Privacy Policy

Last updated: November 2026

Your privacy matters to us. This policy explains what information we collect, why we collect it, how we use it, and your rights regarding your data when you use DrRosieDVM.com and its associated services.

Information We Collect

We collect information in the following ways:

Information You Provide

  • Account information: When you create an account, we collect your name, email address, and authentication credentials through our identity provider, Clerk.
  • Profile data: Optional information you choose to share, such as pet species, breed, and areas of interest, to personalize your experience.
  • Payment information: When you subscribe to premium content, payment details are processed securely by Stripe. We do not store your full credit card number on our servers.
  • Communications: Messages you send through our contact form, AI chat assistant, or email correspondence.
  • Sales calls and our booth: Our sales line is answered by Dr. Rosie, an AI. Calls are recorded and transcribed, and your phone number (caller ID) is saved with the conversation so our team can reach you. Conversations with Dr. Rosie at our booth are saved too.
  • Remembering you: If you call our sales line, or chat with Dr. Rosie while signed in, she recognizes you by your phone number or your account and uses what you told her before. Ask us to delete your conversations and she no longer will.
  • Your number at our booth: If you give Dr. Rosie your phone number at our booth, she uses it to recognize you when you call our sales line from that phone, and our team uses it only if you ask us to call you back. We never text it.
  • Your clinic's Google listing: When you tell Dr. Rosie your clinic's name and town, she may look up the clinic's public Google listing to answer you. We keep only Google's ID for that listing — never its name, address, rating or reviews.
  • Licenses and course records. Licenses you save (state, license number, profession, expiry and renewal dates, CE Broker ID) are used to show your renewal dates and, if you also use Dr. Rosie's practice tools, to fill in forms that ask for your license number. If you belong to a Practice Team, its owners and managers can see your license state, number, status and renewal date, the CE you have logged and whether you have completed the courses they require, and every member of the team can see teammates' names, email addresses, completed courses, rewards and streaks on the team leaderboard. We use your course activity to run your CE account. When your account deletion completes (after a 30-day grace period), your licenses and your course activity (enrollments and progress, quiz attempts, certificates and their stored PDFs, course reviews, logged outside CE and uploaded scans, badges, learning-path progress, CE Broker reports, waitlist entries, watch-time records and review-card schedules) are deleted, and your name and email are removed from any Practice Team member list. A Practice Team keeps its record of the rewards it paid, without your name. A certificate can be checked by its number on a public verification page, which shows the holder's name and course; when an account is deleted its certificates are deleted and their numbers no longer verify.

Information Collected Automatically

  • Usage data: Pages visited, content viewed, search queries, and interaction patterns to improve our platform.
  • Device information: Browser type, operating system, screen resolution, and device identifiers.
  • Network data: IP address, approximate geographic location (country and region level), and referring URLs.

Memorial candles

When you light a candle on a memorial page, we store the name and message you write, when you lit it, and which account lit it. Other people — including the memorial’s owner — see only the name you chose (or “Someone”) and your message, never your account or email address.

We keep the link to your account to provide the feature you chose to use — so that you can delete your candle — and in our legitimate interest in preventing abuse, so that we can act if a candle breaks our Terms. A candle stays until you or the memorial’s owner delete it, or until we remove it under our Terms. If your account is deleted, or your data is erased at your request, your candles are deleted as part of that.

If you report a candle or a memorial, we store the report, the reason you chose, any note you add, and which account sent it. Neither the person you reported nor the memorial’s owner is ever told who reported. We use the link to your account only to keep to one report per person and to stop misuse of reporting. If your account is deleted, or your data is erased at your request, your reports stay for review but are no longer linked to you.

If you block someone, we store which account you blocked, along with the candle name and the pet’s name you saw when you did, so that your Blocked people list can show it. We use it only to keep that person’s candles and memorials out of your view and their candles off your memorials. The person you block is not told, and if someone blocks you, you are not told either. A block is deleted when it is undone, or when either account is deleted or its data is erased at its holder’s request.

If we stop an account from posting under our Terms, we record on the account when we did it and why, and we tell the account holder by email. While it is stopped, the account cannot light candles and its candles are hidden. The record is cleared when we lift the stop.

How We Use Your Information

We use your information to:

  • Provide, maintain, and improve our educational platform and services
  • Personalize your content recommendations based on your interests and pet profiles
  • Process payments and manage subscriptions
  • Power the Dr. Rosie AI assistant with relevant context for your questions
  • Send important account notifications and, with your consent, educational newsletters
  • Keep the email you leave on a waitlist or sign-up form, with the role and practice name you enter, add the email and practice name to that product's list at our email provider, send you a confirmation, and email you about that product's launch (write to hello@drrosiedvm.com to have it removed)
  • Analyze aggregate usage patterns to improve content quality and site performance
  • Detect and prevent fraud, abuse, or security threats
  • Comply with legal obligations
  • Share your pet's records and your contact details among the clinics of one veterinary company, so each of its clinics that sees your pet has the whole file. Your app shows which clinics share each pet's records.

Cookies and Tracking Technologies

We use cookies and similar technologies, grouped into the categories below. Analytics and advertising cookies are off by default and load only after you consent through our cookie banner. Full details are in our Cookie Policy.

  • Essential cookies: Required for authentication, session management, security, and remembering your theme and language. These cannot be disabled.
  • Analytics (cookie-based tracking needs consent): Privacy-hardened product analytics. PostHog records browser events only after you allow it (see PostHog below). With your analytics consent we also store first-party page-view and event records. Vercel Analytics page counts need no cookie and run on every visit to the website, our servers send product events for signed-in accounts, and the watch time of lessons and videos is recorded against a random session number (and, when signed in, the account).
  • Counting our own advertisements (analytics consent): With analytics cookies allowed, we also count how often our own paid advertisements load. We never use analytics data to choose advertisements or to build advertising profiles.
  • Third-party advertising cookies (consent required): On our public marketing pages only, and only after you consent, we use Google Tag Manager, the Meta (Facebook) Pixel, and Google Ads to measure and improve our own advertising. These never load on authenticated clinic, portal, or app pages. They are separate from the paid advertisements described below, which use no third-party code.
  • Operational event logging: Some authenticated product workflows, including billing and team-management actions, are logged on our servers so we can process subscriptions, investigate failures, prevent abuse, and improve reliability. These are first-party service logs, not advertising trackers.

We do not sell your personal information for money. Because advertising cookies may be considered a "sale" or "sharing" under some U.S. state privacy laws, we keep them off until you opt in and honor the Global Privacy Control signal. You can change or withdraw consent anytime via "Your Privacy Choices" in the footer.

Our own paid advertisements

Some public pages may show clearly labeled advertisements that we sell directly to advertisers. Which advertisement appears depends only on the page, your site language and the booking dates — never on your browsing history or a profile. We check whether you have a paid plan and whether you are using our app, because paid members and app users never see these advertisements.

If you allow analytics cookies, your browser tells our server when an advertisement's image loads or fails to load. A click on an advertisement passes through our own web address, which records the click before sending you on. Each record holds only which advertisement it was, what happened and when — no account, session, cookie value, IP address or page address. We keep these records for 90 days and then keep only daily totals per advertisement. Advertisers receive those totals, never records about you.

The server that receives image-load reports applies a security rate limit, which keeps your IP address and a time for about seven days. While that record exists, a report could in principle be linked to an IP address by its timing, so we do not describe this counting as anonymous.

Advertisers cannot place cookies, pixels or code on our pages: we store and serve their images ourselves. Our Advertising Policy explains what we accept and how advertisements are marked.

If you advertise with us or ask about advertising: we keep your company details, your business contact name and email address, our correspondence and notes, your booking and payment records, and the ad you give us (picture, words, link). We use them to answer you, run and bill your bookings, handle disputes and legal obligations, and contact you about future advertising.

To check an ad against our rules, we send the ad — its picture and words, your company name and the link — to our AI providers (Google and Anthropic). A person at Dr Rosie DVM makes every approval. Payments are handled by Stripe; we do not see or keep your card number. If you start an order and never send it, we delete the picture you uploaded after 30 days.

We keep the rest until you ask us to delete it — write to hello@drrosiedvm.com. When you ask, we erase your contact details and your orders’ contact fields. We keep payment and refund records and the correspondence we hold as business records, because the law requires some of it and the rest is our record of the business. You can also ask us at any time to stop contacting you.

Third-Party Services

We partner with trusted third-party services to operate our platform. Each has their own privacy policy governing how they handle your data:

  • Clerk — Authentication and user management. Handles login credentials, session tokens, and identity verification.
  • Stripe — Payment processing for premium subscriptions. Stripe is PCI DSS Level 1 certified, the highest level of security certification.
  • Cloudflare — DNS, content delivery and file storage (R2) for our media and documents (certificates included), video (Stream), bot protection (Turnstile) and an AI gateway. Cloudflare processes traffic data to serve and protect these services.
  • Facebook Login (Meta) — Optional social sign-in. If you choose to log in with Facebook, we receive your name, email, and profile picture. You can revoke access and request deletion of your Facebook data at any time via our Facebook Data Deletion page.
  • YouTube — Video hosting for our free educational content. Embedded YouTube videos may set cookies when played. YouTube is governed by Google's privacy policy.
  • PostHog — Privacy-hardened product analytics (autocapture and session recording disabled). Until you allow analytics, your browser makes no request to PostHog and keeps nothing from PostHog other than a note of your choice. Once you allow analytics, your browser sends events to PostHog's servers, which see your IP address. If you are also signed in, PostHog receives your email, name, account IDs, plan and payment status and amount, days since sign-up, profession, practice name, role, size and type, license states, course counts, certificate status, region and weight unit. If you type your email into a sign-up or request form on our website after allowing analytics, PostHog receives that email, your role and your practice name, even if you are not signed in. Our servers also send product events for signed-in accounts, such as course progress and quiz results.
  • Google (Tag Manager & Google Ads) — Advertising measurement and conversion tracking on our public marketing pages, using Google Consent Mode v2. Loads only with your advertising consent.
  • Meta (Facebook Pixel) — Advertising measurement on our public marketing pages. Loads only with your advertising consent. This is separate from the optional Facebook Login above.
  • Vercel — Application hosting and privacy-friendly traffic analytics.

We only share the minimum information necessary for each service to function. A complete, current list of our data processors is on our Subprocessors page. We do not sell your personal information for money.

Data Retention

We retain your data according to the following guidelines:

  • Account data: Retained as long as your account is active. You may request deletion at any time.
  • Payment records: Retained for seven years as required by tax and financial regulations.
  • Usage analytics and audit records: Page-view and event records tied to your account are deleted when your account is deleted; records not tied to an account, and aggregated or anonymized usage data, may be retained indefinitely. Security, team-management and seat-billing audit records (for example denied requests, team changes and seat changes) are kept permanently by design, as our record of who did what; the security records keep the IP address and device details of those events, and your email is removed when you delete your account. Our daily database backup expires 30 days after it is made, so deleted data leaves it within 30 days.
  • Conversations with Dr. Rosie: Kept until you ask us to delete them or you delete your account, so you can pick up where you left off and, if you asked about RosaVet, so our team can follow up. Email hello@drrosiedvm.com to have yours deleted.
  • Advertisement counts: Records of advertisement image loads, image-load failures and clicks are kept for 90 days; after that, only daily totals per advertisement are kept.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data, subject to legal retention requirements. How to delete your account
  • Portability: Request your data in a structured, machine-readable format.
  • Objection: Object to processing of your data for specific purposes.
  • Withdrawal of consent: Withdraw consent for optional data processing at any time.
  • Opt out of "sale" or "sharing": Under California (CCPA/CPRA) and similar U.S. state laws, you may opt out of the use of advertising cookies. Use "Your Privacy Choices" in the footer, or send a Global Privacy Control signal, which we honor automatically.
  • Non-discrimination: We will not deny you service, charge a different price, or provide a lesser experience for exercising any of these rights.

For EU/EEA and UK residents (GDPR/UK GDPR), we process personal data on the legal bases of consent, contract, legal obligation, and legitimate interests, and you have the right to lodge a complaint with your local data-protection supervisory authority. For Brazilian residents, the LGPD affords equivalent rights. To exercise any right, contact us at hello@drrosiedvm.com. We will verify and respond within the time required by applicable law (generally 30 days, or 45 days under the CCPA).

Contact Us

If you have questions or concerns about this privacy policy or our data practices, please reach out:

Email: hello@drrosiedvm.com

We may update this policy from time to time. When we do, we will revise the "last updated" date at the top and, for material changes, notify you via email or a prominent notice on our site.

This policy is published in English. Translations are provided for convenience only; if there is any conflict or inconsistency between the English version and any translation, the English version controls.