Privacy policy for Petivo: Tiergesundheit

Petivo helps you record your pets’ care and health. This policy explains how personal data is processed when you use the app. It covers guest access, registered accounts and Premium subscriptions.

1. Who is responsible for your data

Digital-e UG (haftungsbeschränkt)
Norderstraße 47, 25436 Tornesch, Germany
Represented by managing director Kurt Laabs
Pinneberg Local Court, HRB 18836 PI
Contact: anfrage@digital-e.org

No data protection officer has been appointed. You can send privacy requests to the address above.

2. Required and optional information

Petivo requires a technical Firebase account. You can start as a guest or sign in with email and password or Google. A guest account also has a persistent identifier. “Anonymous” describes the sign-in method; identifiers, connection data and entered content can still be personal data.

Email, name and profile details depend on the sign-in method. Pet details, contacts, photos, documents and voice recordings are optional. Features that depend on information you do not provide will be unavailable. You can use Petivo without voice recording, Google sign-in or a Premium subscription.

The app is intended for people aged 16 and over. At registration you confirm this minimum age; before a purchase you also confirm that you are an adult. Petivo does not collect an identity document or date of birth for these confirmations.

3. Accounts, pet records and shared care

Firebase Authentication processes your sign-in identifier and, for email sign-in, your email and technical password data, verification status and sign-in times. We cannot read your password in plain text. Google sign-in may also provide Google identifiers, a display name and a profile image URL. Firebase sends necessary verification and password messages.

Depending on use, a pet record contains:

• pet details, microchip number, living conditions, diet, intolerances and weight history;
• observations, symptoms, wounds, photos, documents and free text;
• medication, doses, stock levels, administrations and side effects;
• care plans, reminders, veterinary appointments, diagnoses, findings, vaccinations and costs entered by you;
• veterinary and emergency contacts, plus technical change, synchronization and deletion information.

Records synchronize through Cloud Firestore. Petivo’s database is in the US multi-region nam5. An account-separated copy on the device supports offline use. Overviews and summaries use the recorded information. An animal’s health data is not human health data, but text, images and contacts can contain information about people. Only enter content you are entitled to use and avoid unnecessary details about others.

Co-Care lets you invite another signed-in user as a reader or editor. They receive access to the pet record according to that permission. Private notes are excluded. Petivo processes invitations, roles and change records to control access and keep changes traceable. You can revoke access; this does not recall copies already made outside the app.

4. Photos, documents and device access

Synchronized media uses private Cloudflare R2 storage with EU jurisdiction. Following an access check, the app receives a short-lived permission for the particular file. Cloudflare processes file content and necessary connection data. Images are re-encoded and metadata such as EXIF and GPS is removed. PDFs remain unchanged and may contain their own metadata.

Petivo requests device permissions for the relevant feature:

• microphone for a voice recording you start;
• camera or the system photo and file picker for media;
• notifications for local reminders;
• where needed, the system’s exact-alarm permission for reminders scheduled that way.

The app does not access your address book or GPS/system location. You enter veterinary and emergency contacts yourself. You can change permissions in Android. Home-screen widgets and local notifications may display information you have configured on your device.

5. Voice input with Care Capture

Recording starts only after your separate consent and your action to start it. Petivo sends microphone audio over an encrypted connection through a Cloudflare Worker to OpenAI. Speech is transcribed and turned into suggested pet-related entries. You review and confirm suggestions before saving. The feature does not provide a veterinary diagnosis or make treatment or dosage decisions.

The transfer includes audio, a temporary transcript, language, the context needed to assign entries and technical operation details. Cloudflare also processes authentication and connection data. OpenAI receives pseudonymous, technically derived identifiers for abuse prevention. These identifiers do not guarantee full anonymity.

Petivo does not archive raw audio or full transcripts. A structured result with short supporting excerpts remains available on the server for handover for up to 15 minutes and is removed earlier after confirmed receipt. The local review draft remains until you save or discard it, or at the latest until sign-out or account deletion. Saved entries become part of your pet record.

The global OpenAI API is not restricted to EU processing. By default, content is not used to train OpenAI models. OpenAI may keep content in security logs for up to 30 days by default; legal obligations or necessary protective measures can require longer retention. The store=false setting used for structuring does not prevent such security logging.

You can withdraw consent in the app and continue making entries manually. Withdrawal prevents new recordings; previously saved pet-record entries can be deleted separately. Petivo keeps the current consent or withdrawal status, including version, language and time, until account deletion. Production recordings are not collected as a Petivo testing or training dataset.

6. Premium and Google Play purchases

Petivo offers monthly and annual auto-renewing subscriptions through Google Play. Google Play shows the price, duration and purchase terms before confirmation. Google collects payment details directly; Petivo does not receive complete card or bank details.

To unlock or restore Premium, the app sends product ID, transaction ID and purchase evidence with authentication and security tokens to Petivo’s API. A pseudonymous account identifier links the purchase to your Petivo account. The API checks the status with Google Play and acknowledges valid purchases.

Petivo stores the account association, product and transaction identifiers, subscription status, expiry and renewal information and verification times in Firestore. Necessary purchase evidence is encrypted on the server. Repeated status checks keep access current and prevent the same purchase being assigned to multiple accounts.

Account deletion removes Petivo’s purchase-verification data. It does not cancel a Google Play subscription or delete Google’s own order history. Manage subscriptions in Google Play. Google’s own purchase, payment and account processing is governed by its terms and privacy information.

The free voice sample is available once per Petivo account, including guests. An account counter is retained until account deletion and contains no audio or transcript. Premium includes up to 30 successfully processed captures per UTC week and photo comparison. If Google Play offers you a free trial, the app shows its duration and the subsequent annual price before purchase. The trial becomes a paid, automatically renewing subscription unless you cancel in Google Play before it ends.

7. Operation and security

Our API runs on a RackNerd server in the European Union. It processes the data needed for shared care, media, purchases, export and deletion, along with authentication and App Check tokens. The server also cleans up expired Care Capture operations. It may process structured results and supporting excerpts for this purpose, but not raw audio or full transcripts.

Firebase App Check with Google Play Integrity evaluates app and device signals to prevent abuse. The API uses short-lived tokens and checks permission for each protected request. Data is encrypted in transit.

Server access logs include IP address, time, path, status and user agent. Application logs contain technical operation IDs, routes, duration and error codes. Authentication tokens and request content are not written to access logs. Limited counters support voice quotas and abuse prevention, including daily changing HMAC identifiers derived from IP addresses; these counters do not store the raw IP address.

Petivo has no advertising or advertising ID. Firebase Analytics is optional: collection starts only after consent under “More → Data and privacy”. Events cover viewing and closing Premium offers, starting purchases and restores, and using the voice sample. The SDK also processes standard technical data such as pseudonymous app-instance identifiers, app version, device and operating-system information and interaction data. Technical connections send IP addresses to Google, which can derive a coarse region from masked IP addresses. After consent, the SDK can also measure purchase and subscription events with product ID, product name and price. Petivo does not send pet records, audio, transcripts, free text, email addresses or Petivo account identifiers as analytics parameters. Advertising purposes, ad personalization and automatic screen reporting are disabled. This choice applies on this device and can be withdrawn in the same place at any time. Withdrawal immediately blocks new custom events, disables SDK collection and resets local analytics data. It does not retrospectively delete all data already sent to Google. The app works without this consent. Crashlytics and Cloud Messaging are not integrated; there are no marketing push notifications.

How Google uses data from apps.

8. Purposes and legal bases

Device storage required for accounts, local pet records and synchronization falls under Section 25(2), point 2 TDDDG. You control optional device features through their permissions. Consent to a voice recording does not replace the legal basis for separate security processing.

9. Recipients and international processing

In addition to Digital-e, these providers receive the data required for their function:

• Google/Firebase and Google Cloud: sign-in, App Check, Firestore, synchronization and, with consent, Firebase Analytics. Google generally processes this app data on our behalf. Google Play also processes orders and payments for its own purposes.
• RackNerd LLC: hosting the API server in the EU.
• Cloudflare, Inc.: private R2 media storage and forwarding optional recordings through Workers.
• OpenAI Ireland Ltd. and participating OpenAI companies: transcription, structuring and necessary protection of the API service.
• Shared-care users or external recipients you select when you share or export, and competent authorities where legally required.

Firebase/Firestore processes data in countries including the United States. R2’s EU jurisdiction does not mean that all technical processing by Cloudflare or OpenAI occurs only in the EU.

Google identifies the EU-US Data Privacy Framework and Standard Contractual Clauses for relevant transfers. Cloudflare’s and OpenAI’s processing terms provide for Standard Contractual Clauses or applicable adequacy decisions for relevant third-country transfers. You can ask us for information and a copy of the safeguards applicable to your data. Legal access and protection rights in third countries may differ from EU standards.

Further information: Firebase, Google Cloud, Cloudflare, OpenAI and Google Privacy.

10. Retention and deletion

Due technical records are cleared at service start and regularly every 30 minutes in bounded batches. Backlogs or errors can delay actual deletion. Failed deletion jobs remain restricted until completed and are retried. Content-free status copies of completed individual deletions remain for display and synchronization until account deletion.

Firebase describes up to 180 days to remove deleted authentication data from its live and backup systems. Providers may also keep their own legally required security or order records. Petivo has no additional external backup service or Firestore point-in-time recovery enabled.

We have configured optional Analytics event and user data to be retained for two months, without extending retention on new activity. The local consent choice is stored until withdrawal or deletion of app data. Aggregated reports may remain for longer.

11. Deleting, exporting and external apps

Under More → Privacy and data, you can export data and delete your account. Individual entries and media can be removed separately. Account deletion clears owned pet records, media, private notes, sharing links and purchase-verification data across the systems involved. Confirmation follows successful processing. Remaining legal or technical retention periods are described in section 10.

If you no longer have app access or want specific data removed, see our deletion instructions. Creating another account later does not restore deleted content.

You choose recipients when sharing, printing, exporting or opening a phone or email app. An offline emergency card and its QR code contain only the details you select. Anyone you make them available to can read them. Petivo cannot recall copies already shared.

12. Your rights

Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You can withdraw consent at any time for the future without affecting the lawfulness of earlier processing. Additional rights under applicable local privacy law remain unaffected.

Write to anfrage@digital-e.org. We may request proportionate evidence that the data belongs to you. We normally answer rights requests within one month and inform you of any legally permitted extension. Exercising your rights is generally free of charge.

Your right to object

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests under Article 6(1)(f) GDPR. We will stop that processing unless overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims apply.

13. Complaints and automated decisions

You can complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. The authority for our registered office is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Holstenstraße 98, 24103 Kiel, Germany
mail@datenschutzzentrum.de · www.datenschutzzentrum.de

Petivo does not make solely automated decisions, including profiling, with legal or similarly significant effects under Article 22 GDPR. You confirm voice-input suggestions yourself.

14. Changes to this policy

We update this policy when features, data flows or legal requirements change. The current version is linked in the app and on this website. We provide appropriate notice of significant changes and request fresh consent before the relevant processing where required.