Privacy Policy

Who we are

TellDoug is a private pet-health record service. For the purposes of the UK General Data Protection Regulation (UK GDPR), the operator of TellDoug acts as the Data Controller for the personal data collected through this service.

Data we collect

To provide the TellDoug service, we securely store specific categories of information belonging to you and your pets:

• Account data: Your email address, administrative status, subscription tier (free or pro), age affirmation timestamp, the date and version of your Terms of Service acceptance, and the date you joined.
• AI consent records: Whether you have opted in to AI processing, and We keep a permanent record of when you turned AI processing on or off, not just the current setting.
• Pets: Name, species, breed, date of birth, sex, microchip number, and allergies.
• Pet photos: A profile photo stored as a private file reference. When you replace a photo, the old one is permanently erased.
• Health record entries: Type of event (e.g., vaccination, medication, vet visit, invoice, etc.), date, details, source (owner-stated or document-extracted), linked documents, sealed status, chain seal to the previous entry, timestamps, and correction relationships. Entries are append-only—never silently edited or deleted.
• Vet practices: Name, address, postcode, phone, and website of your practices.
• Invoices and line items: Links to entries, invoice date, totals, VAT total, currency, notes, deterministic audit flags, as well as line item descriptions, quantities, unit prices, and VAT rates.
• Documents: Uploaded files such as vaccination cards, lab results, invoices, and the file type.
• Complaint drafts: The drafted complaint text, current status (drafted, sent, response received, resolved, or withdrawn), status change history with timestamps, and any reply documents you upload.
• Emergency share tokens: Revocable, time-limited tokens you create to share a pet's emergency information with a third party. Includes expiry and revocation timestamps.
• AI action ledger: For every AI action: input summary, proposal, confidence score, pinned model version, prompt version, status (accepted/rejected/failed), your changes prior to confirming, call type, and exact token usage (input, output, cache-read, cache-creation).
• Audit results & flags: Overall score, dimension sub-scores, flag count, triggered rules, severity, affected line items, and regulatory sources.
• Verification runs: System pass/fail statuses, entry counts, and sources for chain verifications.

Lawful basis for processing

Under UK GDPR, our lawful bases are:

• Contract (Art 6(1)(b)): To provide the core health record and deterministic cost-audit service you signed up for.
• Consent (Art 6(1)(a)): Specifically for AI document processing. We require explicit opt-in (an unticked checkbox) resulting in a durable timestamped record before any file or text is sent to our AI sub-processor.
• Legitimate interests (Art 6(1)(f)): To publish the public Vet Directory — a free listing of UK veterinary practice business contact details compiled from publicly available sources. We have balanced our interest in providing a useful public information service against the interests of listed practices by limiting the directory to business contact details and providing a clear correction and removal route.

AI sub-processing

Documents and text are sent to Anthropic (Claude) only when your AI consent is explicitly turned ON. Anthropic Inc. is a US-based sub-processor. Data transfers are protected by appropriate international transfer safeguards, including Standard Contractual Clauses where required.

If consent is OFF, absolutely nothing is sent. The health record works entirely manually. Our AI model version is pinned, actions are strictly ledgered, and AI only proposes—it never decides or writes to your record automatically.

Payment processing

Payments for Pro subscriptions are processed by Stripe, Inc., a US-based payment processor. Stripe collects and processes your payment card details directly — TellDoug never sees or stores your card number. Stripe's processing of your data is governed by their own privacy policy.

Data retention

The health record is designed as an append-only, sealed ledger. Entries cannot be silently edited or deleted. Corrections create a new entry that supersedes the original, while keeping the original visibly in place for auditing.

Full erasure is available via the "Delete everything" action in your Settings. This immediately and irreversibly removes all data and files associated with your account, and is never paywalled.

Your rights

• Access & Portability (Art 15/20): You can export a full JSON archive of all your data at any time via Settings. Never paywalled.
• Erasure (Art 17): Complete erasure of all data and files is available via the "Delete everything" feature. Never paywalled.
• Rectification (Art 16): You can create a new correcting entry that supersedes a previous one in your append-only ledger.
• Object / Withdraw consent (Art 21/7): You can instantly revoke AI processing consent via a toggle in Settings.
• Restriction of processing (Art 18): Contact us to request restricted processing under specific legal grounds.

Security

Your data remains strictly private. We enforce absolute per-account isolation—the acting account is always derived from your secure session token, never from a request parameter. The health record employs an append-only cryptographic hash chain to make silent tampering strictly detectable. Access requires session-based authentication via email and password (securely hashed with bcrypt) or OAuth, maintained by a secure httpOnly session cookie (SameSite=Lax).

Cookies and tracking

TellDoug uses a strictly necessary, highly secure session authentication cookie (httpOnly, secure, SameSite=Lax) to keep you logged in.

We do not use advertising cookies, third-party analytics cookies, or trackers. There is absolutely no tracking without a recorded owner decision.

Vet Directory

TellDoug publishes a free, public directory of UK veterinary practices. This is a separate service from your private pet-health records — you do not need an account to use it and we do not ask for personal details to search.

The directory contains business contact information (name, location, phone, website, opening hours) compiled from publicly available sources including OpenStreetMap and the RCVS register. We publish it on the basis of our legitimate interests (Art 6(1)(f)) in providing a useful public information service. For most practices this is business contact information; where a practice trades under a sole practitioner's name, that name may also be personal data.

To prevent abuse, we briefly hold a one-way, salted hash of your IP address for rate-limiting. This is not your IP address and is not personally identifiable. These hashes are deleted automatically within approximately one hour. We do not log your searches or build a profile of you.

If you represent a practice and your entry is inaccurate, or you'd like it corrected or removed, contact dataprotection@telldoug.com — you may also object to being listed. We aim to respond within one calendar month. For full details on directory data sources and coverage, see our About Our Data page.

Contact & Complaints

For data protection queries, please contact us at: dataprotection@telldoug.com.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues: ico.org.uk.

Changes

We will notify you of material changes to this Privacy Policy via a notice on this page and, for material changes, by email to registered users.