Subprocessors

Data scope. Chat prompts and clinical-context strings sent through the AI Gateway; drug interaction safety checks and literature extraction (first-ranked model since 2026-09-06). Dr. Rosie Professional diagnostic consults (veterinary professionals, RosaCE): the case text, answers and picked species, after client names and contact details are removed, and the retrieved literature (Gemini Flash for the first read, Gemini Pro for the full answer). PHI scrubbing is applied at the application boundary; embeddings are computed on de-identified text. Under the paid Gemini API terms, Google does not use prompts or responses to improve its products. That training-use protection does not itself establish zero retention; current terms and account configuration govern retention.

Location. US data centers (regional pinning supported)

Data scope. Drug interaction safety checks (the fallback since 2026-09-06), SOAP note generation fallback, occasional analysis tasks. Dr. Rosie Professional diagnostic consults, while we compare models (Claude Opus 5.5, Claude Sonnet 5.5 and Claude Fable 5.1): the same scrubbed case text, answers and literature. Claude Fable 5.1 requests are kept by Anthropic for up to 30 days (its required data retention). Routed via Cloudflare AI Gateway with cache + redaction layer. Anthropic’s commercial terms do not allow training on customer content.

Location. US data centers

Data scope. Voice audio captured during DVM dictation sessions, transcribed to text and returned. Requests include the model-improvement-program opt-out to exclude the audio from model training. The training opt-out does not itself establish zero retention; retention is governed separately by provider terms and account configuration.

Location. US data centers

Data scope. The voice for AI callbacks (phone calls to a pet owner after a visit, with the pet’s name and visit follow-up details), Dr. Rosie’s phone, booth and website voice (what a visitor says to her and what she answers), and article narration. Our policy requires model-training opt-out for this account. Retention is governed separately by provider terms and account configuration; contact our team for current account-setting evidence. This disclosure is not a live verification of those settings.

Location. US (ElevenLabs’ standard hosting)

Data scope. Email, display name, and authentication state for every user (consumer + practice staff). Practice roles are stored in our own Postgres, not in Clerk metadata.

Location. US data centers

Data scope. Card / bank tokens, billing addresses, subscription state, and payout details for practices on Stripe Connect. No card numbers ever touch our servers.

Location. US + EU data centers

Data scope. Serverless function execution, HTTP request logs, edge config and page-visit counts (Vercel Analytics, on the website). Request logs and page counts are kept by Vercel under its own retention.

Location. US data centers (per-region pinning via project config)

Data scope. All application data — patient, client, encounter, SOAP, billing, audit-log rows. Postgres + pgvector + tsvector. Backed up daily to private storage.

Location. EU West (Amsterdam, Netherlands)

Data scope. Addresses you type into an address field (autocomplete), clinic addresses for map coordinates, and clinic names and addresses used to find a clinic’s own public Google listing and nearby clinics (Rosie Growth), and the clinic name and town a visitor gives Dr. Rosie, to find that clinic’s public listing for her reply. We keep Google place IDs, and map coordinates for at most 30 days; listing names, addresses, ratings and review counts are read live and never stored. Google acts as an independent controller under its Maps Platform terms.

Location. Google global infrastructure

Data scope. Only when a staff member registers a pet’s microchip with the Animal-ID registry: the pet’s name, species and microchip number, and the owner’s email address and phone number.

Location. Animal-ID’s own hosting; the vendor does not state a region

Data scope. DICOM imaging (R2), document storage (R2), CDN caching of public assets, AI Gateway proxy for outbound LLM calls, and bot protection (Turnstile) on the public sign-up and request forms.

Location. Global edge; R2 storage region per bucket config (defaults to US)

Data scope. Premium CE video content. No PHI; only published educational material.

Location. Global edge

Data scope. SMS recipient phone numbers + message bodies for appointment reminders and client communications (templates render in the recipient locale). Voice calls: the caller’s phone number and the call audio on our sales line and on clinics’ AI phone lines.

Location. US data centers

Data scope. Transactional email recipients, subjects and bodies. Also holds the email lists behind the waitlist and sign-up forms: each address given there is added to that product's list with the practice name entered, and used to tell people about that product's launch; an account deletion removes the entry for the account's email address.

Location. US data centers

Data scope. Live video and audio for telemedicine visits between a clinic and a pet owner, with the room and participant details needed to connect the call.

Location. Vendor-managed; see the DPA

Data scope. Embedded free educational video content. Public videos only; no end-user PII is sent.

Location. Global

Data scope. Application error stack traces + breadcrumbs, and performance traces from the browser (5% of page loads in production). PHI scrubbing is applied client-side and server-side (see sentry-scrub.ts) before transmission.

Location. US data centers (EU region available; not currently used)

Data scope. Product analytics (autocapture and session recording disabled). Browser requests to PostHog only with your consent; product events from our servers for signed-in accounts. Once allowed, about twenty profile details are sent (email, name, account IDs, plan and payment status and amount, days since sign-up, profession, practice name, role, size and type, license states, course counts, certificate status, region, weight unit), and an email typed into a sign-up or request form goes with its role and practice name, even when signed out.

Location. US + EU data centers (project-level region selection)