Privacy Policy

1Responsible Party

Kalaharicoding (Pty) Ltd ("VetLoop", "we", "our", "us") is the responsible party as defined in the Protection of Personal Information Act 4 of 2013 (POPIA) in respect of all personal information processed through the VetLoop software application and website located at vetloop.co.za.

The Information Officer of Kalaharicoding (Pty) Ltd has been registered with the Information Regulator of South Africa in terms of POPIA Section 55 and the POPIA Regulations.

2POPIA Compliance

VetLoop is built from the ground up to comply with the Protection of Personal Information Act 4 of 2013 (POPIA). We adhere to the eight conditions for lawful processing:

• Accountability — We take full responsibility for the personal information we process.
• Processing Limitation — We collect only what is necessary for the purposes stated herein.
• Purpose Specification — Information is collected for specific, explicitly defined purposes.
• Further Processing Limitation — We do not process data in ways incompatible with the original purpose.
• Information Quality — We take reasonable steps to keep personal information accurate and complete.
• Openness — We maintain transparency about our processing activities through this policy.
• Security Safeguards — We implement appropriate technical and organisational measures to protect data.
• Data Subject Participation — You have the right to access and correct your personal information.

3Information We Collect

3.1 Practice & Staff Information

• Practice name, physical address, telephone number and email address
• SAVC registration numbers of veterinary practitioners
• Staff names, roles, usernames and hashed passwords
• Login activity and session information

3.2 Client (Pet Owner) Information

• Full name, contact number, email address and physical address
• National identity number (if provided for invoicing purposes)
• Billing and payment records

3.3 Patient (Animal) Information

• Animal name, species, breed, date of birth, sex and microchip number
• Clinical history, SOAP notes, diagnoses and treatment records
• Laboratory results, imaging studies (DICOM/PACS) and vaccination records
• Prescriptions and medication history

3.4 Technical Information

• Device identifiers for multi-device sync purposes
• Application usage logs and audit trails (for POPIA Section 19 compliance)
• IP addresses and network information (local network only — never sent to external servers without consent)

3.5 Payroll & Financial Information

Where a practice uses the integrated payroll module or accounting integrations, the Software may process:

• Employee salary, wage and remuneration details;
• Bank account details for payslip and payment purposes;
• SARS tax numbers, IT3(a) data and IRP5/UI-19 information;
• Invoice amounts, VAT records and financial statements synchronised to Xero or QuickBooks.

4How & Why We Collect Information

Source of Information

Personal information is collected directly from the data subject (practice staff, pet owners) or from the veterinary practice acting on behalf of its clients. We do not purchase, scrape or receive personal information from unrelated third parties.

Voluntary vs Mandatory Provision

In terms of POPIA Section 18(1)(f), we are required to advise you whether provision of personal information is voluntary or mandatory:

• Mandatory information — Practice name, contact details and SAVC registration numbers are required to activate and use the Software. Without this information, the Software cannot function as intended.
• Client/patient information — Entry of client and patient records is required to use the clinical management features of the Software. This information is collected and controlled by the veterinary practice.
• Voluntary information — National identity numbers, additional contact details and optional clinical fields are voluntary. The Software will function without them.
• Payroll and accounting information — Required only if you choose to use those integrations. These modules are entirely opt-in.

Consequences of Not Providing Information

Failure to provide mandatory information will prevent activation or limit the functionality of the Software. Failure to provide optional information will not affect core Software functionality.

5Purpose of Processing

We process personal information for the following explicitly defined purposes:

6Lawful Basis for Processing

VetLoop processes personal information on the following lawful bases:

• Consent — Where pet owners consent to their information being stored in the practice management system.
• Contract — Processing necessary to provide veterinary services under a professional relationship.
• Legal obligation — Compliance with SAVC record-keeping requirements, SARS obligations and other legislation.
• Legitimate interest — Internal analytics and system security, where not overridden by data subject rights.

7Data Storage & Security

VetLoop stores all practice data locally on devices owned and controlled by the veterinary practice. We implement the following technical safeguards:

• At Rest: AES-256 encryption for all personal information using HiveAesCipher. Encryption keys are stored in the device's platform keychain (iOS/macOS) or Android Keystore.
• In Transit: HTTPS with TLS 1.2 or higher for all client-server communication within the practice local network.
• Access Control: Role-based access (Admin, Vet, Receptionist, Viewer) with session management and automatic timeout.
• Audit Logs: All access to personal information is logged with timestamp, user ID and action type. Logs include automatic PII redaction.
• Breach Response: We maintain documented incident response procedures. In the event of a breach, affected parties and the Information Regulator will be notified within the timeframes required by POPIA.

8Sharing of Personal Information

VetLoop does not sell, rent or trade personal information to any third party. Information may be disclosed to:

• SimplePay (payroll processing) — employee payroll data only, subject to their own privacy policy, used only when the practice has configured the SimplePay integration.
• Xero / QuickBooks (accounting) — invoicing and financial data only, subject to their respective privacy policies, used only when the practice has configured the accounting integration. VetLoop transmits only the data necessary for invoice synchronisation and does not share clinical or patient data with these providers.
• PayFast (subscription payment processing) — licence subscription payment data only, processed in accordance with PayFast's PCI-DSS compliant platform. VetLoop does not store your full payment card details.
• SARS — as required by law for tax submissions.
• SAVC — as required by law for regulatory compliance.
• Courts and law enforcement — where required by a court order, subpoena or other legally binding process.

All third-party service providers used by VetLoop are required to adhere to data protection standards consistent with POPIA. Kalaharicoding (Pty) Ltd has concluded or is in the process of concluding written operator/processor agreements with all third parties that process personal information on our behalf, as required by POPIA Section 21. These agreements oblige operators to process personal information only on our documented instructions, to maintain appropriate security measures, and not to engage sub-processors without authorisation.

★Cross-Border Data Transfers

In terms of POPIA Section 72, personal information may only be transferred to a foreign country if that country provides an adequate level of protection, or specific conditions are met. VetLoop discloses the following cross-border processing:

Where cross-border transfers occur (Firebase, Xero, QuickBooks), they are limited to the minimum data required for the specific function and are governed by binding contractual obligations that require equivalent data protection standards.

9Data Retention

Personal information is retained for the following periods:

When data reaches the end of its retention period, it is cryptographically wiped using secure deletion procedures. You may request earlier deletion where this does not conflict with our legal obligations.

10Your Rights as a Data Subject

Under POPIA, you have the following rights in respect of your personal information:

• Right of access — You may request a copy of the personal information we hold about you.
• Right to correction — You may request that inaccurate or incomplete information be corrected.
• Right to deletion — You may request deletion of your personal information where no legal retention obligation applies.
• Right to object — You may object to processing of your information based on legitimate interest.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time.
• Right to complain — You have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

To exercise any of these rights, contact our Information Officer at info@vetloop.co.za. We will respond within 30 days as required by POPIA.

11PAIA — Access to Information

In terms of the Promotion of Access to Information Act 2 of 2000 (PAIA), you have the right to request access to records held by Kalaharicoding (Pty) Ltd that are required for the exercise or protection of your rights.

Requests by private individuals must be submitted in writing using the prescribed Form C (available from the South African Government website at gov.za or on request from our Information Officer). We will respond within 30 days of receipt of a valid request. Reasonable fees may apply as prescribed by the PAIA Regulations.

PAIA Manual

Kalaharicoding (Pty) Ltd is a small company. In terms of Section 52(2) of PAIA and the relevant Regulations, companies below the prescribed threshold may apply for exemption from the requirement to compile and publish an annual PAIA manual. Our PAIA Manual is nonetheless available on request by emailing info@vetloop.co.za. The manual describes the categories of records held, the subjects on which records are available, and the procedure for submitting a formal access request.

12Cookies & Website Analytics

The VetLoop website (vetloop.co.za) may use cookies to improve your browsing experience. We do not use tracking cookies for advertising purposes.

• Essential cookies — Required for the website to function. Cannot be disabled.
• Analytics cookies — Anonymous, aggregated usage statistics to help us improve the website. No personal information is stored.

You may disable cookies in your browser settings. This will not affect your use of the VetLoop software application.

13Children's Privacy

VetLoop is a professional software tool intended for use by veterinary practices. We do not knowingly collect personal information from persons under the age of 18 directly. Any personal information relating to minor pet owners is processed only with the consent of a parent or guardian.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. Material changes will be communicated to registered users by email or in-app notification. The "Last updated" date at the top of this document reflects the most recent revision. Continued use of VetLoop after changes constitutes acceptance of the updated policy.

15Contact the Information Officer

For any questions, concerns or requests relating to this Privacy Policy or our data processing activities, please contact:

You also have the right to lodge a complaint directly with the Information Regulator of South Africa:
Website: inforegulator.org.za
Email: inforeg@justice.gov.za