Privacy Policy
Effective March 12, 2026
Effective Date: March 12, 2026
Last Updated: March 12, 2026
1. Overview & Scope
This Privacy Policy ("Policy") describes how AnyVet Co., Ltd., a company incorporated under the laws of Thailand with its registered office at 7th Fl., 748 Sukhumvit Rd, Khlong Tan, Khlong Toei, Bangkok 10110, and its affiliate 애니벳에이아이 (AnyVet AI) in South Korea (collectively, "AnyVet," "we," "us," or "our") collect, use, share, and protect your personal information.
This Policy applies to all users of the following services (collectively, the "Services"):
- AnyVet Smart — a cloud-based Hospital Operating System for veterinary clinics, including electronic medical records (EMR), billing, AI Scribe, diagnostic tools, TeleVet, and Line OA integration.
- AnyVet App — a mobile application for pet owners providing AI triage, telemedicine, appointment booking, a pet shop, and health management.
- AnyVet Microchip — a cloud-based pet identification system compliant with ISO 11784/11785, featuring SMS alerts, a lost pet network, and emergency reporting.
1.1 Data Controllers
Depending on which Service you use and your location, the data controller responsible for your personal information is:
| Entity | Jurisdiction | Role |
|---|---|---|
| AnyVet Co., Ltd. | Thailand | Primary data controller for all Services |
| 애니벳에이아이 (AnyVet AI) | South Korea | Data controller for users in South Korea; joint controller for cross-border processing |
Both entities share a single Data Protection Officer (DPO): Myengseung Jeong — [email protected].
By using any of the Services, you acknowledge that you have read and understood this Policy. Where applicable law requires your consent for the processing of personal information, your continued use of the Services constitutes that consent unless you withdraw it as described in Section 9.
2. Information We Collect
We collect personal information in the following categories. The specific data points collected depend on which Services you use and how you interact with them.
2.1 Account Information
When you create an account or subscribe to a plan, we collect:
- Full name
- Email address
- Phone number
- Postal address (where applicable)
- Account credentials (passwords are stored in hashed form only)
- Profile photo (optional)
- Professional license number (for veterinary professionals using AnyVet Smart)
2.2 Pet & Animal Information
To provide veterinary and pet management services, we collect:
- Pet name, species, breed, and color
- Date of birth or estimated age
- Sex and neutering/spaying status
- Weight and body condition
- Microchip ID (ISO 11784/11785 compliant)
- Photos of your pet
- Vaccination history and allergy information
2.3 Veterinary Medical Data
When veterinary clinics use AnyVet Smart, or when you receive care through AnyVet App's telemedicine features, we process:
- Clinical notes and consultation records
- Diagnoses and treatment plans
- Prescriptions and medication records
- Laboratory results (blood work, urinalysis, etc.)
- Diagnostic imaging (X-rays, ultrasound images)
- Surgical records
- AI Scribe transcriptions of veterinary consultations
- AI triage conversation logs
Note: Veterinary medical data pertains to animals, not humans. However, because this data is linked to identifiable pet owners, we treat it with the same care as sensitive personal information.
2.4 Payment & Billing Information
When you make purchases or subscribe to paid plans, we collect:
- Billing name and address
- Payment method details (processed securely by our payment sub-processors; we do not store full credit card numbers)
- Transaction history, invoices, and receipts
- Tax identification numbers (where required by law)
2.5 Microchip Registration Data
When you register a pet with AnyVet Microchip, we collect:
- Microchip ID number
- Owner name, phone number, and email
- Up to three emergency contact numbers
- Pet description and identifying information
- Registration date and implanting clinic
- Lost/found status and associated reports
2.6 Automatically Collected Data
When you access the Services, we automatically collect:
- IP address
- Device type, operating system, and browser version
- Unique device identifiers
- Usage logs (pages visited, features used, timestamps, session duration)
- Approximate location derived from IP address
- Precise location (only with your explicit permission, for features like nearby clinic search)
- Crash reports and performance data
2.7 Cookies & Tracking Technologies
We use cookies and similar technologies for the following purposes:
| Category | Purpose | Can You Opt Out? |
|---|---|---|
| Essential | Authentication, security, and core functionality | No (required for the Services to function) |
| Functional | Language preferences, UI settings | Yes |
| Analytics | Usage patterns, feature adoption, performance monitoring (via Google Analytics) | Yes |
You can manage cookie preferences through your browser settings or through the cookie consent banner displayed when you first visit anyvet.ai. Disabling non-essential cookies will not affect the core functionality of the Services.
3. How We Use Your Information
We process your personal information only for specific, legitimate purposes. The table below maps each purpose to its legal basis under applicable law.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide and maintain the Services — account creation, EMR management, appointment booking, telemedicine, microchip registration | Account info, pet info, medical data, microchip data | Performance of contract |
| Process payments — subscription billing, in-app purchases, clinic billing | Payment & billing info | Performance of contract |
| AI-powered features — AI Scribe transcription, AI triage, diagnostic assistance | Medical data, consultation audio/text | Consent; performance of contract |
| Lost pet network — matching found pets with registered owners, sending SMS alerts | Microchip data, owner contact info | Legitimate interest; consent |
| Communication — service notifications, appointment reminders, support responses | Account info | Performance of contract; legitimate interest |
| Analytics and improvement — understanding usage patterns, improving features, fixing bugs | Automatically collected data, usage logs | Legitimate interest |
| Security and fraud prevention — detecting unauthorized access, preventing abuse | Account info, device info, IP address | Legitimate interest; legal obligation |
| Legal compliance — responding to lawful requests, tax record retention | As required by the specific obligation | Legal obligation |
We will not use your personal information for purposes materially different from those described above without providing you with notice and, where required, obtaining your consent.
4. How We Share Your Information
We do not sell your personal information. We share information only in the circumstances described below.
4.1 Sub-processors
We rely on trusted third-party service providers to operate the Services. Each sub-processor is contractually bound to process your data only as instructed by us and to maintain appropriate security measures.
| Sub-processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, data storage, and computing | All data processed through the Services | Singapore (ap-southeast-1); additional regions as needed |
| Omise | Payment processing (Thailand) | Payment & billing info | Thailand |
| Stripe | Payment processing (international) | Payment & billing info | United States |
| TossPayments | Payment processing (South Korea) | Payment & billing info | South Korea |
| Google Analytics | Website and app usage analytics | Anonymized usage data, device info, IP address (anonymized) | United States |
4.2 Hospital ↔ Pet Owner Sharing
To deliver integrated veterinary care, we facilitate the sharing of information between clinics using AnyVet Smart and pet owners using AnyVet App:
- Clinics can access: Pet owner contact details, pet profiles, medical history (only for animals under their care), and appointment records.
- Pet owners can access: Their pet's medical records created by any clinic using AnyVet Smart, prescription details, invoices, and vaccination certificates.
- Microchip lookup: When a found pet's microchip is scanned, only the owner's designated contact information is shared with the finder — no medical or financial data is disclosed.
4.3 Legal Requirements
We may disclose your personal information if required to do so by law, or if we believe in good faith that such disclosure is necessary to:
- Comply with a legal obligation, court order, or government request
- Protect the safety of any person or animal
- Investigate suspected fraud or violations of our Terms of Service
- Protect our legal rights or defend against legal claims
4.4 Business Transfers
If AnyVet is involved in a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. In such an event, we will notify you before your information becomes subject to a different privacy policy and provide you with the opportunity to opt out where required by law.
5. AI Data Processing
Several of our Services incorporate artificial intelligence to assist veterinary professionals and pet owners. This section explains how AI features process your data.
5.1 AI Scribe (AnyVet Smart)
AI Scribe transcribes and summarizes veterinary consultations in real time. When a veterinary professional activates AI Scribe during a consultation:
- Audio from the consultation is processed to generate a text transcription.
- The transcription is analyzed to produce structured clinical notes (SOAP format, diagnosis codes, etc.).
- Audio recordings are not stored after transcription is complete. Only the resulting text notes are retained as part of the medical record.
5.2 AI Triage (AnyVet App)
AI Triage helps pet owners assess the urgency of their pet's symptoms before scheduling a veterinary visit:
- You provide symptom descriptions via text or voice input.
- The AI analyzes the information and suggests an urgency level (e.g., emergency, urgent, routine).
- Triage conversation logs are retained for 1 year to enable continuity of care and quality improvement.
5.3 AI Diagnostic Assistance (AnyVet Smart)
Our diagnostic AI tools assist veterinary professionals in interpreting lab results and diagnostic images. The AI provides suggestions and highlights, but the final diagnosis is always made by the attending veterinarian.
5.4 Training & Model Improvement
We take AI training transparency seriously:
- Your data is not used to train general-purpose AI models. We do not share your medical records, consultation transcripts, or personal information with third-party AI providers for model training.
- We may use de-identified, aggregated data to improve our own AI models' accuracy and safety. De-identified means all personal identifiers (names, contact details, microchip IDs) are removed before any analysis.
- If we wish to use identifiable data for AI improvement in the future, we will obtain separate, explicit consent before doing so.
5.5 Medical Disclaimer
AI features are decision-support tools and do not replace professional veterinary judgment. AI Scribe, AI Triage, and AI Diagnostic Assistance are designed to assist — not substitute for — licensed veterinary professionals. No AI output from our Services should be treated as a definitive diagnosis, prescription, or treatment recommendation. Pet owners should always consult a qualified veterinarian for medical decisions regarding their animals.
6. International Data Transfers
AnyVet operates across Thailand and South Korea, and uses infrastructure that may process data in additional countries. Your personal information may be transferred to and processed in countries other than the one in which you reside.
6.1 Transfer Routes
- Thailand ↔ South Korea: Data is shared between AnyVet Co., Ltd. and 애니벳에이아이 (AnyVet AI) as joint controllers for purposes including account management, technical support, and product development.
- Thailand / South Korea → Singapore: Our primary cloud infrastructure (AWS ap-southeast-1) is located in Singapore.
- Thailand / South Korea → United States: Limited data is processed by Stripe (payment) and Google Analytics (anonymized analytics).
6.2 Safeguards
When transferring personal information internationally, we apply the following safeguards:
- Data processing agreements with all sub-processors that include obligations equivalent to those under PDPA and PIPA.
- Encryption in transit and at rest using industry-standard protocols (TLS 1.2+ for transit; AES-256 for storage).
- Access controls ensuring that only authorized personnel in each jurisdiction can access the data necessary for their role.
- Adequacy assessments of recipient countries' data protection standards before initiating transfers.
7. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy, or as required by law. The table below outlines our standard retention periods.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account information | Duration of account + 3 years after account deletion | Legal claims limitation period; regulatory requirements |
| Pet & animal profiles | Duration of account + 3 years after account deletion | Continuity of veterinary care; linked to medical records |
| Veterinary medical records (EMR) | 5 years from the date of the last clinical entry | Veterinary medical record retention standards; continuity of care |
| Payment & billing records | 5 years from the date of the transaction | Tax and accounting obligations (Thai Revenue Code; Korean tax law) |
| Microchip registration data | Lifetime of the animal + 1 year (or until owner requests deletion) | Permanent identification purpose; animal welfare |
| AI Scribe transcriptions | Same as veterinary medical records (5 years) | Part of the clinical record |
| AI Triage conversation logs | 1 year from the date of the conversation | Quality improvement and continuity of care |
| Usage logs & analytics | 2 years from collection | Product improvement and troubleshooting |
| Cookies | Session cookies: until browser is closed. Persistent cookies: up to 12 months | Functional and analytics purposes |
| Support correspondence | 3 years from resolution of the inquiry | Service quality; dispute resolution |
When the retention period expires, we will securely delete or anonymize the data. Where anonymization is used, the resulting dataset cannot be re-linked to any individual.
8. Data Security
We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
8.1 Technical Measures
- Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database backups are also encrypted.
- Access controls: Role-based access control (RBAC) limits data access to authorized personnel. Multi-factor authentication (MFA) is enforced for all administrative accounts.
- Network security: Firewalls, intrusion detection systems, and DDoS protection safeguard our infrastructure.
- Vulnerability management: Regular security assessments, penetration testing, and automated vulnerability scanning.
- Audit logging: All access to medical records and sensitive data is logged for accountability and incident investigation.
8.2 Organizational Measures
- Employee training: All team members receive data protection training upon onboarding and annually thereafter.
- Confidentiality agreements: All employees and contractors with access to personal data sign confidentiality agreements.
- Incident response: We maintain a documented incident response plan. In the event of a data breach, we will notify affected users and relevant authorities within the timeframes required by applicable law (72 hours under PDPA; without delay under PIPA).
8.3 Special Protections for Medical Data
Veterinary medical records receive additional protections, including:
- Separate logical storage from non-medical account data
- Stricter access controls — only the treating veterinary team and the pet owner can access medical records
- Comprehensive audit trails for every access and modification
- No exposure of medical data in analytics or tracking systems
9. Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal information:
| Right | Description |
|---|---|
| Access | Request a copy of the personal information we hold about you, including the purposes for which it is processed. |
| Rectification | Request correction of inaccurate or incomplete personal information. |
| Deletion | Request deletion of your personal information, subject to legal retention obligations. |
| Portability | Receive your personal information in a structured, commonly used, machine-readable format (JSON or CSV) and transmit it to another controller. |
| Restriction of Processing | Request that we limit the processing of your information in certain circumstances (e.g., while we verify the accuracy of disputed data). |
| Objection | Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds. |
| Consent Withdrawal | Where processing is based on consent, withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal. |
9.1 How to Exercise Your Rights
You can exercise your rights by:
- In-app: Navigate to Settings → Privacy → Data Rights in AnyVet App or AnyVet Smart.
- Email: Send a request to our DPO at [email protected] with the subject line "Data Rights Request."
We will verify your identity before processing any request. We will respond to your request within 30 days. If the request is complex or we receive a high volume of requests, we may extend this period by an additional 30 days, and we will inform you of the extension.
If we deny your request (e.g., due to a legal retention requirement), we will explain the reason in writing and inform you of your right to file a complaint with the relevant data protection authority.
10. Children's Privacy
Our Services are not directed at children. The age thresholds below apply based on your jurisdiction:
| Jurisdiction | Minimum Age for Independent Use | Younger Users |
|---|---|---|
| Thailand | 20 years (age of majority under Thai Civil and Commercial Code) | Parental or legal guardian consent required |
| South Korea | 14 years (PIPA threshold for minors) | Consent of a legal representative required for users under 14 |
| All other jurisdictions | 18 years (or the local age of majority, whichever is higher) | Parental or legal guardian consent required |
If we learn that we have collected personal information from a child without the required parental or guardian consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information without appropriate consent, please contact us at [email protected].
11. Region-Specific Provisions
In addition to the rights and practices described above, the following provisions apply to users in specific jurisdictions.
11.1 Thailand — Personal Data Protection Act (PDPA)
If you are located in Thailand, the following provisions apply under the Personal Data Protection Act B.E. 2562 (2019):
Data Controller:
- AnyVet Co., Ltd., 7th Fl., 748 Sukhumvit Rd, Khlong Tan, Khlong Toei, Bangkok 10110
- DPO: Myengseung Jeong — [email protected]
Consent and Withdrawal:
- Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time by contacting our DPO or using the in-app privacy settings.
- Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- If withdrawing consent significantly affects our ability to provide the Services to you, we will inform you of the consequences before processing the withdrawal.
Right to Lodge a Complaint:
You have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) if you believe that the processing of your personal data violates the PDPA. More information is available at www.pdpc.or.th.
11.2 South Korea — Personal Information Protection Act (PIPA)
If you are located in South Korea, the following additional provisions apply under the Personal Information Protection Act (개인정보 보호법):
Data Controller (개인정보처리자):
- 애니벳에이아이 (AnyVet AI), South Korea
- 개인정보 보호책임자 (DPO): Myengseung Jeong (정명승) — [email protected]
Collection and Use Disclosures:
Pursuant to Article 15 of PIPA, we collect and use personal information for the purposes described in Section 3 of this Policy. The specific items collected are listed in Section 2. By using the Services, you consent to this collection and use.
Provision to Third Parties:
Pursuant to Article 17 of PIPA, we provide personal information to the third parties listed in Section 4 of this Policy. Personal information is shared only for the purposes stated and is not used beyond those purposes.
Sub-processor (수탁자) Disclosures:
| Sub-processor (수탁자) | Tasks Entrusted (위탁 업무) |
|---|---|
| Amazon Web Services, Inc. | Cloud hosting, data storage, and computing |
| Omise Co., Ltd. | Payment processing (Thailand) |
| Stripe, Inc. | Payment processing (international) |
| 비바리퍼블리카 (TossPayments) | Payment processing (South Korea) |
| Google LLC | Website and app usage analytics |
Destruction of Personal Information:
When the retention period expires or the purpose of processing is achieved, we destroy personal information without delay using the following methods:
- Electronic files: Permanently deleted using secure deletion methods that make recovery impossible (e.g., cryptographic erasure, secure overwrite).
- Paper documents: Shredded or incinerated.
- If retention is required by other laws despite the original purpose being fulfilled, the data is moved to a separate database or storage location and deleted when the legal retention period expires.
Rights of Data Subjects:
In addition to the rights described in Section 9, South Korean users may exercise rights through a legal representative (대리인). To designate a representative, submit a power of attorney form to our DPO.
Right to Lodge a Complaint:
You may lodge complaints with the following Korean authorities:
- Personal Information Protection Commission (개인정보보호위원회): www.pipc.go.kr
- Korea Internet & Security Agency (KISA): privacy.kisa.or.kr / 118
12. Changes to This Policy & Contact
12.1 Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do:
- We will update the "Last Updated" date at the top of this Policy.
- For non-material changes (e.g., formatting, clarifications), the updated Policy will become effective upon posting.
- For material changes (e.g., new categories of data collection, new sharing purposes, changes to your rights), we will:
- Notify you at least 30 days in advance via email and/or in-app notification.
- Where required by applicable law (including PDPA and PIPA), obtain your separate consent before the changes take effect.
- Provide a clear summary of what has changed.
If you do not agree with the updated Policy after being notified of a material change, you may delete your account before the changes take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.
12.2 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:
| Thailand Entity | Korea Entity | |
|---|---|---|
| Entity Name | AnyVet Co., Ltd. | 애니벳에이아이 (AnyVet AI) |
| DPO | Myengseung Jeong | Myengseung Jeong (정명승) |
| [email protected] | ||
| Address | 7th Fl., 748 Sukhumvit Rd, Khlong Tan, Khlong Toei, Bangkok 10110, Thailand | South Korea (contact via email for postal address) |
| Website | anyvet.ai | |