Data Protection Addendum

This addendum applies to practices that treat animals. The practice decides what information is kept about its clients (animal owners and the agents they authorize) and its patients (the animals); AminoLiance processes that information only to provide the Service, on the practice's documented instructions.

Animal medical records are not protected health information under HIPAA. Many state veterinary practice acts nonetheless make them confidential and limit their release to the owner, an authorized agent, another treating veterinarian or as the law requires; AminoLiance treats every animal record and client record as confidential to the practice.

We use and disclose client and animal information only to provide, secure and support the Service, or as the law requires; we never sell it, use it for advertising or combine it with information from other practices.

We protect it with the safeguards described on our Security page: encryption in transit and at rest, access limited by role and multi-factor sign-in, an append-only audit trail, encrypted backups in two regions, and personnel bound by confidentiality.

Our subprocessors (hosting, email delivery, payment processing) are bound by obligations at least as protective as these. [Counsel: list of subprocessors and how changes are notified.]

We tell the practice without undue delay, and in any case within [X] days, after we become aware of unauthorized access to its client or animal information, with what we know and the steps taken, so the practice can meet its own obligations under state data-breach notification laws.

Requests from a client to see, copy or correct their information, or from an authority (for example a rabies control or public-health agency, or a state board), are passed to the practice, which decides how to answer. Rabies vaccination certificates and other records the practice chooses to issue are produced from the practice's own data.

The practice remains responsible for its DEA registration, controlled-substance records, biennial inventories and any state prescription-monitoring reporting. The Service helps keep those records; it does not file them on the practice's behalf.

The practice can export its records at any time. When its subscription ends we keep its records available for export for [X] days, then delete them, except where the law requires longer retention or the practice asks us to keep them for its record-retention period. [Counsel: retention and deletion terms.]

This addendum lasts as long as the Terms of Service. If it conflicts with the Terms on the handling of client or animal information, this addendum prevails. [To be completed by counsel: governing law, liability, audit rights.]