This policy explains how Telvo LLC processes personal data entered by an Organization in vetman when the Organization is the controller and Telvo LLC is its processor. Binding terms are in the Data Processing Agreement.
1. Roles
The Organization decides what data to enter, its purpose, who receives access or communications, and when a record is corrected or deleted. vetman carries out those decisions through platform features and documented instructions.
Telvo LLC is separately a controller for purposes such as account administration, security logs, billing and support communications. That processing is covered by the Privacy Policy.
2. Data and data subjects
Processing on the Organization's instructions may include:
- client or representative names, contact details, address, personal number, notes and billing data;
- animal identification and related clinical records, diagnosis, prescriptions, laboratory results, surgery, hospitalization, photographs, video and documents;
- staff, external consultant and supplier contact and activity data; and
- technical data including sign-in time, IP address, sharing use and activity logs.
An animal health record is not itself human health data. Free text and uploaded files may, however, contain sensitive human information. The Organization must not enter it unless necessary and lawful.
3. Purposes and core rules
We process data to provide platform functions: storage, search, display, documents, reporting, communications, support, security and backups.
We process only under the agreement, actions taken by the Organization in the platform and its additional written instructions. Organizations are logically separated and access is role-based. Our personnel receive access only for a work need and under confidentiality obligations. We do not sell Organization data, use it for advertising or show it to another Organization. Retention is limited to service, contract, legal and technical backup needs.
4. Recipients and international processing
Hosting, communications and other support providers may participate in delivery. The current provider, purpose and location are listed in the Subprocessor List.
The main application infrastructure is in DigitalOcean's Frankfurt region, Germany. An optional external function such as SMS receives data only when it is actually configured, used by the Organization and first disclosed in the current list.
5. Security and incidents
Measures include HTTPS/HSTS, password hashing, session time limits, sign-in rate limits, roles, tenant separation, protected file delivery, logs of significant writes and security events, encryption of configuration secrets and backups. Annex B to the DPA provides more detail.
On discovering an incident, we begin assessment, containment and documentation and notify the Organization without undue delay with available information needed for its obligations.
6. Data-subject requests and termination
If a client or other data subject contacts us about data controlled by an Organization, we refer the request to that Organization. We reasonably assist with locating, copying, correcting, restricting and deleting data.
At termination, the Organization may request return of available data or deletion. The process may currently require manual work. Mandatory retention and backup cycles take precedence.
7. Organization responsibilities
The Organization is responsible for lawful bases, transparent notices, minimization and accuracy, access management, sharing links, the basis for communications and the security of its user accounts.
For questions, use the contact page.