Privacy Policy

Effective April 18, 2026 · Last updated October 19, 2026

PAWTAL is the veterinary practice operating system operated by VetAILs ("PAWTAL", "we", "us", or "our"). This policy explains what we collect, why, who we share it with, and the choices a hospital and its people have. It covers the PAWTAL application, www.pawtal.com, the user manual, and the SMS and email programs described below.

We are not a veterinary hospital. Nothing in the product, including anything produced by AiVA, is a diagnosis or a treatment order. We do not sell personal information, and we do not use it for advertising.

1. Who this covers

This policy applies to information we process when:

  • a hospital uses PAWTAL, whether beside its existing practice-management system or as its system of record;
  • a person the hospital authorizes signs in, including staff and administrators;
  • a client or referring practice receives a message, completes a form, or otherwise interacts with a hospital workflow we host;
  • someone visits our public website or requests a demo.

The hospital decides who may use its workspace and what that person may see. Questions about a specific chart, schedule, or personnel record should go to the hospital first. Questions about this policy can go to support@pawtal.com.

2. Information we collect

2.1 Account and identity

When a hospital creates an account for someone, we collect the name, email address, role, and authentication credentials the hospital provides. Passwords are stored by our authentication provider in hashed form. We do not keep a plaintext password.

2.2 The hospital's operating record

Hospitals use PAWTAL for scheduling, time and attendance, training, checklists, incidents, licenses, inventory, client communication, and the other operations around the practice. We store the records those features create: shifts, tasks, messages, documents the hospital uploads, and the audit of who changed them.

2.3 Clinical records

When a hospital uses PAWTAL as its medical record, we store the clinical information the hospital enters: clients, patients, visits, treatments, medications, diagnostics, and charges. When a hospital keeps its medical record in another system and uses PAWTAL beside it, that other system remains the source of the chart. PAWTAL then holds the operational data around it, plus any record the hospital chooses to sync.

2.4 Connected practice systems

If a hospital connects another system, such as its existing practice-management software, we store an encrypted credential and the records that connection is set up to sync. We do not ask staff to type that system's password into a PAWTAL page, and we do not store that password.

2.5 Client communications

  • Mobile numbers and email addresses a hospital or a client provides for reminders, follow-up, and similar messages.
  • The content and delivery status of those messages.
  • Consent and opt-out timestamps for SMS and email.

2.6 AiVA

When someone uses AiVA, the question and the hospital context needed to answer it — which can include chart or operational data — are sent to OpenAI to produce that response. We keep the conversation in the hospital's workspace when the feature is built to do so. We do not use that content to train PAWTAL models. The request is sent under an API agreement that does not allow OpenAI to use it to train their models.

2.7 Usage, cookies, and technical data

We collect IP address, browser type, device type, pages visited, and timestamps. We use cookies and similar storage to keep a signed-in session and to remember preferences. We do not use that data for third-party advertising, and we do not sell it.

2.8 Demo requests

If you request a demo, we collect the name, work email, hospital, and the note you send, and we use them to respond.

3. How we use information

We use information to:

  • operate the hospital's workspace and show each person only what their role allows;
  • authenticate sign-in and protect the service;
  • send the SMS and email a person or hospital has turned on;
  • run AiVA and other assistance the user invokes;
  • sync a connected practice system the hospital has enabled;
  • keep delivery and change history so the hospital can see what happened;
  • respond to support requests and enforce our terms;
  • comply with law;
  • understand, in aggregate and without identifying a person, how the product is used so we can fix it.

We do not sell personal information. We do not use hospital, staff, client, or patient information for advertising.

4. SMS and email notifications

Staff text and email notifications go only to people who have opted in on the Notifications settings page. Each category has its own toggle, and none of those categories is on by default. A person can turn a category off on that page, or reply STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to any staff SMS to opt out of all PAWTAL staff SMS. The steps are documented at /sms-opt-in.

Client reminders and similar hospital-to-client messages are sent for the hospital, to the number or address the hospital's record holds, and they stop when the recipient opts out or the hospital turns the program off. Phone numbers and opt-in data are not shared with third parties for marketing.

Mobile carrier message-and-data rates may apply. How often a message arrives depends on the schedule and the categories that are on.

5. Service providers

These providers process information to run PAWTAL. Each has its own privacy terms. We do not authorize them to use the information for their own advertising.

If a hospital connects its own practice-management system, that vendor's terms apply to the hospital's use of that system.

6. When we disclose information

  • The hospital. The subscribing hospital administers its workspace and can see the records its roles allow, including whether a staff member has opted in or out of notifications.
  • People the hospital authorizes. Access inside a workspace follows the role the hospital assigns.
  • Service providers listed above, only as needed to operate the product.
  • Legal and safety. We may disclose information to comply with a valid legal obligation, or when we believe disclosure is necessary to protect the security of the service or to prevent imminent harm. Where the law lets us, we will tell the hospital.
  • A business transfer. If VetAILs is involved in a merger, acquisition, or sale of the business, information may transfer with it, subject to this policy.

7. Security

How the service is protected is described on the Security page: hospital separation in the database, encryption in transit and at rest, and encrypted storage of connected-system credentials. No method of transmission or storage is perfectly secure.

8. Retention

We keep a hospital's information while its workspace is active and as needed to provide the service, meet a legal duty, or resolve a dispute. Notification logs are kept for delivery history and troubleshooting. To ask us to delete personal information, email support@pawtal.com. The hospital owns the practice record, so a request that would erase a chart, a schedule, or another hospital record is confirmed with the hospital before anything is removed. Encrypted backups roll off on their normal cycle.

9. Your rights

  • Access. Ask for a copy of the personal information we hold about you.
  • Correction. Ask us to correct information that is wrong. Staff can also update notification settings in the application.
  • Deletion. Ask us to delete your personal information, subject to the hospital's record and to law.
  • Portability. Ask for an export of your personal information in a common format.
  • Opt out of messages. Use Notifications settings, reply STOP to a staff SMS, or use the unsubscribe link in an email.
  • Objection or restriction. Ask us to limit processing in the circumstances the law provides.

Email support@pawtal.com from the address on the account. We will respond within 30 days. We may need to confirm that the request comes from the account holder or from the hospital.

10. California residents

If you are a California resident, the California Consumer Privacy Act gives you the rights to know, delete, and correct personal information, and the right not to be discriminated against for exercising them. We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of on that point. To make a request, email support@pawtal.com. We will respond within 45 days.

11. Children

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email support@pawtal.com and we will delete it.

12. International processing

We operate the Services from the United States. If you access them from somewhere else, your information is processed in the United States.

13. Changes

We will update the date at the top of this page when the policy changes. If a change is material, we will also give notice in the product. The SMS program terms have been in effect since April 18, 2026.

14. Contact

Privacy questions, data requests, and security concerns: support@pawtal.com.