Privacy policy

1. Data controller

PetiVeto is a service published by company name, legal form and share capital, with its registered office at registered office address, registered with the trade register of city under no. RC number, ICE no. ICE number. Contact: contact@petiveto.com.

The processing described here has been declared to the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP), receipt no. CNDP declaration receipt number.

2. Who is responsible for what

• PetiVeto is the data controller for mobile app accounts, clinic dashboard accounts, the clinic directory and the website.
• For the records a clinic keeps about its clients and their animals in the clinic dashboard, the clinic is the data controller. PetiVeto then acts as a processor within the meaning of articles 23 and 24 of Law 09-08: we host and process that data only to provide the service to the clinic, on its instructions.
• If your request concerns a record held by your clinic, contact the clinic first. You can also write to us: we will forward your request and help the clinic answer it.

3. Data we collect

• Pet owners (app): first name, last name, email address, phone number, password (never stored in plain text, only as a hash), and if you add them: profile photo and postal address. We also store your language and notification preferences.
• Your animals: name, species, breed, sex, date of birth, colour, photo, microchip number, blood group, allergies, notes, emergency contact, weight, vaccines, medical records, documents, tasks and reminders, and the “lost pet” flag if you turn it on.
• Appointments and conversations: appointment requests, their reason and status, messages exchanged with a clinic, and messages sent to our support.
• Family sharing: the email address or phone number of the person you share an animal’s record with.
• Clinic teams (clinic dashboard): name, email address, phone, hashed password, role in the clinic, and if you fill them in: specialty, licence number, photo. For the clinic: name, address, city, GPS coordinates, phone, email, opening hours, photos, and information about its patients, calendar and stock.
• Directory: so that owners can find a clinic even before it signs up, we publish the business contact details of veterinary clinics collected from public sources (name, address, phone, opening hours). A clinic can claim, correct or have its listing removed at any time.
• Sign in with Google or Apple: if you choose this option, we receive your name, email address (Apple may provide a relay address) and an account identifier from Google or Apple. We do not receive your password or your contacts.
• Technical data: for each session, the IP address and device or browser type; sign-in and code attempts, to block abuse; a notification token if you allow notifications on your phone; for PetiVeto administrator accounts, a log of the actions taken.

We do not collect your contacts, do not track your location, use no advertising identifier, and include no analytics or advertising tools. We process no payment data.

4. Mandatory and optional data

To create an account, your name, email address, phone number and password are required: without them we cannot verify your account or let your clinic find you. Everything else is optional; leaving it out only limits the features that depend on it (for example, vaccine reminders without vaccination dates).

Information about your animals is not sensitive data within the meaning of Law 09-08, which protects the health of people. We nevertheless treat it with the same level of confidentiality.

5. Location, photos and files

• The app may ask for your location to sort clinics from nearest to farthest. This is calculated on your phone: your location is neither sent to our servers nor stored. You can decline or withdraw this permission in your phone’s settings.
• The app accesses your photos or files only when you choose to add one. Only the chosen file is uploaded.

6. Why we use your data

• To provide the service (performance of the terms of use you accept): health records, reminders, booking, messaging, sharing, directory, clinic management.
• To secure accounts (legitimate interest and the security obligation of article 23 of Law 09-08): email verification by code, session management, attempt limits, abuse detection.
• To write to you when the service requires it: verification codes, team invitations, notifications about your appointments and messages. Phone notifications are only sent if you have allowed them.
• To answer your support requests.
• To publish the clinic directory (legitimate interest of owners in finding a veterinarian; the clinic may object).
• To comply with our legal obligations and answer requests from competent authorities.

We do not send you marketing by email, SMS or notification without your prior consent, in accordance with article 10 of Law 09-08.

The “health score” shown for an animal is calculated automatically, for information only, from the recorded vaccines, weigh-ins and visits. It is not veterinary advice and has no legal effect on you.

7. Who can see your data

• The clinic you book with or are linked to: it sees your contact details, the animals concerned, your appointment requests and your conversations with it. The records it enters for your animals appear in your app.
• The people you share an animal’s record with, read-only, until you remove the share.
• Authorised members of the PetiVeto team, only when necessary (support, security, clinic verification). Access to the administration console requires two-factor authentication and every action there is logged.
• Our technical providers, who act on our instructions and only to run the service (see section 8).
• Judicial or administrative authorities, when the law requires it.

We do not sell or rent your data, and do not use it for advertising.

8. Hosting and transfers outside Morocco

Our servers and database are hosted in Morocco by hosting provider name.

Some providers essential to the service are established abroad. These transfers comply with articles 43 and 44 of Law 09-08 and have been authorised by the CNDP, authorisation no. CNDP transfer authorisation number. Only the data needed for their task is sent to them:

• Cloudflare (storage of uploaded photos and documents): Cloudflare R2 storage country or region.
• Google (delivery of emails sent by the service, and Google sign-in if you choose it): United States and European Union.
• Expo (routing of notifications to your phone), then Apple or Google depending on your device: United States.
• Apple (Apple sign-in if you choose it): United States.

9. How long we keep data

• Account data and your animals’ records: for as long as your account exists.
• After a deletion request: the account is deactivated immediately, then your personal data is erased or anonymised within 30 days. Backup copies are overwritten no later than 30 days after that.
• Records held by a clinic: they belong to the clinic and are kept according to its own professional obligations. Deleting your app account does not delete the record your clinic holds; contact the clinic.
• Session data (IP address, device): 12 months after the session ends.
• Verification codes: a few minutes, after which they no longer work.
• Support messages: 2 years after the request is closed.
• Administration action log: 5 years, so that we can answer an authority or a dispute. Once an account is erased, the log no longer contains data that identifies the person.
• Closed clinic account: on request, we give the clinic a copy of its data, then delete it within 90 days.

10. Your rights

Law 09-08 gives you a right to information, a right of access to your data (article 7), a right to rectification (article 8) and a right to object, on legitimate grounds, and at any time without giving a reason in the case of marketing (article 9). You can also ask for your account to be deleted and withdraw any consent you gave (notifications, location) at any time.

You can change most of your information directly in the app or the clinic dashboard. To delete your account, use “Delete account” in the app (Profile › Privacy & Security) or write to contact@petiveto.com from the address linked to your account. For any other request, write to the same address.

We reply free of charge within 30 days at most. If we have doubts about your identity, we may ask for proof before replying.

If you believe your rights have not been respected, you can lodge a complaint with the CNDP (www.cndp.ma).

11. Minors

PetiVeto accounts are reserved for adults (18 years old). A minor may use the account of a parent or legal guardian, under their responsibility. If we learn that an account was created by a minor, we delete it.

12. Cookies and storage on your device

• petiveto.com website: no advertising or analytics cookies. A single, strictly necessary cookie: pv_lang, which remembers your chosen language (one year).
• Clinic dashboard: one cookie remembers the language, another the light or dark theme (one year). The token that keeps you signed in is kept in the browser’s storage: until the tab is closed, or until you sign out if you ticked “Remember me”.
• Mobile app: your sign-in tokens are kept in the phone’s secure storage (iOS Keychain or Android Keystore); your preferences stay on the device.

These items are necessary for the service to work and therefore do not require consent. None is used to track you.

13. Security

Traffic is encrypted (HTTPS). Passwords are hashed; session tokens are stored as fingerprints, never in plain text. Password and code attempts are limited. Each clinic can only access its own data. Access by PetiVeto administrators requires two-factor authentication and is logged.

If a data breach is likely to affect you, we will inform you and the CNDP as soon as possible, together with the measures taken.

14. Changes

We may change this policy, for example when the service evolves. If the change is significant, we will tell you by email or in the app before it takes effect. The date of the last update is shown at the top of this page.

15. Contact us

For any question about your data: contact@petiveto.com, or by post to registered office address.