Privacy policy

Effective from: 2026-07-01
Document drafted pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Privacy Code), as amended by Legislative Decree 101/2018.
It replaces the previous privacy notice effective from 12/05/2022.

1. Data Controller

The Veterly service (mobile app, web app and website) is operated by:

Bake One S.r.l. (hereinafter “Veterly”, “we”, the “Controller”)

• Registered office: via Carlo Farini n. 5, 20154 Milan (Italy)
• Tax code / VAT no. / registration with the Register of Companies of Milan Monza Brianza Lodi: 11745420965
• Certified email (PEC): bakeone@legalmail.it
• Email: info@veterly.com

The Controller acts as an independent data controller for the processing of data relating to registration and use of the Platform.

As of the date of publication, no DPO has been appointed, as the conditions making it mandatory (Art. 37 GDPR) do not apply; this information will be updated should an appointment be made. For any request relating to the processing of your data, you can write to info@veterly.com.

2. Who this notice is addressed to

This notice describes how we process the personal data of registered users of Veterly, in particular:

• pet owners who register to manage their animals, book appointments and communicate with veterinary practices;
• veterinarians and practice staff who use the platform in a professional context.

The economic and professional terms applied to veterinary practices are governed by a separate agreement; from a privacy standpoint, in relation to the data of end clients the veterinary practice may act as an independent controller or joint controller for care purposes, while Veterly remains the controller for the technical management of the platform (see §9).

3. Categories of data we process

3.1 Data provided during registration and account management

• First and last name, email address, password. Registration and authentication are managed through our identity provider Clerk: the password is held by Clerk and is never stored in our databases.
• Alternatively, data received via Google sign-in (and any other social/SSO providers): identifier, email, name and any profile picture shared by the provider.
• Phone number, preferred language and (if provided) address.
• Consents given (marketing, third-party communications) and the related confirmation date.
• Access events (date/time, authentication provider) for security and audit purposes.

3.2 Data relating to your animals

• Animal profile: name, species, breed, sex, date of birth, coat, origin, photo.
• Clinical diary and health notes: observations, symptoms, treatments, documents and attachments that you or the veterinary practice enter in the animal’s timeline.

Health data relating to animals does not constitute “special categories of personal data” within the meaning of Art. 9 GDPR (which concerns natural persons). We nonetheless process it with appropriate security measures.

3.3 Communications and services

• Chat messages with veterinary practices and related attachments (photos, documents), over in-app channels and — when enabled — SMS, WhatsApp and Telegram.
• Requests, bookings and appointments (reason for the request, priority, status, notes).
• Video consultations: session metadata and room links (video handled through the provider Daily).

3.4 Phone calls and voice assistant (Smart Reception)

When you call a practice that uses our smart reception features, we may process:

• calling number and called number, date/time, duration;
• call recording, transcription, summary and classification/triage generated automatically;
• any consent to recording and processing.

These operations may take place through telephony providers (Aircall, Vonage) and artificial intelligence providers (ElevenLabs for transcription/voice, Anthropic Claude for classification and summarisation). See §5 and §6.

3.5 Payment data

• Amount, status and type of payments linked to services.
• Payment card data is processed directly by Stripe; Veterly does not store card numbers.

3.6 Billing data (professional users)

For veterinary practices and, where necessary for the issuance of tax documents, we process billing data: company name, VAT number, tax code, billing email, certified email (PEC), recipient code (SDI) and address.

3.7 Technical, device and usage data

• Push notification tokens and device platform (iOS / Android / web), to send you reminders and alerts.
• Technical connection data and logs necessary for operation and security.

4. Purposes of processing and legal bases

Consents 5 and 6 are optional: failure to provide them does not prevent registration or use of the service. You can change them at any time from the “Privacy and consents” section of the app.

Marketing (purpose 5). With your consent, we may contact you via email, push notifications, SMS/phone with news, tips and offers relating to Veterly. You can object at any time by withdrawing consent from the app, writing to info@veterly.com or clicking the unsubscribe link included in every promotional email.

Communication to third-party partners (purpose 6). With your consent, certain contact data (name, email, phone, address) may be communicated to the Controller’s partners who act as independent controllers for their own marketing purposes. The categories of partners are, by way of example: food, breeding, insurance, pharmaceutical companies, pharmacies, plant engineering, accessories, veterinarians, animal husbandry, transport, trade, software development. After the communication, to stop receiving further contacts you will need to contact the individual partner directly.

5. Use of artificial intelligence — transparency

Some features rely on AI providers:

• Anthropic (Claude) — classification, summarisation and conversational assistance;
• ElevenLabs — voice transcription (speech-to-text) and the voice of the phone assistant.

These providers process the data as data processors, on the basis of our instructions and their respective commercial/enterprise terms, which provide that data transmitted via API is not used to train their models. The AI assistant does not provide diagnoses or treatments and does not replace the opinion of a veterinarian. Automatically generated information (transcriptions, summaries, triage) may contain inaccuracies and is intended to support, not replace, professional judgement.

6. Recipients and data processors

To provide the service we rely on selected providers acting as data processors (Art. 28 GDPR) or as independent controllers where applicable. Below are the main categories and providers:

An up-to-date list of data processors is available on request at info@veterly.com.

Data may also be communicated to: the Controller’s advisors and professionals (accountants, lawyers), competent authorities where required by law, and parties involved in any extraordinary corporate transactions, always in compliance with the GDPR.

7. Transfers of data outside the EU

Some of the providers listed above are based or have infrastructure outside the European Economic Area (in particular in the United States: e.g. Clerk, Anthropic, ElevenLabs, Stripe, HubSpot, Daily, Google, AWS). Where this occurs, the transfer is safeguarded by appropriate guarantees pursuant to Arts. 44 et seq. GDPR, such as the Standard Contractual Clauses (SCC) approved by the European Commission and/or the provider’s adherence to the EU-US Data Privacy Framework, in addition to supplementary measures where necessary. You may request a copy of the guarantees adopted.

8. Retention period

We retain data for as long as necessary for the purposes for which it is collected:

• Account and animal data: for the duration of the relationship; when the account is closed, data is deleted or anonymised, except for what must be retained for legal obligations or for the animal’s clinical history held by the veterinary practice.
• Service, chat and clinical diary data: for the duration of the relationship with the practice and within applicable document retention periods.
• Payment and billing data: 10 years for accounting/tax obligations.
• Call recordings and transcriptions: for as long as necessary to handle the request and in any case according to the providers’ policies and legal limits; recordings that are not needed are deleted.
• Data processed for marketing and communication to partners (purposes 5 and 6): until consent is withdrawn and in any case no longer than 24 months from collection.
• Security logs and access events: for as long as necessary for security and audit purposes.

9. Role of veterinary practices

When you interact with a veterinary practice through Veterly, the practice processes your data and your animal’s data for its own care purposes, acting as an independent controller (or joint controller) for those aspects. Veterly provides the technological tool and acts as controller for the management of the platform and as processor on behalf of the practice where applicable. For the processing carried out by the practice, we invite you to also consult its own privacy notice.

10. Rights of the data subject

At any time you can exercise the rights provided for by Arts. 15–22 GDPR:

• access to your data;
• rectification of inaccurate data;
• erasure (“right to be forgotten”), within the limits of legal obligations;
• restriction of processing;
• portability of data;
• objection to processing based on legitimate interest;
• withdrawal of consent at any time (without affecting the lawfulness of prior processing), directly from the “Privacy and consents” section or by writing to info@veterly.com.

You can exercise your rights by contacting the Controller:

• by email at info@veterly.com;
• by certified email (PEC) at bakeone@legalmail.it;
• by registered mail with return receipt to Bake One S.r.l., via Carlo Farini n. 5, 20154 Milan.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia n. 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of the EU State of your residence, place of work or of the alleged infringement.

11. Minors

The service is not directed at persons under 18 years of age. We do not knowingly collect data of minors without the consent of those with parental responsibility. If you believe a minor has provided us with data, please contact us for its removal.

12. Cookies and similar technologies

The website and the web app use technical cookies necessary for operation (e.g. authentication session) and, subject to consent, analytics/statistical cookies via Google Tag Manager (which may load Google Analytics). Details, including how to give or withdraw consent, are set out in the dedicated Cookie Policy. The mobile app does not use cookies but equivalent technologies (e.g. secure local storage, notification identifiers).

13. Security

We adopt appropriate technical and organisational measures to protect data (encryption in transit, access controls, credential management entrusted to a dedicated identity provider, minimisation). No system is, however, 100% secure: in the event of a data breach we act in accordance with Arts. 33–34 GDPR.

14. Changes to this notice

We may update this notice; the current version is always available in the app and on the website, with the relevant date. In the event of material changes we will give you adequate notice.

Last updated: 2026-07-01.