1. Who we are
VaroVet is operated by SIA Waldemaar Group, reg. no. 40203737019, registered office Rīga, LV-1029, Latvia ("VaroVet", "we", "us"). For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), we are the data controller for personal data collected through the varovet.com website and the VaroVet service when used by clinic administrators and prospective customers.
For Clinic Data — everything a clinic records in its account, including owner and pet profiles, medical history, visits, vaccinations, invoices, staff, schedules and settings — the clinic is the controller and VaroVet acts as processor under a separate Data Processing Agreement. The clinic decides how this data is used and may have it deleted.
Separately, when a pet owner creates their own account in the pet-owner portal and accepts the Pet Owner Portal Terms, VaroVet maintains a personal pet health record for that owner as an independent controller on its own legal basis. That record is a separate service between VaroVet and the pet owner; see the Pet Owner Privacy Policy.
2. Information we collect
- Account information you provide on signup: name, email, clinic name, phone number, password (hashed).
- Billing information needed to charge a subscription: company details, VAT number, billing address. Payment card details are processed by Stripe and never stored by us.
- Marketing-form submissions (e.g. webinar signups, demo requests): name, email, optional phone, clinic name, the form's source.
- Usage data: pages viewed, actions performed, device, browser, IP, approximate location derived from IP. Used to operate the service and improve reliability.
- Cookies and similar technologies as described in our Cookie Policy.
3. How we use it
| Purpose | Legal basis |
|---|---|
| Provide and operate the VaroVet service | Performance of a contract (Art. 6(1)(b)) |
| Send transactional emails (verification, password reset, billing) | Performance of a contract (Art. 6(1)(b)) |
| Customer support | Performance of a contract (Art. 6(1)(b)) |
| Marketing communications about VaroVet | Consent (Art. 6(1)(a)) — opt-in only |
| Security, fraud prevention, audit logs | Legitimate interest (Art. 6(1)(f)) |
| Analytics and advertising (Meta Pixel, Google Ads) | Consent (Art. 6(1)(a)) — via cookie banner |
| Compliance with legal obligations (accounting, tax) | Legal obligation (Art. 6(1)(c)) |
4. Who we share data with
We use the following sub-processors. Each is bound by a written contract that meets the requirements of Art. 28 GDPR:
- Railway Corp. (USA) — application hosting and database
- Cloudflare, Inc. (USA) — CDN, DDoS protection, static site hosting
- Resend (USA) — transactional and marketing email delivery
- Stripe Payments Europe Ltd. (Ireland) — payment processing
- text2reach — SMS delivery
- Functional Software, Inc. (Sentry) (USA) — application error monitoring
- Meta Platforms Ireland Ltd. — advertising / retargeting (only if you accept marketing cookies)
- Google Ireland Ltd. — advertising / analytics (only if you accept marketing cookies)
We do not sell personal data. We disclose data to authorities only where compelled by valid legal process.
5. International transfers
Some sub-processors are located outside the European Economic Area. For such transfers we rely on the European Commission's Standard Contractual Clauses and, where applicable, supplementary measures.
6. Retention
- Clinic Data (owner/pet profiles, medical history, visits, vaccinations, staff, schedules, settings): retained while the clinic's account is active, and deleted on the clinic's instruction — in full on offboarding — subject to backup cycles. The clinic controls this data and is responsible for any veterinary record-retention obligations that apply to it.
- Pet-owner portal records: where a pet owner holds their own portal account, their personal record is retained under the separate Pet Owner Privacy Policy, on VaroVet's own legal basis, and is not affected by a clinic's deletion of its Clinic Data.
- Marketing leads (e.g. webinar signups): up to 24 months from collection unless you object earlier.
- Accounting documents (invoices): retained for the period required by Latvian law (typically 5 years).
- Server and audit logs: up to 12 months.
7. Your rights
Under GDPR you have the right to:
- access your personal data,
- rectify inaccurate data,
- request erasure ("right to be forgotten") within the limits set by law,
- restrict or object to processing,
- data portability,
- withdraw consent at any time without affecting prior processing,
- lodge a complaint with the supervisory authority — in Latvia: Datu valsts inspekcija (www.dvi.gov.lv).
To exercise these rights, email us at support@varovet.com.
8. Security
We apply industry-standard technical and organisational measures to protect personal data, including TLS encryption in transit, encryption at rest for database backups, scoped access for staff, and continuous monitoring. No method of transmission is 100% secure; we cannot guarantee absolute security.
9. Children
The VaroVet service is intended for use by veterinary professionals. We do not knowingly collect personal data from children.
10. Changes
We may update this policy from time to time. Material changes will be communicated by email or via the service. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
SIA Waldemaar Group
Rīga, LV-1029, Latvia
Reg. no.: 40203737019
Email: support@varovet.com