Frequently asked questions

In the EU. All primary storage and processing takes place in EU (EEA) data centres, and backups are additionally replicated to a second EU region for regional-failure cover. The only sub-processor that may process data outside the EEA is Google Firebase Cloud Messaging for push notifications, covered by the EU–U.S. Data Privacy Framework with Standard Contractual Clauses as fallback. See Subprocessors.

Yes, in transit and at rest. All external traffic runs over encrypted connections (HTTPS/TLS), and plain HTTP is redirected to HTTPS. Data at rest (the database, file storage and secrets) is encrypted using our cloud provider's managed encryption.

Each clinic is a separate tenant, and that separation is enforced at two levels. In the application, a central mechanism constrains every query to the caller's clinic, on every execution path (web requests, background jobs, events), and fails closed if tenant context is missing. In addition (since September 2026), the database itself enforces the separation with row-level, default-deny rules, through a restricted database role that does not own the tables and is bound by these rules, so a mistake in application code does not by itself expose another clinic's data. A small, inventoried set of platform tasks explicitly switches to an elevated mode for a single database transaction; because the application makes that switch itself, this layer protects against mistakes in application code, not against a fully compromised application. A dedicated isolation audit (July 2026) found zero confirmed cross-tenant data leaks.

Yes, both. We take automated daily backups with point-in-time recovery, retained for 7 days and geo-redundant within the EU. Restores are not just assumed to work: we have run a documented restore rehearsal against production (schema and row-count checks both passed) and repeat it periodically. Specific recovery objectives are available on request.

Zoravet notifies clinics of a personal-data breach affecting their data without undue delay and at the latest within 48 hours of becoming aware. As controller, the clinic remains responsible for notifying the Autoriteit Persoonsgegevens and, where required, affected individuals; Zoravet supports with the information needed.

No. We do not claim certifications we do not hold: there is no ISO 27001 or SOC 2 certification, and no independent penetration test has been performed. What we do describe in the Security Statement and the DPA is built, tested and active, except where we explicitly mark something as planned.

A small, documented list: AWS (EU infrastructure), Amazon Bedrock from AWS (EU-only AI inference: the medical-history summary, which is off until a clinic switches it on, and breed-name de-duplication during a data migration) and Google Firebase Cloud Messaging (push notifications). See the Subprocessors page for the full list, including Mollie for payments, which is planned but not yet active. Clinics get at least 30 days advance notice before a new or replaced sub-processor, with a right to object.

In two ways. The AI summary of a pet's medical history is off until your clinic switches it on; the summary is a tool for clinic staff and never makes decisions on its own. Separately, when Zoravet migrates your clinic's records from its previous system, AI suggests which differently spelled breed names mean the same breed. There is no clinic setting for this: it is part of every migration, only the breed names and their species are sent (no owner, pet or dossier details), and the person running the migration confirms or changes the suggestions. Processing happens in the EU only; the AI service does not retain the data, does not use it for model training and does not share it with the model provider.

Ask your clinic. It is the controller for your client and pet dossier and provides you with a copy. In the app you can download your own profile data yourself (name, contact and address details, language preference, loyalty points and account status); your pet's records, appointments, messages and invoices are not in that download and come from your clinic. Deletion requests are routed to your clinic, which can carry out the erasure directly in the platform. Owner erasure and anonymisation are built and live, while records that must be kept by law (e.g. invoices) are retained.

No longer than necessary. Medical dossiers are kept as lifelong patient history under the clinic's control and erased on the owner's request. Invoices/financial records: at least 7 years (Dutch fiscal retention obligation). Veterinary-medicine dispensing records: at least 5 years (EU Regulation 2019/6). Deleting these two after their legal terms is planned but not yet automated. Notification log: 2 years. Audit records: 7 years. Technical logs: 30 days; web-traffic logs: 90 days. An automated retention process enforces the other periods in production. See the Data Retention document for the full overview.

Security reports: security@zoravet.nl. Compliance, privacy or data-processing questions (e.g. for a vendor assessment): support@zoravet.nl.