Who we are
Aleefy is a veterinary platform made of two applications and one shared record. The Aleefy app is used by pet owners. The Aleefy Clinics app is used by veterinary clinics and their staff. Both talk to the same backend, and this policy covers all of it, including this website.
We are the controller of the personal data described below. For anything in this policy, write to support@aleefy.me.
What we collect
Account and identity
- Your email address, and your password stored in a form that cannot be read back — never the password itself.
- Your full name, phone number, country and region, and an optional profile photo.
- One-time codes sent to your email or, where enabled, your WhatsApp number, so we can verify that the address or number is yours.
Your pets
Name, species and breed, colour, sex, date of birth, weight, whether the animal is neutered, allergies, free-text notes, an optional photo, and a QR token unique to that animal.
Medical records
Visits recorded by a clinic: date, visit type, clinical notes, line items and their prices, payment status, vaccinations given and when the next dose is due, reminders, and any files a clinic attaches such as lab results or images.
Appointments
The clinic, the date and time, the reason, and the status. For a home visit, the address, area and — if you provide it — the map coordinates you chose, because a vet cannot come to you without them.
Payments
For clinics on a paid plan: wallet balance and transaction history, deposit references from the payment provider, invoices, and the plan a clinic is on. We never see or store full card numbers.
Technical and security data
IP address, user agent and device identifiers on sign-in sessions and on security-relevant actions; push notification tokens for the devices you have signed in on; and audit logs recording who read or changed a medical record, and when.
Why we use it
- To run the service you asked for: keeping the record, booking the appointment, sending the reminder.
- To verify that an account belongs to the person using it, and to keep other people out of it.
- To let a clinic identify the right animal and the right owner at the counter.
- To send you notifications you have turned on — a vaccination due, an appointment confirmed, a record shared.
- To take payment from clinics on a paid plan, and to keep the accounting straight.
- To detect and investigate abuse, fraud and unauthorised access to medical records.
- To meet obligations we are under by law.
We do not sell your personal data. We do not use it to build advertising profiles, and we do not share it with advertising networks.
How medical records are shared
A medical record is written by a clinic and belongs to the animal. Each clinic keeps its own record for a pet it has treated, and one clinic cannot read another clinic's record.
A clinic may share a record, or a single visit, with the pet's owner. Once shared, that owner can read it in the Aleefy app. Sharing is an explicit act by the clinic; nothing is shared automatically.Clinic app
Every read and every change to a medical record is written to an audit log with the staff member, the time and the IP address. That log exists so a clinic can answer "who opened this record", and we do not delete it when a record is deleted.
The QR pet tagPet owner app
Each pet has a QR tag. Anyone who scans it — a stranger who has found your animal — is shown the pet's name, species, breed, colour, sex and date of birth, together with your name and phone number, so they can call you.
This is the entire purpose of the tag, and it means the printed tag is a credential: whoever physically holds it can see those contact details, without signing in. Nothing else about your account, and no medical record, is reachable from a scan.
If a tag is lost or you no longer want it to work, regenerate the QR code from the pet's page in the app. The old code stops resolving immediately.
Who else sees your data
- Clinics you visit, or that you book with, see what they need to treat your animal.
- Our hosting and infrastructure providers, who store the data on our behalf under contract.
- The messaging providers that deliver our emails, WhatsApp messages and push notifications — they see the message and the address it goes to.
- Our payment provider, for clinic subscriptions, sees the transaction and the reference it belongs to.
- Authorities, where we are legally required to disclose and after we have checked that the request is valid.
That is the complete list. We add to it only for a reason described in this policy, and this page is updated when we do.
Clinic staff accountsClinic app
A clinic owner creates accounts for their staff, and those accounts carry the staff member's name, contact details, role, permissions and working hours. The clinic decides who has which permission.
A clinic owner can see what their staff did inside the clinic — which records were opened, which visits were written, which appointments were changed. That visibility is a requirement of running a clinic, and staff should know it exists.
When a staff member leaves, their access ends immediately. The entries they wrote stay in the record, because a medical history cannot be rewritten when a person leaves.
How long we keep it
- Your account and profile: for as long as the account exists.
- Medical records: for as long as the clinic that wrote them keeps them, because a health history has value precisely for being long.
- Audit logs and security records: kept beyond the deletion of the thing they describe, because a log you can delete is not a log.
- One-time codes and expired sign-in sessions: pruned automatically once they are no longer valid.
- Payment records: kept as long as accounting and tax rules require.
Your rights
You can ask us to show you the personal data we hold about you, correct anything wrong, delete your account, or give you a copy you can take elsewhere. You can withdraw consent for notifications at any time in the app.
Write to support@aleefy.me and we will answer within 30 days. We may ask you to confirm your identity first — a data request is exactly the request an impostor would make.
One limit, stated plainly: we cannot delete a medical record on your instruction, because it is the clinic's record of treatment it gave. Ask the clinic. We can delete your account and your side of the relationship.
Deleting your account
Delete your account from the settings screen in the app, or ask us to do it for you.Pet owner app
If you own a clinic you must transfer or close it first — deleting the owner of a live clinic would strand its staff and its patients.Clinic app
When an account is deleted we remove your profile, your pets and your access. Records a clinic wrote, and the audit and payment history described above, are kept as set out in this policy.
Security
- Everything travels over an encrypted connection, and passwords are never stored in a readable form.
- A clinic's data is isolated from every other clinic's at the database level, not only in application code.
- Access to a medical record is checked per request and written to an audit log.
- Sessions can be revoked, and signing in from a new device is recorded.
No system is perfect. If you believe an account or a record has been accessed by someone who should not have it, tell us immediately and we will investigate.
Children
Aleefy is not for children. You must be 18 or older to hold an account. We do not knowingly collect data from anyone under 18, and we delete it if we discover we have.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects what we do with your data, we will tell you in the app or by email before it takes effect, rather than relying on you to re-read this page.
Contact
Questions, requests and complaints: support@aleefy.me. If you are not satisfied with our answer, you may complain to your local data protection authority.