Privacy Policy

Last updated: October 20, 2026

The privacy of your data—and it is your data, not ours—matters to us. This policy explains what data we collect, why we collect it, how we handle it, and your rights. We promise we never sell your personal data.

When we say Company, we, us, or our, we mean Clean Wake AB, a company registered in Sweden.

When we say Services, we mean our website at digitalclinic.vet and the Digital Clinic platform, including our iPhone app (Digital Clinic for iPhone, listed in the App Store as The Digital Clinic) and our browser extension.

When we say you or your, we mean visitors to our website, customers, and users of our Services.

Quick Summary

We collect only what we need to provide our Services
We never sell your personal data
We use third-party processors—you can see who they are below
Your data is primarily stored in Germany (EU)
You have rights to access, correct, and delete your data
We take security seriously

What We Collect and Why

Our guiding principle is to collect only what we need. Here's what that means in practice:

Identity and Access

When you sign up, we collect:

Name and email address — to create your account and communicate with you
Phone number — for account recovery and optional notifications
Professional information — your role, profession, competencies, and licenses (for veterinary professionals)
Organization details — clinic or practice name and address

We use this information to provide and personalize our Services, verify professional credentials, and send essential communications.

Billing Information

For paid accounts, we collect:

Billing address — to process payments and comply with tax requirements
Payment information — processed securely by our payment providers; we don't store full card numbers
Bank account details — for specialists receiving payouts
VAT/organization numbers — for invoicing purposes

Content You Provide

When you use The Digital Clinic, you may upload:

Case information — patient data, medical histories, symptoms
Media files — images, videos, audio recordings, documents
Communications — chat messages, call recordings, notes

Important: You are responsible for ensuring you have the right to upload this content, including obtaining consent from pet owners for any personal data about them or their animals.

Browser Extension

If you install our optional Chrome extension, you can open a side panel and record voice notes from any page in your browser without leaving the page you're on. The extension transmits to our backend:

Audio recordings you initiate from the side panel — processed identically to in-app dictation (see Sub-processors)
Patient context read from the page only when you are on a Practice Management System (PMS) we integrate with — name, ID, species, age, weight, sex, chip number, medical history — used to attach the voice note to the correct medical case, or to create a new case if one doesn't exist. On any other page, the extension does not read page content; your recording is uploaded without context, and you can link it to a case from inside the app.
Authentication via your existing Digital Clinic browser session cookie — the extension stores no credentials of its own

The extension does not introduce new sub-processors. All data flows to the same Digital Clinic backend and is processed under the arrangements described elsewhere in this policy. Google's Chrome Web Store is a distribution channel only; we do not transmit your case or patient data to Google. If you uninstall the extension, no further data is transmitted from your browser; data already submitted is retained per the schedule below.

iPhone App

If your clinic uses Digital Clinic for iPhone, you can record consultations on your iPhone and find the finished notes in Digital Clinic on your computer. The app is part of the Services and is processed under the same arrangements as the rest of this policy; it introduces no new sub-processors.

Signing in. You pair the app with your Digital Clinic account by scanning a one-time code shown in Digital Clinic on your computer (or typing it). The app receives an access token that is stored in the iPhone's Keychain. You can sign the app out on the phone, or remove the phone from your account in Digital Clinic at any time; a token that hasn't been used for 90 days stops working. When pairing, the app sends the device's name, model, iOS version, app version and an identifier that iOS gives our app on that phone (it can't be used to recognise the phone in other companies' apps), so you can recognise your phones in your account and so that pairing a phone again replaces its earlier sign-in.

What the app sends to us:

Audio recordings you make — uploaded to our servers in the EU and processed like any other recording (transcription and document writing, see Sub-processors)
What you choose for a recording — the case (patient) it belongs to, if any, and the templates it should become
Usage events — what was done in the app, not what was said: for example that a recording started or stopped and how long it was, that an upload completed or failed, that a note was opened or copied. Each event carries the app version, iOS version, device model, the app's language and a random session identifier, and is linked to your account. Usage events never contain audio, transcripts, note text, or patient or owner names. They are stored on our own infrastructure and are not shared with third parties.

What stays on your iPhone:

Recordings are saved on the phone as you record, so nothing is lost if the connection drops or the app is closed. A recording that hasn't reached our servers yet stays on the phone until it has been sent. After it has been sent, the phone keeps its copy for listening for the time you choose in the app's settings (7, 30 or 90 days, or deleted right after sending; 30 days unless you change it), then deletes it. Our servers keep their copy as described under How Long We Keep Your Data below.
Your VoiceIts and their notes are kept on the phone so you can read them offline (the most recent ones from the last 12 months).
Recordings and these copies are excluded from iCloud and device backups. Signing out or removing the phone deletes the notes and the kept recordings from the phone; a recording that hasn't been sent yet waits on the phone for the vet who made it.

Permissions. The app asks for the microphone (to record), the camera (only to scan the pairing code — the camera image is neither stored nor sent) and notifications (reminders about a paused recording). You can change these in the iPhone's Settings at any time.

Lock screen. While a recording runs or is paused, the lock screen and the Dynamic Island show the patient's name (if the recording has one) and what the recording becomes, and the reminders about a paused recording show the patient's name. Anyone who can see the phone can read them. You can turn off Live Activities and notifications for the app in the iPhone's Settings.

No tracking. The app contains no advertising or third-party analytics SDKs and does not track you across other companies' apps or websites. If you have chosen to share crash and usage data with app developers in your iPhone's settings, Apple provides us with anonymous crash reports; these contain no content from the app.

Apple. The App Store and TestFlight are distribution channels only; we don't send your case or patient data to Apple. If you delete the app, everything it stored on the phone is deleted with it, except any recording you hadn't sent yet, which is lost; data already sent to us is kept per the schedule below.

Automatically Collected Information

When you use our Services, we automatically collect:

Log data — IP address, browser type, pages visited, time spent, referring URLs
Device information — device type, operating system, unique identifiers
Location data — general location based on IP address (we don't use precise GPS location)

We use this information to maintain security, improve our Services, and troubleshoot issues.

We don't use third-party tracking. Our analytics are self-hosted on our own infrastructure—we don't share your browsing behavior with Google, Facebook, or other advertising networks.

Cookies

We use cookies and similar technologies for essential functionality, security, and analytics. See our Cookie Policy for details.

How We Use Your Information

We process your personal data for these purposes:

To Provide Our Services

Creating and managing your account
Enabling communication between veterinary professionals and specialists
Processing payments and generating invoices
Facilitating case management and consultations

Legal basis: Performance of our contract with you.

To Improve Our Services

Analyzing usage patterns to improve features
Troubleshooting technical issues
Developing new functionality

Legal basis: Our legitimate interests in improving our Services.

To Communicate With You

Sending essential service notifications
Responding to support requests
Providing product updates (you can opt out)

Legal basis: Performance of our contract; our legitimate interests; or your consent (for marketing).

To Ensure Security

Detecting and preventing fraud
Protecting against unauthorized access
Monitoring for abuse

Legal basis: Our legitimate interests in maintaining a secure platform.

To Comply With Law

Responding to legal requests
Maintaining required records
Fulfilling tax obligations

Legal basis: Legal obligation.

When We Share Your Information

Within Your Organization

Data you upload to The Digital Clinic may be visible to other authorized users in your organization—including clinic staff, administrators, and specialists involved in cases. This is fundamental to how the platform works.

With Specialists

When you request a consultation, relevant case information is shared with the specialist. Specialists agree to confidentiality obligations as part of their terms.

With Service Providers

We use third-party service providers to operate our platform. These processors only access your data as needed to perform services for us and are bound by data protection agreements.

See our Sub-processors page for the current list.

We maintain Standard Contractual Clauses with processors outside the EU to ensure adequate protection for your data.

With Pet Owners

If you're a pet owner using our Services, your data may be shared with:

The veterinary clinic managing your pet's care
Specialists consulted about your pet's case
Authorized staff within the clinic or group

For Legal Reasons

We may disclose your information if required by law, court order, or government request. We'll notify you when legally permitted.

Business Transfers

If Clean Wake AB is acquired or merges with another company, your information may be transferred. We'll notify you before your data becomes subject to a different privacy policy.

Testimonials

We may post customer testimonials, comments, and reviews on our website or in marketing materials. These may contain personal information such as names or job titles. We obtain consent before posting testimonials with personal attribution. If you'd like to request removal of your information from a testimonial, please contact us.

Data Controller vs. Data Processor

Under GDPR, we act in different roles depending on the situation:

When We're the Data Controller

We determine why and how to process your data for:

Account management
Billing and payments
Platform analytics
Marketing communications

When We're the Data Processor

Veterinary practices are the data controllers for patient and pet owner data they upload to The Digital Clinic. We process this data on their behalf according to their instructions.

If you're a pet owner with questions about how a veterinary practice handles your data, please contact them directly.

International Data Transfers

Our primary infrastructure is in Germany (EU). However, some of our service providers are located outside the EU (primarily in the United States).

For transfers outside the EU, we ensure adequate protection through:

Standard Contractual Clauses approved by the European Commission
Data Processing Agreements with all processors
Additional security measures where appropriate

Use of Artificial Intelligence

The Digital Clinic includes AI-assisted features such as consultation transcription, clinical note structuring, case summarisation, translation, document OCR, and knowledge-base search. These features send the content you submit (audio recordings, note text, case data, uploaded documents) to AI providers for processing, and return the result to the platform. Some providers are customer-selectable from your organization's configured allowlist; others are platform-level for specific features (audio transcription, knowledge-base search). The current AI providers are listed on our Sub-processors page.

We separate AI providers into customer-selectable and platform-level arrangements so you know exactly what is selectable and what isn't:

Customer-Selectable LLM Providers

For chat, structured clinical notes, case summaries, drug matching, language detection, and message translation, you choose which provider(s) we use for your organization (Mistral AI, OpenAI, Anthropic). Your configured allowlist is enforced in code before any LLM request leaves the platform — a misconfiguration fails loudly and is logged, never silently bypassed.

Customer-Selectable OCR Provider

Document OCR uses Mistral OCR (EU/France). When your allowlist excludes Mistral, OCR falls back to local text extraction (Apache Tika) inside our own application — no document bytes are sent to any external provider.

Platform-Level Providers (Not Customer-Selectable)

Two features rely on a specific provider for architectural reasons:

Audio transcription uses Gladia (EU/France) to convert recorded audio into text. Audio is sent to Gladia, transcribed, and returned via webhook. Gladia retains audio only for the duration of the transcription job and does not train models on customer audio.
Knowledge-base search uses OpenAI embeddings (US) to convert text into vectors for similarity search. Vector dimensions are fixed in our database schema, so supporting alternative embedding providers would require a platform migration.

Neither provider can be swapped per customer; if a particular provider is incompatible with your requirements, the corresponding feature can be disabled for your organization at onboarding. Organizations requiring EU-only processing can restrict the customer-selectable allowlist to Mistral AI (France) — combined with Gladia (France), all customer-content AI processing stays in the EU except knowledge-base search.

No Automated Decision-Making

AI outputs are suggestions for a licensed veterinary professional to review, edit, and validate. No AI output becomes part of a legal medical record without the veterinarian's explicit validation. Every AI-generated output is clearly labelled in the interface, and our chat interface carries a persistent disclaimer that responses are AI-generated and should be verified before clinical use.

We do not use AI to make decisions with legal or similarly significant effects on any data subject, within the meaning of GDPR Article 22.

No Training on Your Data

Our AI providers contractually commit not to use the data we send them via their API to train their models. See the provider DPA links on our Sub-processors page.

Transfers

Where an AI provider is located outside the EU/EEA, transfers are governed by the Standard Contractual Clauses incorporated into our Data Processing Agreement (§8 and §15).

Audit Logging

We track AI usage per operation (provider, model, token counts, timestamp) for audit and cost attribution. This metadata does not include the content submitted to the AI provider or returned to the platform.

How Long We Keep Your Data

We retain your data only as long as necessary:

Account information — Duration of account + 2 years
Case data — Duration of account + 7 years (for medical record requirements)
Billing records — 7 years (Swedish accounting requirements)
Log data — 12 months
Recordings kept on your iPhone after sending — 7, 30 or 90 days, as set in the app (30 days unless changed), or deleted right after sending
Deleted account data — Purged within 90 days

Some data may be retained longer if required by law or to resolve disputes.

Your Rights

You have the following rights under GDPR and Swedish law:

Right to Access

You can request a copy of the personal data we hold about you.

Right to Rectification

You can ask us to correct inaccurate or incomplete data.

Right to Erasure

You can ask us to delete your personal data, subject to legal retention requirements.

Right to Restrict Processing

You can ask us to limit how we use your data in certain circumstances.

Right to Data Portability

You can request your data in a structured, machine-readable format.

Right to Object

You can object to processing based on legitimate interests, including direct marketing.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

How to Exercise Your Rights

Right to Complain

If you're unhappy with how we handle your data, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

How We Protect Your Data

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, role-based access controls, regular security reviews, and employee training.

For details on our security practices, see our Security page.

If you discover a vulnerability, please report it to team@digitalclinic.vet.

Children's Privacy

Our Services are not directed at children under 18. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.

Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. The version on our website is always the current version — check the date at the top of this page.

For material changes that significantly affect how we handle your data, we'll make reasonable efforts to notify you (for example, via a notice on the platform or by email).

Contact Us

For questions about this policy or your personal data:

Clean Wake AB • Sprängarvägen 27 • 184 70 Åkersberga • Sweden • Email: team@digitalclinic.vet

Privacy Contact • Hannes Schippmann • Email: privacy@digitalclinic.vet

To exercise your data protection rights or to lodge a complaint about how we handle your information, contact us at the address above.

Additional Information for Specific Regions

For California Residents

Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information we collect and the right to opt out of the sale of personal information. We do not sell personal information.

For UK Residents

References to GDPR include the UK GDPR as retained in UK law. Your supervisory authority is the Information Commissioner's Office (ICO).