Data Processing Agreement (Verwerkersovereenkomst)

This DPA is the standard template signed with every clinic; the clinic’s own controller details are completed at contract signing. It sits under the main service agreement (Terms of Service / subscription contract) between Zoravet and the clinic; on data-protection matters this DPA prevails.

Parties

• Processor (verwerker): Jensen Software, trading as Zoravet, KvK 96526181, Oanjelaan 32, 1421 AK Uithoorn, Netherlands (“Zoravet”).
• Controller (verwerkingsverantwoordelijke): the veterinary clinic, legal entity name, address, KvK number and contact person are completed at contract signing (the “Clinic”).

Together the “Parties”. This DPA governs only the personal data that Zoravet processes on the Clinic’s instructions to provide the platform. It does not cover data for which Zoravet is itself controller (platform login accounts, security/operational data), which is governed by Zoravet’s own privacy policies.

1. Subject matter, nature, purpose and duration

• Subject matter: processing of personal data through the Zoravet platform (pet-owner app + clinic portal + backend) to deliver hosted veterinary practice-management software to the Clinic.
• Nature and purpose: storing and displaying client/pet/dossier data, managing appointments and messaging, invoicing and bookkeeping, sending transactional notifications, migrating the Clinic’s existing records from its previous practice-management system on the Clinic’s instruction (including AI-assisted breed-name de-duplication during that migration), providing optional AI features the Clinic enables, backups, security, and support, limited to what is necessary to provide the service.
• Duration: for the term of the main service agreement. Obligations that by their nature survive (confidentiality, deletion/return, and liability) continue after termination.
• Instructions: Zoravet processes personal data only on the Clinic’s documented instructions. The main service agreement, this DPA, and the Clinic’s configuration of the platform together constitute those documented instructions. Zoravet informs the Clinic if, in its opinion, an instruction infringes the AVG/GDPR or other applicable data-protection law.
• Zoravet does not use the Clinic’s personal data for its own purposes.

2. Categories of data subjects and personal data

Matching the platform’s actual data inventory (see the app and portal privacy policies):

• Data subjects:

  • the Clinic’s clients (pet owners);
  • the Clinic’s staff users of the portal;
  • the Clinic’s employees, in so far as the Clinic uses the platform’s HR features.

• Categories of personal data:

  • Owner identity and contact data (name, postal address, email, phone, language preference, and date of birth where the Clinic records it);
  • Remarks and warnings the Clinic records about an owner or pet (free-text client notes), and the owner’s account standing with the Clinic (for example whether an account has been marked as overdue, and a loyalty-points balance where the Clinic uses one);
  • Pet details, including a pet photo the owner adds in the app and the pet’s insurer name and policy number where recorded;
  • Pets and their animal medical dossiers (consultation notes, diagnoses, treatments, vaccinations, prescriptions, weight, lab results — data about the animal);
  • The veterinary-medicine dispensing register: for each medicine dispensed or administered, the product, batch, quantity, the animal, the keeper’s name and address, and the prescriber;
  • Appointments (requests, schedule, reason, status);
  • Messages exchanged between owner and clinic, and a log of the Clinic’s other communication with the owner (including earlier emails, letters and phone-call notes imported from the Clinic’s previous practice-management system);
  • Orders an owner places in the app for repeat medication or standard food (product, pet, the owner’s note, order status);
  • Documents the Clinic shares with an owner in the app (for example invoices, lab results, aftercare letters and medication leaflets);
  • Invoices, payments and financial/bookkeeping records;
  • Bank transaction data: counterparty names, IBANs, and payment references of third parties (the Clinic’s suppliers and payers), imported from bank statements for bookkeeping and reconciliation;
  • Push-notification tokens and notification preferences/opt-ins;
  • Consent and acceptance records: which version of the terms and privacy policy a user accepted and when, and a log of when an owner’s notification consents were granted or withdrawn and by whom;
  • Staff work-account data, roles/permissions, and audit records of the changes they make (creating, editing or deleting records);
  • Where the Clinic uses the HR features: employment details (start/end date, contract type, hours, date of birth), leave, working-time and rota records, staff documents the Clinic uploads (for example contracts or identity-document copies kept for wage-tax purposes), and sickness-absence records (dates and an optional note; the features are not designed to hold diagnoses or medical certificates).

• Special-category (Art. 9) data: animal health data is not Art. 9 special-category data (which protects data about a human’s health and other sensitive categories about people). Sickness-absence records in the HR features are health data about the Clinic’s employees (Art. 9). The sickness-absence feature records the fact and dates of absence and an optional free-text note. It is not designed to hold diagnoses or medical certificates, and the Clinic must not record them in the note or in uploaded staff documents. Colleagues who can view the rota see only that an employee is absent today (name only, without the reason or start date), as needed for scheduling; staff who manage the rota or hold HR-management permission see that the absence is due to sickness, its start date, and past absences marked as sickness in the absence calendar. The note and the full sickness history are visible only to the employee and staff with HR-management permission. The Clinic, as employer, determines the lawful basis (UAVG art. 30) and which staff hold these permissions. No other human special-category data is intended to be processed. Human health data about owners is not expected to appear anywhere in the platform’s data fields; the Clinic must not enter such data (e.g. an owner’s own health information) into free-text fields, and if it were ever entered it would be incidental, not a designed data category.

• Payment-card data is not stored by the platform (confirmed 19 Jul 2026: no in-app card payments; pay-by-link is deferred). Should a payment provider be introduced, this section and the sub-processor list (Annex B) will be updated before activation.

3. Processor obligations

3.1 Instructions only

Zoravet processes personal data only as set out in section 1, on the Clinic’s documented instructions, and not for any other purpose.

3.2 Confidentiality

Personnel authorised to process the Clinic’s personal data are bound by an obligation of confidentiality (contractual or statutory) that survives the end of their engagement.

3.3 Security measures (technical and organisational)

Zoravet implements appropriate technical and organisational measures to protect the personal data, taking into account the state of the art, costs, and the nature/scope/context and risk of the processing (AVG/GDPR Art. 32). The measures are described in Zoravet’s Security Statement and summarised in Annex A to this DPA; they include at least:

• Encryption in transit (TLS) and at rest (database, file storage and secrets encryption in the production environment);
• EU-only data residency: primary processing and storage in the EU, with backups additionally replicated to a second EU region;
• Access control and tenant isolation: centralised, role-based, least-privilege access control, with strict per-clinic tenant isolation enforced in two layers, in the application and in the database itself (row-level, default-deny, via a restricted database role), failing closed. A dedicated cross-tenant isolation audit (July 2026) found zero confirmed cross-tenant data leaks;
• Authentication: a dedicated identity & access-management system supporting strong credentials (MFA/TOTP is supported but not enforced by policy for staff or operators today);
• Audit logging of changes to records (who created, edited or deleted what, and when) and of security events around sign-in on shared devices (for example PIN unlocks and lockouts); viewing a record is not logged individually;
• Backups and recovery: automated backups with point-in-time recovery, geo-redundant within the EU (7-day retention); recovery procedures are tested periodically;
• Continuous, automated monitoring and alerting;
• A web application firewall protects the platform’s public-facing services;
• Vulnerability and patch management, and a documented incident-response process.

The full, versioned measures are maintained in Annex A.

3.4 Sub-processors

• The Clinic gives Zoravet general written authorisation to engage the sub-processors listed in Annex B (see the Subprocessors page for the current, full list):

Sub-processor	Purpose	Location / transfer
Amazon Web Services EMEA SARL (AWS)	Cloud infrastructure: compute, database, object storage, transactional email, secrets	EU regions (Germany primary, Ireland backup); data stays in the EU/EEA
Amazon Web Services EMEA SARL (AWS): Amazon Bedrock	AI inference for two uses. (1) The AI medical-history summary for clinic staff: off until the Clinic switches it on; when a staff member requests a summary, the pet’s medical history for the chosen period is sent to produce it. (2) Breed-name de-duplication when Zoravet migrates the Clinic’s records from its previous practice-management system: the differently spelled breed names found in the imported records are sent with their species, so the service can suggest which spellings mean the same breed. This second use has no Clinic setting: it runs as part of every migration Zoravet carries out, it sends no owner, pet or dossier details, and its suggestions are confirmed or changed by the person running the migration before they are applied	EU only (inference restricted to EU regions); data stays in the EU/EEA, is not used for model training, is not retained by the AI service, and is not shared with the model provider. Covered by the existing AWS DPA + SCCs
Google LLC (Firebase Cloud Messaging)	Mobile push-notification delivery (app only)	US; covered by the EU–U.S. Data Privacy Framework, with EU Standard Contractual Clauses as fallback
Mollie B.V.	Payment processing (pay-by-link for clinic invoices), planned, not yet active; hosted-checkout only, no card/PAN data touches Zoravet’s servers	Netherlands. Will be added to this Annex B, with 30 days’ advance notice under section 3.4, before activation

• Zoravet’s own billing: Mollie is already used, separately from the clinic-invoice use above, to collect Zoravet’s own subscription fees from the Clinic by SEPA direct debit. That is processing of Zoravet’s own billing data (the Clinic’s legal entity name, billing contact, IBAN/mandate reference and invoice amounts) as controller, not sub-processing of the Clinic’s client or patient data, and is already active.
• Our login/identity service is self-hosted by Zoravet in the EU and is not a sub-processor. GitHub is used for source control/CI only (no Clinic personal data flows through it) and is likewise not a sub-processor.
• Zoravet imposes on each sub-processor, by contract, data-protection obligations equivalent to those in this DPA (back-to-back). Zoravet remains fully liable to the Clinic for a sub-processor’s performance of those obligations.
• Change notice: Zoravet informs the Clinic in advance of any intended addition or replacement of a sub-processor, giving the Clinic a reasonable period of 30 days to object on reasonable data-protection grounds. If the Parties cannot resolve a well-founded objection, the Clinic may terminate the affected service as its remedy.

3.5 International transfers

• Primary storage and processing is in the EU (AWS, Germany), with backups additionally replicated to a second EU region (Ireland).
• Push-notification delivery via Google may involve transfer outside the EEA; the transfer is covered by Google LLC’s EU–U.S. Data Privacy Framework certification, with EU Standard Contractual Clauses as fallback under Google’s Data Processing Terms.
• Zoravet does not otherwise transfer the Clinic’s personal data outside the EEA without an appropriate Art. 44–49 transfer mechanism.

3.6 Assisting the Clinic

Taking into account the nature of processing and the information available to it, Zoravet assists the Clinic with:

• Data-subject rights requests (access, rectification, erasure, restriction, portability, objection). In the app, a pet owner can download their own profile data as a structured file: name, email address, phone number, postal address, language preference, loyalty-points balance and account status (including whether a deletion request is pending). This self-service export does not contain the owner’s pets, appointments, messages, invoices, documents or the animal’s clinical dossier; those are the Clinic’s controller records, and the Clinic provides them for a full access or portability request, with Zoravet assisting. An automated per-owner erasure/anonymisation function is implemented and live in production (since 9 August 2026): an owner’s erasure request is executed under the Clinic’s instruction/authorisation as controller, with the platform carrying out the erasure/anonymisation automatically rather than as a manual staff action.
• Security of processing (Art. 32);
• Personal-data-breach notification (section 3.7);
• Data protection impact assessments (DPIAs) and prior consultation where applicable.

Zoravet forwards any data-subject request it receives directly to the Clinic without undue delay and does not respond to it itself except on the Clinic’s instruction.

3.7 Personal data breach notification

• Zoravet notifies the Clinic without undue delay and at the latest within 48 hours of becoming aware of a personal-data breach affecting the Clinic’s data. This is identical to the figure stated in the Security Statement.
• The notice includes the information available: nature of the breach, categories and approximate numbers of data subjects and records affected, likely consequences, and the measures taken or proposed.
• The Clinic, as controller, is responsible for notifying the Autoriteit Persoonsgegevens and, where required, the affected data subjects. Zoravet supports the Clinic but does not notify the AP on the Clinic’s behalf.

4. Deletion and return on termination

• On termination of the service, at the Clinic’s choice, Zoravet returns the Clinic’s personal data in a usable export format and/or deletes it within 30–90 days of termination, unless EU or Dutch law requires continued retention.
• Statutory-retention carve-out: records the law requires to be kept are retained even after termination: fiscal records (invoices, invoice PDFs, payments and other financial records) for at least 7 years under the Dutch fiscal retention obligation, and the veterinary-medicine dispensing register for at least 5 years under EU Regulation 2019/6. After an owner’s erasure these records are kept in minimised form. Deleting them once those periods have passed is planned but not yet automated; until it is, they are kept beyond the legal minimum. The automated retention process (live in production since 9 August 2026) enforces the 7-year minimum as a floor, so it never deletes fiscal records early, and it already deletes or anonymises other data on schedule: 7 years after an owner’s erasure it anonymises the name and address left on the client record, and it deletes raw bank-statement files after 7 years. Copies of the name and address are held only in the retained invoice PDFs and the dispensing register; they stay until those records themselves are deleted, which is planned. Other legally mandated retention is likewise honoured, and the reason recorded.
• Backups containing the Clinic’s data are purged on the normal backup-rotation cycle (maximum 7-day retention window).
• Zoravet confirms deletion in writing on the Clinic’s request.

5. Audit rights

• The Clinic may audit Zoravet’s compliance with this DPA on reasonable prior notice, no more than once per year, and additionally after a personal-data breach affecting the Clinic or on a supervisory-authority request.
• Zoravet may satisfy audits primarily by providing documentation: the Security Statement, the Annex A measures, and any third-party certifications or reports it holds (none exist today; no third-party security certification is on a committed roadmap, see the Security Statement, section 2). On-site or technical audits are reserved for where documentation is insufficient, are limited to the Clinic’s data and Zoravet’s own environment, must not compromise other clinics’ confidentiality or security, and are at the Clinic’s cost save where the audit reveals material non-compliance.

6. Liability

• Liability under this DPA follows the limitations and allocations in the main service agreement, subject to the mandatory provisions of AVG/GDPR Art. 82. The precise liability position and any cap are those of the main service agreement; this DPA does not itself introduce a different position.
• In case of conflict on data-protection matters, this DPA prevails over the main service agreement.

7. Governing law and jurisdiction

• This DPA is governed by the law of the Netherlands.
• Disputes are subject to the jurisdiction agreed in the main service agreement; absent such agreement, to the competent Dutch court.

Annexes

• Annex A: Technical and organisational measures (full). The Security Statement constitutes Annex A in full.
• Annex B: Sub-processor list (maintained and versioned). Current list reproduced in section 3.4 and on the Subprocessors page.
• Annex C: Details of processing. Data subjects, personal-data categories, and purposes, captured in sections 1–2 above.

Signatures

This DPA is signed as part of the clinic onboarding process, alongside the main service agreement. For a copy of the signature page or to start onboarding, contact support@zoravet.nl.