Privacy Policy
Scope
This Privacy Policy explains how FriendlyCrm collects and uses personal data when you use our website, create an account, or use the FriendlyCrm clinic application on behalf of a veterinary organization.
Who controls your data
FriendlyCrm is business software for veterinary clinics. In most cases, your clinic is the data controller for information about pet owners and patients that staff enter into FriendlyCrm. FriendlyCrm acts as a data processor when we host and operate the service for your clinic, processing that information on the clinic’s instructions. For our own website administration, account relationships, billing, support and service security, the FriendlyCrm operator determines the purposes of processing and acts as a controller.
Information we process
Information we process may include: clinic staff account details (such as name, email, and role); pet owner contact details and clinical records entered by the clinic; messages you send through support or feedback; billing and subscription information; and technical data needed to secure and run the service (such as sign-in activity and error logs).
Purposes of processing
This information is used to operate and improve FriendlyCrm, authenticate users, process subscriptions, respond to support requests, protect against abuse, and meet legal obligations. The clinic is responsible for choosing a lawful basis (for example consent or legitimate interest) for pet owner data it collects and for informing pet owners as required by law.
Sharing and service providers
Personal data is not sold. Providers help with hosting, file storage and email delivery. Our Subprocessors page identifies website providers and planned clinic subprocessors, with their deployment status. Paddle handles purchases as merchant of record and processes buyer data under its own privacy notice; it is not simply a processor of clinic records.
Data locations and transfers
EU regions are planned for the clinic application, database and file storage. This is not a guarantee that all processing takes place exclusively in the EU: website delivery, supplier support and other operations may involve other countries. Actual processing locations and any required international-transfer safeguards must be confirmed before the clinic service launches.
Clinic privacy controls
Clinic administrators can export organization or individual client data, request deletion or anonymization of client records where the product allows it (subject to legal and clinical retention rules), and manage email recall consent per client. Files attached to records may be removed from storage after deletion on a short delay.
Retention
Data is generally kept for as long as your clinic uses the service and as needed for backups, security, and legal requirements. Clinics remain responsible for veterinary and financial record retention under applicable law. Routine technical cleanup (for example expired sign-in tokens, abandoned registrations, and redaction of old payment notification payloads) may run according to configured retention periods.
Your rights
Depending on where you live, you may have rights over your personal data — such as to access it, correct it, delete it, receive a copy, or object to or restrict certain processing — and the right to complain to your local data protection authority. These rights are exercised as provided by the laws that apply to you. For data your clinic entered, your request may need to be passed to the clinic, which acts as the controller.
Contact
If you are a pet owner and want to access, correct, or delete your data, please contact your veterinary clinic first. The clinic holds your clinical relationship and can act on your request. Clinic staff with privacy questions about FriendlyCrm can reach us through the in-app feedback option or at contact@friendly.vet.
Security and breaches
Access controls and encryption in transit help protect personal data. When acting as a processor, we must notify the affected clinic without undue delay after becoming aware of a personal data breach. The controller is responsible for notifying authorities and affected individuals when required by applicable law; we assist the clinic with those duties.
Policy updates
Revised notices will appear here with an updated revision date. A privacy notice explains processing; continued use of the service does not constitute consent to new processing. Where consent is required, it must be obtained separately and can be withdrawn without affecting processing that was lawful before withdrawal.