Who is responsible
For clinic records (patients, owners, appointments, medical records and messages a clinic keeps), the clinic is the personal information controller. Vet Clinic processes that data on the clinic’s behalf and only on its instructions.
For Waggle app accounts and the data owners add themselves, Vet Clinic is the controller.
What we collect
Accounts
- Name, email address and a hashed password.
- For clinic administrators: a contact number, and the clinic’s name, phone and address.
- Sign-in sessions, with the IP address, browser or device description and time of sign-in, used for security.
Clinic records
- Owner contact details and pet profiles, including photos.
- Appointments, medical records, care due dates, reminders and messages between the clinic and linked owners.
- An audit log of who created, changed or deleted a record and when.
Waggle app
- Pets, personal reminders and files owners upload (PDF, PNG, JPEG or text, up to 2 MB each).
- Bookings, caregiver invitations and record-sharing links.
- Payment records: amounts, status and refund status. Card and e-wallet details are entered on PayMongo’s checkout and are never received or stored by us.
We collect only what these features need. The public website has no analytics, advertising or tracking scripts.
Why we use it
- To provide the service you or your clinic signed up for: records, scheduling, reminders, messages and bookings (contract).
- To keep accounts secure, prevent abuse and keep an audit trail (legitimate interest and legal obligation).
- To process booking payments and refunds through PayMongo (contract).
- To send password-reset emails you request (contract).
- Optional cookies only with your consent. See the cookie policy.
How long we keep it
- Sign-in sessions end after 8 hours.
- Account data is kept while the account is active, and deleted or anonymised after a verified deletion request, unless we must keep it.
- Medical records, payment records and audit logs may be kept for as long as the clinic or the law requires, even after a deletion request.
How we protect it
- Passwords are hashed. Session cookies are HTTP-only and sent only over HTTPS.
- Each clinic’s data is separated from every other clinic’s, and staff only see the clinic they belong to.
- Sign-in and API requests are rate-limited.
- Changes to records are written to an audit log.
Your rights
Under the Data Privacy Act you have the right to:
- be informed about how your data is processed;
- access a copy of your data;
- correct inaccurate data;
- object to processing, or withdraw consent you gave earlier;
- have your data erased or blocked;
- receive your data in a portable format;
- complain to the National Privacy Commission (privacy.gov.ph).
Use the data request form to ask for any of these. If a clinic holds your data, we pass the request to that clinic and help it respond.
Children
The service is for clinic staff and adult pet owners. We do not knowingly collect data from children.
Changes and contact
We will post changes here and update the effective date. For significant changes we will also tell signed-in users.
Email privacy@vetclinic.example.