Privacy
Policy

1Who We Are and Our Roles

Kalaharicoding (Pty) Ltd ("VetLoop", "we", "our", "us") develops the VetLoop veterinary practice management software and operates the website at vetloop.co.za and the online services that support the software. This policy explains how personal information is handled under the Protection of Personal Information Act 4 of 2013 ("POPIA").

1.1 Two different roles

• The veterinary practice is the responsible party for the personal information of its clients (pet owners), its patients' records, its staff and everyone else whose information it enters into VetLoop. VetLoop software stores this information mainly on devices the practice owns and controls. For data stored locally on practice devices, VetLoop has no physical or remote custody, no access keys, and does not host or process that information; VetLoop is neither an operator nor a responsible party for strictly on-premises storage. If you are a pet owner, your primary contact for access, correction or deletion requests about your pet's or your own records is your veterinary practice.
• VetLoop is the responsible party for the personal information we collect for ourselves: our customers' account, licence, billing and support information, website visitors, and the accounts of pet owners who register on the VetLoop Customer Portal.
• VetLoop is an operator (processor) for the practice's information only where a practice chooses an online feature that stores or relays that information on our cloud infrastructure, namely Cloud Backup and appointment requests made through the Customer Portal. In that case we process it only on the practice's instructions under the data processing terms in our Terms of Service.

Our Information Officer is registered with the Information Regulator of South Africa in terms of POPIA.

2POPIA Compliance

We work to comply with the eight conditions for lawful processing under POPIA:

• Accountability — we take responsibility for the personal information we process as responsible party, and we meet our obligations as operator.
• Processing limitation — we collect only what is necessary for the purposes stated here.
• Purpose specification — information is collected for specific, explicitly defined purposes.
• Further processing limitation — we do not process information in ways incompatible with the original purpose.
• Information quality — we take reasonable steps to keep information accurate and complete.
• Openness — we explain our processing in this policy.
• Security safeguards — we apply appropriate technical and organisational measures.
• Data subject participation — you may ask to access and correct your information.

We also take into account the Electronic Communications and Transactions Act 25 of 2002 (ECTA), the Cybercrimes Act 19 of 2020, the Promotion of Access to Information Act 2 of 2000 (PAIA) and, for veterinary practices, the professional rules of the South African Veterinary Council (SAVC).

3Information We Collect

3.1 Information VetLoop holds about its customers and website visitors

• Practice name, address, telephone, email and SAVC / registration numbers;
• Names, email addresses and phone numbers of account holders and billing contacts;
• Licence details, activation-code records, plan and subscription status, and device identifiers and device names registered to a licence;
• Payment records (transaction references and status). Card details are handled by PayFast and are not stored by VetLoop;
• Support correspondence and information you send us;
• Website technical data and cookies (see section 14).

3.2 Customer Portal (pet-owner accounts and appointment requests)

• Portal account details: name, email address and password credentials;
• Appointment requests: contact details, pet name and species, reason for the visit and requested date and time, which are made available to the practice you selected.

3.3 Cloud Backup (only if the practice switches it on)

A backup is a copy of the practice's own records, which may include client contact details, patient and clinical records, laboratory results, prescriptions, financial and payroll records and attachments. It is stored in encrypted form in our Google Cloud project and is accessible to the practice. VetLoop does not use it for any purpose other than providing the backup and restore service, and accesses it only if needed for support at the practice's request or as required by law.

3.4 Information that normally stays on the practice's own devices

The practice enters and stores, on its own devices, information such as:

• Client (pet owner) names, contact details, addresses, identity numbers (if provided) and billing records;
• Patient (animal) details, clinical history, notes, diagnoses, treatments, prescriptions, vaccinations, laboratory results and imaging;
• Staff details, usernames, hashed passwords, time-clock and payroll information including salary, tax and bank details where the payroll module is used;
• Application usage logs and audit trails.

VetLoop does not receive this information unless the practice chooses to use an online feature described in this policy.

3.5 Optional research data (de-identified)

If the practice opts in, de-identified clinical information is contributed monthly as described in section 9.

4How & Why We Collect Information

Source

We collect information directly from you (for example when you register or purchase a licence), from the practice's use of the software's online features, and from our payment processor. We do not purchase or scrape personal information from unrelated third parties.

Voluntary vs mandatory (POPIA section 18)

• Mandatory: practice and contact details and registration numbers needed to activate and bill a licence. Without them the software cannot be activated or supported.
• Mandatory for the clinical features: client and patient records are required to use those features; they are collected and controlled by the practice.
• Voluntary: identity numbers, additional contact details, optional clinical fields, and every optional online feature (Cloud Backup, Customer Portal, integrations, AI features, research programme).

Failure to provide mandatory information will prevent activation or limit functionality. Failure to provide optional information will not affect core functionality.

5Purpose of Processing

6Lawful Justification for Processing

Under POPIA section 11 we process personal information where:

• Consent — you or the practice have consented (for example opting in to the Research Data Programme or Cloud Backup);
• Contract — processing is necessary to perform a contract with you (for example providing and billing your licence);
• Legal obligation — we must keep records or respond to lawful requests;
• Legitimate interest — for security, fraud prevention, service improvement and de-identification, where your interests are not unreasonably affected.

7Data Storage & Security

VetLoop is designed primarily as an on-premises application: practice data is stored on devices owned and controlled by the practice. Where the practice switches on an online feature, the relevant data is stored in Google Cloud as described in this policy.

• Encryption at rest: sensitive record stores (including client, patient, clinical, user and financial records) are encrypted with AES-256 using keys held in the device's secure storage. Practices should also use full-disk encryption on every device.
• Local network: devices at the practice synchronise over the practice's own network using access tokens. Practices must keep this network private and must not expose the software to the internet; remote access should use a VPN or secure tunnel.
• Cloud features: data is stored and transmitted using Google Cloud / Firebase infrastructure and its security controls, with access restricted by authentication and server-side rules.
• Access control: role-based access within the practice, with passwords stored as salted hashes.
• Audit logs: the software keeps an audit trail of significant actions.
• Breach response: we maintain an incident response procedure. If personal information we hold is compromised we will notify the affected practice without undue delay, and notify the Information Regulator and affected data subjects where we are the responsible party, as POPIA section 22 requires.

No method of storage or transmission is completely secure. The practice remains responsible for the security of its own devices, networks and backups.

8Sharing of Personal Information

VetLoop does not sell personal information. We disclose personal information only as follows:

• Google (Firebase / Google Cloud) — hosting, authentication, licence validation, Cloud Backup, Customer Portal and cloud functions;
• PayFast — subscription payment processing;
• Professional advisers, insurers and auditors — under confidentiality;
• Authorities — SARS, the SAVC, courts and law enforcement where the law requires or a valid order compels it.

The following connections are made by the practice, at its own initiative, using its own accounts, and are controlled by the practice as responsible party. VetLoop does not receive the data:

• SimplePay and Sage (payroll) and Xero, QuickBooks (Intuit) and Sage (accounting);
• Reference laboratories and analysers (for example IDEXX, Zoetis, Antech, Mindray, Seamaty);
• SMS and messaging providers (SMSPortal, BulkSMS, Clickatell) and WhatsApp click-to-chat;
• AI and transcription providers the practice configures with its own API key (for example Google Gemini, OpenAI, Anthropic): clinical text, patient signalment, images or audio selected by the user are sent directly to the provider.

We require the service providers that process personal information on our behalf to protect it and to use it only for the purpose we specify, as required by POPIA section 21.

9Research Data Programme (Optional, De-identified)

Practices may choose to contribute de-identified data to help veterinary research and product development. It is off by default, can be withdrawn at any time, and is described to the practice in the software before it is switched on.

What is contributed

Once a month, for each completed month, the practice's server sends de-identified records such as: diagnoses and diagnosis category; therapeutic diet and chronic-medication purchases; vaccination, prescription (drug, strength, duration), weight and laboratory values; procedure, anaesthesia, hospitalisation, referral and end-of-life categories; whether a pet is insured and the insurer; and monthly aggregate counts. Each record carries only species, breed group, sex, neutered status and an age band.

What is never contributed

Client or pet names, contact details, addresses, identity numbers, invoices, revenue, prices, costs, margins, bank or accounting data, staff names or performance, clinical-note text, free-text comments, images, files, the practice's name, and exact dates.

How data is de-identified

• Patient identifiers are replaced by pseudonyms made with a secret key that stays with the practice; neither VetLoop nor a recipient holds it;
• Dates become the month; ages and weights are banded; free-text and rare values are generalised or removed; small groups are suppressed;
• The server accepts only an allow-listed set of fields and rejects anything that looks like contact information;
• The practice is identified only by a random code. Datasets given to a recipient are re-keyed so they cannot be linked to other datasets, and are only released if several practices contribute.

Recipients

VetLoop may license aggregated datasets compiled from de-identified data to researchers, universities and companies in the veterinary and pet-care industries, under written agreements that prohibit re-identification and onward sale of row-level data and require appropriate security. Recipients may be located outside South Africa. Because the data is de-identified, it is not intended to constitute personal information; we nevertheless apply the safeguards above.

Withdrawal

A practice can switch the programme off at any time and ask us to delete what it previously contributed that has not yet been delivered. Data already delivered to a recipient under a lawful agreement cannot be recalled.

10Cross-Border Data Transfers

Under POPIA section 72, personal information may be transferred to a country outside South Africa only if the recipient is subject to adequate protection or another condition in that section is met. VetLoop discloses the following:

Clinical records that stay on the practice's own devices are not transmitted to VetLoop or to any foreign server unless the practice uses one of the features above.

11Data Retention

The practice decides how long it keeps its own records and must comply with the retention periods that apply to it (for example SAVC, SARS and labour law requirements). The software provides tools but does not delete a practice's records automatically on a legal timetable. For information VetLoop holds:

You may ask for earlier deletion where we have no legal reason to keep the information.

12Your Rights as a Data Subject

Under POPIA you may:

• Ask whether we hold your personal information and request a copy (access);
• Ask us to correct inaccurate or incomplete information;
• Ask us to delete information we are not entitled to keep;
• Object to processing based on legitimate interest, or withdraw consent you gave;
• Complain to the Information Regulator at inforegulator.org.za (inforeg@justice.gov.za).

If your information is in a veterinary practice's records, please contact that practice first; we will assist the practice where we hold relevant data as its operator. To exercise any right against VetLoop, contact our Information Officer at info@vetloop.co.za. We respond within 30 days.

13PAIA — Access to Information

Under the Promotion of Access to Information Act 2 of 2000 (PAIA) you may request access to records held by Kalaharicoding (Pty) Ltd that are required to exercise or protect your rights. Requests to private bodies must be made in writing on the prescribed Form C (available from gov.za or from our Information Officer). We respond within 30 days of a valid request; prescribed fees may apply. Our PAIA manual is available on request at info@vetloop.co.za.

14Cookies & Website Analytics

The VetLoop website uses essential cookies and local storage needed for it to work, such as keeping you signed in. We do not use advertising or cross-site tracking cookies. If we add analytics we will update this section and use anonymous, aggregated statistics. You can disable cookies in your browser, which will not affect the desktop software.

15Children's Privacy

VetLoop is a professional tool for veterinary practices and is not directed at children. We do not knowingly collect personal information directly from anyone under 18. Customer Portal accounts must be opened by adults.

16Marketing & Automated Decisions

We send service communications to account holders. We send marketing only where POPIA section 69 allows, and every marketing message will include a way to opt out. We do not make decisions about individuals based solely on automated processing of their personal information. AI features inside the software are controlled and reviewed by the veterinary professional using them.

17Changes to This Policy

We may update this policy to reflect changes in law, our services or our practices. Material changes will be communicated to registered users by e-mail or in-software notice at least 14 days before they take effect, and where a change affects the data a practice shares we will ask for the practice's consent again. The "Last updated" date shows the latest revision.

18Contact the Information Officer

For any questions, concerns or requests about this policy or our processing, contact:

You also have the right to complain to the Information Regulator of South Africa: inforegulator.org.za, inforeg@justice.gov.za.