visits; the professional records the client, the animal or the appointment. The professional is then the source of the data and informs the client.
- By import or synchronisation — the professional imports existing records or connects a calendar it has authorised.
5. Data-processing terms for professionals
5.1 Subject, nature, purpose and duration
The Processor hosts, stores, displays, transmits and deletes personal data so that the Controller can manage its agenda, its clients and patients, its records, its communication, its public page and its orders. The processing lasts for the duration of the Controller’s use of the platform, and until the data is returned or deleted afterwards.
5.2 Data and people concerned
People: the Controller’s clients (animal owners) and their contacts, and the Controller’s staff. Data: identity and contact details; information about animals and their health; appointments; clinical notes, prescriptions and documents; invoices and payment status; messages and reminders; orders; access logs. Information about an animal’s health is treated as confidential.
5.3 The Processor’s commitments
- Instructions. To process the data only on the Controller’s documented instructions — these terms and the Controller’s use of the platform’s features — unless EU or Luxembourg law requires otherwise, in which case the Controller is informed beforehand where the law allows. The Processor tells the Controller if it considers that an instruction infringes data-protection law.
- Confidentiality. To ensure that the people it authorises to access the data are bound by confidentiality and access it only where necessary for maintenance or support.
- Security. To apply appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit, hashed passwords, encryption of sensitive secrets at rest, role-based access, session expiry, audit logging and regular backups, as described in the Privacy Policy.
- Sub-processors. The Controller gives a general authorisation to use the sub-processors listed in the Privacy Policy. The Processor imposes on them data-protection obligations equivalent to these terms, remains responsible for them, and announces any addition or replacement in advance so that the Controller can object (section 6).
- Rights of individuals. To assist the Controller, through the platform’s features (search, export, correction, deletion) and on request, in answering requests from individuals. A request received directly by the Processor about the Controller’s data is passed on to the Controller without delay.
- Assistance. To assist the Controller, taking into account the information available to it, with security, breach notification, data-protection impact assessments and prior consultation of the authority (Articles 32 to 36 GDPR).
- Incidents. To notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data — where feasible within 48 hours — with the information available, so that the Controller can meet its own 72-hour duty.
- End of the service. At the Controller’s choice, to return the data in a commonly used format or delete it, within 90 days of the end of the service, unless the law requires it to be kept; backups are overwritten on their normal cycle.
- Evidence and audits. To make available the information needed to demonstrate compliance with Article 28 and to allow audits by the Controller or an auditor it mandates, on reasonable notice, during business hours, no more than once a year unless an incident justifies it, and subject to confidentiality.
- Transfers. Not to transfer the data outside the European Economic Area except through a sub-processor covered by the safeguards in section 11.
5.4 The Controller’s commitments
- To have a legal basis for the data it enters, imports or collects, and to inform its clients as required by Articles 13 and 14 GDPR.
- To enter only the data it needs, to manage its team’s accounts and access rights, and to keep its sign-in details secure.
- To decide on retention in line with the rules of its profession and to delete what it no longer needs.
- To answer requests from its clients, and to notify the supervisory authority and the people concerned of a breach where the law requires it.
6. Service providers and changes
The providers that help us run the platform are listed in section 7 of the Privacy Policy, with their role and the data each can see. Before we add or replace a provider that handles professionals’ client data, we announce it to professionals by e-mail or in the dashboard at least 14 days in advance. A professional who objects on reasonable data-protection grounds may contact us; if no solution is found, the professional may end its use of the platform.
7. Where data is stored
The application, its databases, uploaded files and backups are hosted in the European Union by Hostinger International Ltd. (EU data centre). Where a feature relies on a provider that may process data outside the European Economic Area, only the data needed for that feature is sent, under the safeguards in section 11.
8. Retention and deletion
Retention periods are set out in section 9 of the Privacy Policy. Professionals decide how long they keep their own records, within the duties of their profession and the accounting rules. When a professional stops using the platform, its data is returned or deleted as described in section 5.3.
9. Security incidents
- Where we are the controller, we notify the National Commission for Data Protection (CNPD) within 72 hours of becoming aware of a personal-data breach, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33 GDPR), and we inform the people concerned without undue delay where the risk is high (Article 34).
- Where we are the processor, we notify the professional concerned as set out in section 5.3, so that it can meet its own obligations.
To report a security concern, write to contact@noa.vet.
10. Animal health data and professional secrecy
Information about an animal’s health is not a “special category” of personal data under Article 9 GDPR, which concerns people. It is nevertheless linked to an identifiable owner, it is covered by the veterinarian’s duty of professional secrecy, and it can reveal private circumstances. We therefore treat it as confidential: it is visible only to the clinic that created it, to the owner, and to those the owner has chosen to share it with.
Our staff can access clinical content only where necessary for a maintenance or support operation. We do not use clinical data for advertising, and we do not use it to train artificial-intelligence models.
11. Transfers outside the European Union
Where a provider processes data in a country outside the European Economic Area, the transfer rests on an adequacy decision of the European Commission — for the United States, the EU–US Data Privacy Framework for certified companies — or on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with an assessment of the transfer and additional measures where needed.
12. Your rights and how we handle requests
The rights in Articles 15 to 22 GDPR — access, rectification, erasure, restriction, portability and objection — and the way to exercise them are described in section 12 of the Privacy Policy. We answer within one month, free of charge. Where your request concerns records held by a clinic or a provider, we pass it on to that professional and help it answer you.
13. Data protection contact and supervisory authority
Data protection contact: contact@noa.vet.
Our lead supervisory authority is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.public.lu. You may also contact the authority of the country where you live or work.