Privacy Notice

Last updated: [DATE]. This notice explains how NudgeCore handles personal data on this website and in the Service.

1. Two roles we play

Context	Role	What we handle
You visit this website / contact us	Controller	Your name, email, organisation, message content, basic technical logs
A veterinary practice uses the Service	Processor for the practice	Client name and contact details, pet name/species/breed/sex, dates of care, appointment and recheck dates — only as instructed by the practice

2. Why we process it

For practice data: to build recall and follow-up lists, draft messages for the practice's approval, send them on the practice's behalf, and report results. For website data: to answer enquiries, provide the Service and keep basic security records. We do not profile individuals for advertising and we do not sell personal data.

3. What we refuse

We do not accept payment-card data, government identifiers, or records unrelated to the Service. Our upload page rejects files containing fields such as SSN, card, IBAN or passport numbers.

4. Retention

Uploaded client files: processed for the Service, then deleted within 30 days of your request, of termination, or immediately after report generation where you selected that option.
Receipts and access logs: retained without client-level personal data for accounting and security.
Website enquiry data: retained up to [24] months.

5. Sharing

We share data only with sub-processors needed to run the Service (hosting, email/SMS delivery, payment processing), each under written terms, and with authorities where legally required. A current sub-processor list is available on request and is attached to the DPA.

6. Security

Encryption in transit (TLS), least-privilege access limited to named personnel, unique credentials, and logging of access to client files. We notify the practice of any personal-data breach within 72 hours of becoming aware, with the facts then known and our remediation steps. No system is perfectly secure.

7. International transfers

Data may be processed in [REGION(S)]. Where required, transfers rely on appropriate safeguards such as standard contractual clauses. Practices outside [REGION] can request the transfer addendum.

8. Your rights

Where we are a controller, you may request access, correction, deletion or object to processing by writing to [email protected]. Where we are a processor, requests from pet owners should be directed to the practice; we assist the practice in responding within [10] business days at no extra charge for standard requests.

9. Cookies and analytics

This site uses only essential cookies by default. [If analytics are enabled, name the provider and the lawful basis here.]

Companion-animal records are not “protected health information” under HIPAA. Client personal data, however, remains subject to applicable privacy law; we process it only under a signed data-processing agreement, keep it minimal, and do not resell it.