Privacy Policy

This Privacy Policy explains how AlagangVet handles personal data when providing its clinic-management platform (the "Service"). It should be read together with the Terms and Conditions and any agreement with the subscribing veterinary clinic or organization (the "Clinic").

1. Privacy roles

For client, pet-owner, patient, medical, appointment, billing, inventory, staff, and other information entered by or for a Clinic ("Clinic Data"), the Clinic determines why and how the information is processed. The Clinic generally acts as the personal information controller, and AlagangVet processes that information for the Clinic as a personal information processor and service provider.

AlagangVet may act as a personal information controller for limited information needed to administer its own service relationship, such as subscriber contact details, account-security records, support communications, subscription information, and legally required records.

2. Information handled

• Account data: names, email addresses, roles, branch assignments, authentication identifiers, and account status.
• Clinic Data: clinic and staff details; client or pet-owner contact details; patient identity and clinical records; appointments; prescriptions; preventive care; forms; uploaded files; confinement checks; billing; inventory; and purchase activity.
• Technical and security data: timestamps, IP and device information when available, session and authentication events, audit records, error information, and security logs.
• Support and subscription data: messages sent to support, troubleshooting information voluntarily provided, plan details, and payment-status records. Full payment-card details should not be stored in the Service unless a specifically supported payment provider is used.

3. How information is used

Information is processed only as reasonably necessary to:

• store and display Clinic Data and provide the workflows requested by the Clinic;
• authenticate Users, apply permissions, maintain audit trails, and protect the Service;
• back up, maintain, troubleshoot, and restore the Service;
• respond to authorized support requests and communicate service or security notices;
• administer subscriptions and enforce applicable agreements; and
• comply with legal obligations, lawful orders, and the establishment or defense of legal claims.

We do not sell personal data. We do not use Clinic Data for advertising, data brokerage, unrelated profiling, or training general-purpose artificial-intelligence models. We do not routinely read or manually review Clinic Data. Authorized access may occur only when reasonably necessary for requested support, security investigation, service recovery, compliance with law, or another purpose permitted by the Clinic's instructions and applicable law.

4. Legal basis and Clinic obligations

The Clinic is responsible for identifying and documenting a lawful basis for collecting and processing personal data through the Service, giving required privacy notices, obtaining consent when consent is the appropriate basis, honoring data-subject rights, and limiting access to authorized personnel. AlagangVet processes Clinic Data under the Clinic's instructions, the service agreement, legitimate security and service interests, and applicable legal obligations.

5. Ownership and control

Privacy rights are not transferred by using the Service. The Clinic retains its rights in Clinic Data, and individuals retain their rights in their personal data. AlagangVet owns the software, interfaces, database structure, documentation, and system-generated operational and security metadata, but does not claim ownership of the Clinic's client records, patient records, medical content, uploaded documents, or personal data.

6. Disclosure and service providers

Information may be processed by vetted providers that supply cloud hosting, database, authentication, deployment, communications, backup, monitoring, and security services. They may process data only to provide contracted services and are expected to protect it appropriately. Information may also be disclosed when required by law, to protect rights or security, during a lawful business transfer subject to confidentiality, or at the Clinic's direction. We do not disclose Clinic Data to other clinics.

7. International processing

Cloud providers may store or process information in the Philippines or other countries. Where information is transferred across borders, we use reasonable contractual, organizational, and technical measures intended to preserve protection consistent with applicable privacy requirements. The Clinic should ensure that its own notices and legal basis cover necessary cross-border processing.

8. Retention and deletion

Active Clinic Data is generally retained for the duration of the Clinic's subscription and according to the Clinic's instructions and settings. After termination, data may remain for a limited export, recovery, backup, security, dispute, or legal-retention period before deletion or anonymization. Backup copies may persist until safely overwritten in the ordinary backup cycle. Technical, audit, subscription, and security records may be retained longer when reasonably necessary for integrity, fraud prevention, legal compliance, or claims.

The Clinic is responsible for its professional and statutory record-retention duties and should export records before closing its account. A deletion request may be limited where retention is required by law, needed to protect patient care or record integrity, or necessary for legal claims.

9. Security

We use reasonable role-based access, tenant separation, authentication, encryption provided by our infrastructure, audit, backup, and software-security measures. Access is limited according to operational need. Nevertheless, no system can guarantee absolute security. Clinics must secure their devices, credentials, networks, staff access, exports, and printed records and must notify us promptly of suspected compromise.

10. Security incidents

We investigate suspected incidents affecting the Service and take reasonable containment and recovery steps. When an incident involving Clinic Data requires notification, we will provide the Clinic with reasonably available information so the Clinic and AlagangVet can meet their respective legal obligations. The Clinic remains responsible for notifications it must make as personal information controller unless law provides otherwise.

11. Cookies and sessions

The Service uses essential cookies or similar local storage for authentication, security, session continuity, and user preferences. These technologies are not used by AlagangVet for third-party behavioral advertising.

12. Data-subject rights

Subject to applicable law, individuals may have rights to be informed, access personal data, object to or restrict processing, correct inaccurate data, request deletion or blocking, obtain portability where applicable, withdraw consent when processing relies on consent, and lodge a complaint with the National Privacy Commission.

Requests concerning Clinic Data should first be sent to the Clinic that collected the information because the Clinic controls those records and must verify the requester's identity and any retention requirements. We will reasonably assist the Clinic with valid requests. Requests concerning an AlagangVet account or our own service-administration records may be sent to the address below.

13. Children and account users

Staff accounts are not intended for children. If a Clinic collects information about a minor pet owner or other minor, the Clinic is responsible for the appropriate legal basis, notices, and safeguards.

14. Changes and contact

We may update this Policy when the Service, providers, or legal requirements change. Material changes will be identified by a revised effective date and, where appropriate, additional notice. Privacy questions, security reports, or requests concerning data controlled by AlagangVet may be sent to support@alagangvet.com. Clinic clients should contact their Clinic first for requests about clinic-held records.