Your pet's TailPlan card: how we handle the data

1. Who is responsible

The card (the "card layer") is run by TailPlan, as controller, with your consent when you add a clinic. Contact: info@tailplan.vet.

Each clinic is responsible for its own records (your details, your pet's file, visits, bookings, messages). TailPlan processes those records on behalf of each clinic, as its processor, under a contract with it.

2. What the card holds, and what it never holds

The card holds: your pet's name and species, the microchip number if you gave it (encrypted), which clinics are linked and which one is home, which clinic reminds each procedure, your consents (which text, which version, when), and your Telegram chat if you linked it (encrypted).

The card never holds your name, phone number or e-mail, notes, products or prices. Those stay in each clinic's own records.

When you ask to add a clinic, the name and phone number you type are sent only to that clinic (encrypted with its key) so it can find you in its records, and they are deleted from the request as soon as the clinic answers.

3. What the clinics on the card see

A clinic that accepted sees which procedures were done or are due at the other clinics on the card: the procedure (a generic name) and the date only, shown as "another clinic".

Clinics never see each other's names, notes, products, prices, bookings, messages, or the contact details you gave to other clinics. Only you see the list of your clinics, on the card.

4. Who reminds you

For each procedure only one clinic sends you reminders: the clinic that did it last, otherwise your home clinic. If that clinic cannot send (for example because of an unpaid bill), another clinic on the card takes over. The card shows which clinic reminds each procedure, and you can change it.

5. Legal bases, and how to withdraw

Linking clinics and sharing between them: your consent (GDPR Article 6(1)(a)). Withdraw it by removing a clinic from the card or by deleting the card. Withdrawing does not affect what happened before.

Running the card you asked for (the Wallet card and its notifications): providing the service you requested (Article 6(1)(b)), and our legitimate interest in running it correctly and securely (Article 6(1)(f)).

The consent log: our obligation to be able to show your consent (Article 7(1)).

What a clinic already wrote in its own records stays with that clinic; for a clinic's records, ask that clinic.

6. Sharing with your family

Anyone who has the card's link sees the card and can add or remove clinics and change the home clinic. A home change happens at once and can be undone on the card for 7 days. If the link was shared by mistake, ask your clinic for a new card link: the old one stops working.

7. Where the data goes

Apple and Google (the Wallet card and its notifications), Telegram (if you linked it), Twilio and Meta/WhatsApp (only the messages of the clinic that reminds you), Supabase (database, in the EU), Netlify (hosting), Resend (e-mail to clinics; not to you).

Some of them also process data outside the EU (for example in the US). In that case we rely on the safeguards each provider offers, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

8. How long we keep the data

The card is kept while it is linked to a clinic or installed in a Wallet, and deleted 36 months after its last activity. The consent log is kept for 36 months. A clinic keeps its own records under its own rules.

When a clinic closes, its data leaves the card on the day it closes and is deleted from TailPlan 30 days later; your card continues with your other clinics.

9. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. For the card: contact TailPlan or use "Delete my card" on the "Manage reminders" page (each linked clinic then also gets an erasure request for its own records). For a clinic's records: contact that clinic.

10. Complaints

You can complain to the Commissioner for Personal Data Protection (Cyprus) or the Hellenic Data Protection Authority (Greece).