Veta-i

GDPR overview

GDPR compliance is claimed explicitly and in some detail. The privacy policy and terms, both last updated on 12 December 2025, cite Regulation (EU) 2016/679 and the Spanish LOPDGDD, and map each purpose to a legal basis: contract performance, legal obligation, and legitimate interest for service and AI improvement. Roles are stated: the clinic is controller, Veta-i is processor, and a data processing agreement applies. The full set of rights is listed, exercised through a named email address, with requests about clinic-held data forwarded to the clinic. Transfers to Uruguay rely on the European Commission adequacy decision 2012/484/EU; other third-country transfers rely on adequacy, standard contractual clauses or extra safeguards. No Article 27 representative or DPO is named, which is consistent with an EU-established vendor. Governing law is Spanish, with courts in Madrid.

Who owns the data?

The clinic keeps ownership of everything it enters. The terms of service state plainly that clinic data belongs to the customer and that Veta-i claims no rights over it, granting the vendor only a licence to process that data in order to run the service. Under the GDPR the roles are split: the clinic is the controller for animal owners and patients, while Veta-i acts as processor and applies a data processing agreement. Veta-i is controller only for its own platform users, meaning veterinarians, clinic staff and commercial contacts. The vendor states it does not sell personal data, and any sharing with hosting, database, AI, payment or analytics providers is covered by Article 28 contracts.

Reuse rights

Clinic data is used first to deliver the service itself: managing users, running the Veta-i Core diagnostic engine, sending reminders and reports, and providing support. Beyond that, the vendor reserves the right to use anonymised and aggregated data to train and improve its AI models, to produce statistics and for research and development. It commits never to commercialise identifiable data without express consent. Customers keep full ownership of their own records and can export or reuse them freely, including one-click PDF reports shared with animal owners by link or messaging. What customers cannot do is reverse-engineer or bulk-extract the AI model, which the terms prohibit outright. Note that no documented opt-out lets a clinic exclude its anonymised data from model training.

Data retention & training

Hosting summary

The vendor states that data is held on servers located in the European Union and that the service complies with the GDPR and the Spanish LOPDGDD. No specific hosting country and no hosting provider is named, so the commitment is at region level only. One international transfer is disclosed explicitly: data may move from the European Union to Uruguay, which the European Commission recognises as offering an adequate level of protection under decision 2012/484/EU, so no additional safeguards are required. For any provider outside the European Economic Area, the vendor says it would rely on adequacy decisions, standard contractual clauses or additional security measures. Stated security controls include encryption in transit and at rest, access control, logging and audits, encrypted backups, environment isolation and continuous monitoring. Recipients are described by category — hosting, databases, AI processing, payments and analytics — with only the payment provider named as an example, and all are said to be bound by Article 28 contracts. Note that the public IP of the domain resolves to a content delivery network, which says nothing about where data actually resides.