Privacy Policy
Version 2026-08-v1 · In effect from 15 August 2026
This policy explains what personal information PawPad collects, why, who it is shared with, and the choices and rights you have. It is written to be read, not to be survived.
In this policy "we" and "us" mean PawPad. We are an agency under the New Zealand Privacy Act 2020 and we handle your information in accordance with it.
1. This is not veterinary advice
PawPad is a record-keeping and organisation tool. It is not a veterinary service, it does not provide veterinary advice, diagnosis or treatment, and it is not a substitute for consulting a qualified veterinarian. Always seek advice from your vet about your pet's health, and contact a vet or an emergency clinic immediately if you are concerned about your pet.
We put this first because it matters more than anything else in this document. PawPad organises information that you and your veterinarian record. It highlights changes against your pet's own history so that you can have a better-informed conversation with a vet. It does not tell you what is wrong with your pet and it does not tell you what to do about it.
Where a feature is assisted by AI, it is labelled as such and shows the source entries it drew on, so you can always check what it was based on. AI-assisted output is never presented as a clinical finding, and no part of PawPad is reviewed or authored by a veterinarian unless it explicitly says so.
2. Information we collect
We collect only what the product needs to work. There is no advertising, and we do not buy or sell personal information.
| Category | Examples | Why we hold it |
|---|---|---|
| Account information | Your email address, display name, and a hashed password | To create your account, sign you in, and contact you about your account |
| Pet health information | Your pet's profile, uploaded veterinary records, observations, check-ins, medications, and photos | This is the record itself, the reason the product exists |
| Documents you upload | PDFs and photographs of veterinary records | To store the original and organise the information it contains |
| Usage information | Pages visited, features used, and technical error reports | To understand what is used, and to find and fix faults |
| Waitlist information | Email address, first name, and what you told us about your pet | To contact you about early access |
3. How we use it
We do not use your pet's health information to train AI models, and we do not permit our AI subprocessor to do so.
Separately and entirely optionally, you may consent to de-identified information contributing to veterinary research. This is off by default, is never bundled with signing up, and you can withdraw it at any time without any change to how PawPad works for you.
- To provide the service: storing your pet's record, organising it into a timeline, and showing you what changed.
- To provide AI-assisted features: structuring uploaded records, turning your notes into proposed entries, and comparing observations against your pet's own history.
- To communicate with you: account confirmations, password resets, invites, and check-in reminders for monitoring you have set up.
- To keep the service secure and working: rate limiting, fraud and abuse prevention, error diagnosis, and audit records of who changed what.
- To meet legal obligations where they apply to us.
4. AI processing, and information sent overseas
You can see the sources behind any AI-assisted item in the app. If an item cannot show you its sources, do not rely on it, and please report it to us.
To provide AI-assisted features we send a minimised, pseudonymised extract of your pet's record to our AI subprocessor for processing. We send the least text needed for the task, and identifiers are replaced with internal references rather than your name or contact details.
That subprocessor is located in the United States, which means your information is disclosed outside New Zealand. Personal information is handled under the NZ Privacy Act 2020. Health records are stored with an offshore processor bound by contract to comparable safeguards (IPP12).
Processing is transient: the extract is sent, a structured result is returned, and we retain the result and an audit record of the run. Every AI run is logged with what was sent, what came back, and which of your record entries it was allowed to use, so an AI-assisted item can always be traced to its sources.
If AI processing is unavailable, PawPad continues to work. You keep recording, and organisation simply waits. Nothing you enter is lost because an AI feature failed.
5. Who else sees your information
Your pet's record is yours. Nobody else can read it unless you share it, and we do not browse it.
You can share a scoped summary with your veterinarian using a share link that you create and can revoke. Sharing gives a clinic access to what you chose to share. It never makes the clinic the owner of your record, and it never gives them access to your account.
We use service providers to run PawPad. Each is bound by contract to protect your information and to use it only to provide their service to us. They are:
| Who | What they do | Where |
|---|---|---|
| Cloud hosting and storage | Running the application and storing your pet's record and files | Sydney, Australia |
| AI processing (OpenAI) | Reading uploaded records and structuring and comparing their content | United States |
| Email delivery | Sending account email such as invites, password resets and reminders | Outside New Zealand |
| Error reporting | Recording technical faults so they can be diagnosed and fixed | Outside New Zealand |
6. How long we keep it
We keep your pet's record for as long as your account is open, because the value of the record is that it is longitudinal, and a health history is less useful with pieces missing.
Health records are append-only: correcting an entry creates a new entry that supersedes the old one, and the original is retained. This is deliberate, so that a record's history can be trusted, and it means "editing" never silently rewrites the past.
If you delete your account, we erase your account and your pets' records within 30 days. Backups are cycled out on the same schedule. We keep a minimal record that an account existed and was deleted, which we need for security and audit purposes.
Technical logs and error reports are kept for a short period and then discarded.
7. Your rights
Under the Privacy Act 2020 you have the right to ask for the personal information we hold about you, and to ask us to correct it if it is wrong.
- Access: you can export your pet's full record from the app at any time, in a structured format, without asking us.
- Correction: you can correct entries in the app. Because the record is append-only, a correction adds a superseding entry rather than erasing the original.
- Deletion: you can delete your account and your pets' records from the app.
- Withdrawing consent: you can withdraw optional research consent at any time in your profile.
- You can also contact us directly at support@pawpad.tech and we will respond within 20 working days, as the Act requires.
8. How we protect it
No system is perfectly secure. If we ever suffer a privacy breach that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Act requires.
- Passwords are stored only as salted, computationally expensive hashes. We never store the password itself and cannot tell you what it is.
- Your record is only reachable by your account. Access is checked on every request, on our own data, not left to a single layer.
- Uploaded files are stored privately and served only through short-lived links.
- Changes to health information are recorded in an audit log showing who made them and when.
- Secrets and keys are held server-side and are never sent to your browser.
9. Complaints
If you are unhappy with how we have handled your information, please tell us first at support@pawpad.tech and we will try to put it right, and it will reach our privacy officer. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
10. Cookies and analytics
We use a cookie to keep you signed in. It is essential to the service and cannot be turned off while you are using your account.
We collect page-level usage analytics to understand which features are used. We do not use advertising trackers, and analytics never receives your pet's health information.
11. Changes to this policy
If we change this policy in a way that materially affects you, we will tell you before the change takes effect and, where the change affects what you agreed to, ask you to agree again. Every version is dated, and the version you agreed to is recorded against your account.
12. Contact us
PawPad
Email support@pawpad.tech for anything, including privacy requests, corrections and complaints. We aim to reply within a few days, and within 20 working days at the latest.