1. Scope
This policy describes how My solutions SARLS processes personal data when you visit or use NOA.VET: the public website, the pet-parent area, the clinic dashboard, the pet-care provider dashboard and the clinic websites hosted on the platform. It applies to visitors, pet parents, veterinarians and clinic staff, pet-care providers, and people who contact us.
It is written to comply with Regulation (EU) 2016/679 (“GDPR”), the Luxembourg Act of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data-protection framework, and the amended Luxembourg Act of 30 May 2005 on privacy in electronic communications.
Information about an animal is not, as such, personal data. It becomes personal data when it is linked to you as its owner, and we protect it accordingly.
2. Who is responsible
Data protection contact: contact@noa.vet.
Depending on the data, the “controller” — the party that decides why and how data is used — is different:
- My solutions SARLS is the controller for your account, your pets’ health record in the pet-parent area, the community, messaging, website statistics, security logs, support and our own communications.
- Your veterinary clinic is the controller of the records it keeps about you and your animals (appointments, consultations, prescriptions, invoices, documents, reminders). We host and process them on the clinic’s behalf, as its processor.
- Your pet-care provider is the controller of the bookings and client notes it manages; we process them on its behalf.
When you book from your account, the details needed for the appointment are passed to the professional you chose; from then on that professional is responsible for its copy. The GDPR page explains this allocation in detail.
3. The data we collect
Account and profile
- Pet parents: name, e-mail address, telephone number, postal address (optional), password (stored only as a salted hash), language, profile photo, notification preferences. If you sign up with Google: your name, e-mail address and Google account identifier.
- Veterinarians and clinic staff: name, professional e-mail address, role, clinic, speciality, licence number, photo, biography, working hours, calendar-connection tokens where the clinic connects a calendar.
- Pet-care providers: name, e-mail address, telephone number, business details, address or service area, services and prices, photos, availability.
Animals and health record
- Name, species, breed, sex, date of birth, microchip number, weight, insurance, photo, vaccinations, treatments, allergies, documents you upload, and the people you share a pet with.
Appointments, bookings and clinical records
- Date, time, professional, reason for the visit, status, changes and cancellations, waiting-list requests, deposits requested by a clinic (status only).
- Records created by the clinic: consultation notes, vital signs, diagnoses, prescriptions, vaccinations, documents, invoices, reminders, referral letters, insurance-claim summaries.
Orders for pick-up
- Products reserved, total, status, your note to the clinic, and — for an order without an account — your name, e-mail address and mobile number.
Messages and community
- Messages exchanged with clinics, providers and other pet parents; posts, photos, videos, comments, reactions, group memberships and event registrations.
Technical and security data
- IP address, browser and device type, date and time of access, pages viewed. For our statistics we keep only a hash of your IP address that changes every day; the IP address itself is not stored for statistics.
- Security log: sign-ins, failed sign-ins, password changes, two-step verification events, exports, deletions and changes of access rights.
- Records of your agreement to our terms and of your consents (date, version, source).
Data we receive from others
- A clinic or a provider may create your record when you contact it directly (by telephone or at the practice), and may invite you to the platform. Another pet parent may share a pet with you.
You are not obliged to give us data. Fields marked as required are needed to provide the feature concerned; without them we cannot create the account, the booking or the order.
4. Why we use it and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account; let you book, manage and be reminded of appointments; keep your pets’ health record; messaging; orders for pick-up | Account, animals, appointments, orders, messages | Performance of the contract with you — Art. 6(1)(b) |
| Provide the dashboards to clinics and providers and host their records | Professional accounts; client and patient records | Contract with the professional — Art. 6(1)(b); for client and patient records we act as processor on the professional’s instructions — Art. 28 |
| Check an e-mail address or a mobile number with a code; prevent invalid or automated bookings and orders | E-mail address, mobile number, IP address | Legitimate interest in protecting professionals and the service from abuse — Art. 6(1)(f) |
| Keep the platform secure: logs, detection of abuse, account lock-out, two-step verification | Technical and security data | Legitimate interest — Art. 6(1)(f); obligation to secure data — Art. 32 |
| Check photos and videos before publication; handle reports and enforce the content rules | The uploaded file, the report, moderation decisions | Legitimate interest in a safe community — Art. 6(1)(f); legal obligations under Regulation (EU) 2022/2065 — Art. 6(1)(c) |
| Measure and improve the website (cookie-less, first-party statistics) | Pages viewed, device type, daily-rotating IP hash | Legitimate interest — Art. 6(1)(f). Your browser’s “Do Not Track” or Global Privacy Control signal switches it off |
| Optional features you choose: AI assistant and wellness coach, newsletters, marketing reminders | What you type; contact details | Your consent — Art. 6(1)(a); you can withdraw it at any time |
| Answer your questions and requests; exercise of your rights | Contact details, content of your request | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Accounting, tax and legal duties; establishing or defending legal claims | Invoices, contractual records, records of agreement | Legal obligation — Art. 6(1)(c); legitimate interest — Art. 6(1)(f) |
We do not sell personal data, we do not use it for third-party advertising, and we do not build advertising profiles.
5. Artificial-intelligence features
- Assistant and wellness coach. The question you type, and the pet information you choose to include, is sent to our AI provider to generate an answer.
- Voice dictation for veterinarians. The transcript of what the veterinarian dictates during a consultation is sent to our AI provider to structure the clinical notes, which the veterinarian then reviews. The clinic is the controller of this processing.
- Checking of uploads. Photos and frames of videos are sent to an automated moderation service before publication.
Under the terms of the programming interfaces we use, our AI providers act as our processors and do not use this data to train their models. We do not use your data to train any model of our own.
6. Verification by e-mail or text message
To confirm that an e-mail address or a mobile number really belongs to the person using it, we may send a one-time code or link — for example when you sign up, when you book as a new client, or when you place an order without an account. For a text message, our SMS provider receives the mobile number and the text containing the code. The code is valid for a few minutes and can be tried a limited number of times; we limit the number of codes sent to one number or from one connection. We do this on the basis of our legitimate interest in protecting professionals from invalid requests (Art. 6(1)(f)); you may object as described in section 12.
7. Who receives your data
Your data is seen by the professional you book with or write to, to the extent needed. Beyond that, it is shared only with service providers that act on our documented instructions:
| Recipient | Role | Data concerned | Location |
|---|---|---|---|
| Hostinger International Ltd. (EU data centre) | Hosting of the application, the databases, files and backups | All data on the platform | European Union |
| E-mail delivery provider | Sending confirmations, reminders, codes and notifications | E-mail address, content of the message | See section 8 |
| Twilio | Text messages: verification codes and, where the clinic enabled them, reminders | Mobile number, text of the message | EU / United States |
| Anthropic | AI assistant, wellness coach, structuring of dictated notes, fallback moderation | Text or image submitted to the feature | EU / United States |
| OpenAI | Automatic check of uploaded photos and video frames | The uploaded image | EU / United States |
| “Sign in with Google”; calendar synchronisation where a clinic connects its Google Calendar; Google Analytics only if you accept it | Name, e-mail address; appointment events; usage data | EU / United States | |
| jsDelivr / unpkg (content-delivery networks) | Delivery of open-source libraries to your browser | IP address | Worldwide network |
| OpenStreetMap Foundation (Nominatim) | Looking up addresses for maps and distance search | The address or place typed | EU / United Kingdom |
A provider only receives data when the corresponding feature is switched on and used. We may also disclose data where the law requires it (for example to a court or a competent authority) or where it is necessary to establish or defend legal claims. If the platform were transferred to another company, your data would be transferred under the same protections and you would be informed.
8. Transfers outside the European Union
The platform and its databases are hosted in the European Union. Some of the providers listed above may process data in a country outside the European Economic Area, mainly the United States. In that case the transfer is covered by an adequacy decision of the European Commission (for US companies certified under the EU–US Data Privacy Framework) or by the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), with additional measures where needed. You can ask us for a copy of the safeguards at contact@noa.vet.
9. How long we keep it
| Data | Retention |
|---|---|
| Pet-parent and provider accounts, pets’ health record | Until you delete your account; the account is then anonymised without delay |
| Records kept by a clinic (consultations, prescriptions, invoices, documents) | Decided by the clinic, in line with the retention duties that apply to veterinary and accounting records (accounting documents: 10 years under the Luxembourg Commercial Code), then deleted |
| Bookings managed by a provider | Decided by the provider; deleted or anonymised when the provider’s account is closed |
| Orders for pick-up | For the life of the clinic’s account, within the clinic’s accounting retention |
| Messages and community content | Until you delete them or delete your account |
| Verification codes and requests | Codes expire within minutes; the request record is deleted after a few days |
| Records of agreement and consent | For as long as they are needed as evidence of your agreement |
| Website statistics (no direct identifiers) | 400 days |
| Security log | 730 days |
| Failed sign-in records; password-reset links | 30 days; 7 days |
| Backups | Rolling backups overwritten within 30 days |
When a period ends, the data is deleted or irreversibly anonymised. We may keep data longer where the law requires it or where it is needed for a legal claim, for as long as that need lasts.
10. How we protect it
- All traffic is encrypted in transit (HTTPS/TLS). Passwords are stored as salted hashes; calendar tokens and two-step verification secrets are encrypted at rest.
- Two-step verification is available to every account; accounts lock after repeated failed sign-ins; staff sessions expire after inactivity.
- Access is restricted by role: a clinic sees only its own clients and patients, a provider only its own bookings, and a pet parent only their own data and what was shared with them. Documents are served only after an ownership check.
- Security-relevant actions are written to an audit log. Uploaded files are validated and cannot be executed on the server.
- Our staff access personal data only when necessary for maintenance or support, and are bound by confidentiality.
No system is perfectly secure. If a personal-data breach is likely to result in a risk to your rights and freedoms, we notify the National Commission for Data Protection within 72 hours and, where the risk is high, we inform you without undue delay.
11. Cookies and local storage
- Strictly necessary. A session cookie keeps you signed in and protects forms against forgery. Your browser’s local storage keeps small preferences (for example your language, or the contents of your order before you send it). These do not require consent.
- Statistics. Our own statistics use no cookies.
- Optional. If Google Analytics is enabled, it is loaded only after you accept it in the cookie banner; you can change your choice at any time with the “Cookie settings” link in the footer.
- Third-party files. Some fonts, icons and scripts are delivered by a content-delivery network, which receives your IP address to send the file.
We do not use advertising cookies.
12. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access your data and obtain a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17), subject to data that must be kept by law;
- have processing restricted (Art. 18);
- receive your data in a structured, commonly used, machine-readable format — portability (Art. 20);
- object, on grounds relating to your situation, to processing based on legitimate interest (Art. 21), and object at any time to direct marketing;
- withdraw a consent at any time, without affecting what was done before (Art. 7(3));
- lodge a complaint with a supervisory authority (Art. 77).
How to exercise them
- Pet parents: Profile → “Download my data” and “Delete my account”; contact preferences in your profile.
- Pet-care providers: Dashboard → Account → “Download my data” / “Delete account”.
- Clinic staff: Dashboard → Account → “Download my account data”; ask your clinic administrator to deactivate your account.
- Records kept by your clinic or provider: contact that professional, who is the controller; we assist it in answering you.
- Anything else: write to contact@noa.vet. We may ask for proof of identity where we have reasonable doubt.
We answer within one month. This period may be extended by two further months for complex or numerous requests; we tell you so within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
13. Automated decisions
We do not take decisions that produce legal effects for you, or similarly significant effects, solely by automated means. Photos and videos are checked automatically before publication and may be refused; you are told why, and you can ask a person to review the refusal by writing to contact@noa.vet.
14. Minors
The platform is intended for adults. We do not knowingly create accounts for people under 18. If you believe a minor has given us data without the agreement of a parent or guardian, write to contact@noa.vet and we will delete it.
15. Changes to this policy
We update this policy when our processing changes — for example when we add a service provider, change a retention period or introduce a feature. The version and date are shown at the top of the page. For material changes, signed-in users are informed and asked to confirm that they have read the new version.
16. Contact and complaints
For any question about your data, write to contact@noa.vet or to My solutions SARLS, 7 rue de la corniche remich, Luxembourg.
If you are not satisfied with our answer, you can lodge a complaint with the supervisory authority of the country where you live or work, or with our lead authority: Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.public.lu.