What this document is
When a practice uses Clarivet, it stores data about its clients in it: who they are, how to contact them, what animals they have and what has been done to them. That data belongs to the practice, which decides what it is processed for and for how long. We only store it and make it available to the practice.
The General Data Protection Regulation (GDPR) calls the practice the controller and us the processor, and requires that relationship to be in writing (Art. 28(3)). This document is that contract.
Who each party is
- The practice (the controller): the organisation that subscribes to Clarivet, with the details it registers with.
- ProfBlu (the processor): Germán Ezequiel Laso Andino, libero professionista, trading as ProfBlu. Partita IVA 04702090988, Codice fiscale LSNGMN88S04Z600M. Via della Sega 1, 38080 Verdesina, Porte di Rendena (TN), Italy. Contact: privacidad@profblu.com.
When it is accepted
This agreement is part of the terms of use. The practice accepts it when it subscribes to Clarivet, and it applies for as long as the practice uses it. The version in force is the one with the revision date shown at the top.
Subject matter, nature and duration
- Subject matter: hosting, storing, organising, displaying and emailing the data the practice enters in Clarivet, so it can do its work.
- Nature: automated processing on servers, through the panel, the practice's website and the emails the practice decides to send.
- Duration: for as long as the practice uses Clarivet, and afterwards just long enough to return and delete the data as described in «What happens when this ends».
What data, and about whom
About the practice's clients:
- identification and contact: name, ID document, phone, email and address;
- the notes the practice writes about them;
- the appointments they request or are given, and the reminders they receive;
- if the practice links them to their record on the website, their account identifier.
About their animals (who are not people, but whose record carries data about the person responsible for them): species, breed, sex, date of birth, identification, photo, consultations, treatments, vaccinations, test results and attached photos.
About farm work: farms (name, the location the practice writes and holding number), groups and visits.
Clarivet is not designed to store special categories of personal data (health, beliefs, etc.). The clinical history is the animals'. If the practice writes something like that in a note, it does so under its own responsibility.
We only do what the practice tells us
We process the data only to provide Clarivet and following the practice's instructions, which are these terms and what it does in the panel. We do not use it for anything of our own: no advertising, no profiling, no model training. If an instruction seems unlawful to us, we will say so.
Confidentiality
Only the people who operate the service access the data, when needed to make it work or to help the practice, and all of them are bound by confidentiality.
Security measures
- Encrypted communications (TLS).
- Each practice sees only its own data: asking with one practice's session for another's data does not return it. Within the practice, each team member sees and does what their role allows.
- On the website, a client sees only the animals in their record.
- Centralised sign-in: nobody types a password into Clarivet; people sign in through ProfBlu's sign-in.
- Daily backups of the database and files, kept for 35 days at most.
Sub-processors
The practice authorises us to use these sub-processors, with whom we have contracts carrying the same obligations as this one:
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Server, database, files and backups | Germany (EEA) |
| IONOS | Delivery of outgoing email | Spain (EEA) |
| Anthropic | The panel's assistant, only if someone on the team uses it | United States, with standard contractual clauses |
If we add or change one, we announce it on this page beforehand, with a new revision date, and the practice can object by leaving Clarivet.
Help with data subjects' rights
If a client asks us something about their data, we pass it on to the practice without delay and do not answer on its behalf. The practice can correct and delete records from the panel; for what it cannot do on its own (a full copy, for example), we help if it writes to privacidad@profblu.com.
If there is a security breach
If we detect a breach affecting the practice's data, we will tell it without undue delay, with what we know: what happened, what data, how many people are affected and what we have done. That way it can notify the supervisory authority within the 72 hours the law sets.
Information and audits
We give the practice the information it needs to show that this agreement is being complied with, and we accommodate a reasonable audit, with prior notice and at its expense.
What happens when this ends
- The practice leaves Clarivet.
- If it asks within the following month, we give it a copy of its data in a commonly used format.
- Then we delete the data from the database. Backups disappear on their own, at the latest, 35 days later.
- We keep only what a law requires us to keep, and only for as long as it requires.
What is up to the practice
- Having a legal basis to process its clients' data and informing them, in its own privacy policy, that it uses Clarivet as a processor.
- Entering only the data it needs.
- Giving each team member the role that fits them and removing from the team whoever leaves.
Liability
Each party is liable for its own part under Article 82 GDPR.
Changes to this agreement
If we change it, we publish it here with a new revision date and give notice in advance.
Applicable law
Italian law and the GDPR apply.