Privacy Policy

1. What we collect, and how

We collect only what the product needs to work. Everything below is provided directly by you or created through your use of our services. We do not buy data about you or your pets from third parties.

• Your account — the email address you sign in with, your name, your language preference and your timezone.
• Your pets — names, species, dates of birth, photos, and the health conditions, medications and vaccinations recorded against them.
• What you log — routines you create, tasks you tick, and entries you write or speak. Spoken entries are transcribed to text, and only the text transcript is stored.
• Media and attachments — photos and documents you attach to a pet’s profile.
• Communication — messages sent between you and a connected veterinary practice.
• AI assessments — records of what our AI decided about whether a logged entry suggests a pet needs a clinic, kept so we can track what was decided and why.
• Technical data — device notification tokens needed to send you reminders, and a secure audit trail of significant actions on your account.

2. What we use it for

• To operate the service — generating your daily tasks, maintaining your pet’s medical history, and syncing records between the people you invite.
• To assess whether a pet needs to see a clinic when you report something. Our AI never diagnoses, and deterministic safety rules run before it and can overrule it.
• To send the notifications you ask for and essential service emails, such as sign-in codes.
• To share a pet’s history with a veterinary practice you have explicitly connected, for as long as that connection is active.
• To process payments and manage your subscription.
• To keep the service secure, maintain safety, and investigate abuse.

We do not advertise to you, profile you for advertising networks, or sell your data to anyone.

3. Who else sees it

• Connected veterinary practices — a practice can see a pet’s record only while you keep an active connection to it. You start that connection and can end it at any time. Entries you mark private are never visible to a clinic. When a connection ends, the practice keeps a copy of what its own staff authored as its official medical record, with your name and contact details anonymised.
• People you invite — anyone you add to a pet’s group can see the pets in it, limited by the access you grant them.

Service providers. We use a small, vetted group of core infrastructure partners to help us run the service. Each is contractually bound to protect your data to our standards and cannot use it for its own commercial purposes:

• Cloud infrastructure and database — secure data hosting, user authentication and encrypted file storage.
• Push notification services — delivering system notifications and alerts to your device.
• Artificial intelligence service models — processing logged text and audio entries solely to flag whether a clinic visit is needed.
• Subscription and in-app purchase managers — tracking, validating and managing mobile app store subscription states.
• Payment processing gateways — securely processing card transactions and billing details for veterinary practices.
• Transactional email delivery — sending account system emails, security updates and sign-in codes.

Legal and safety disclosures. We disclose data only where a valid legal obligation requires it, or to protect someone’s immediate physical safety.

4. Where it is held, and how it is protected

• Where it lives — all data is held on servers in the United States. If you live outside the US, using the service means your data is transferred there.
• Database-level access — permissions are enforced inside the database itself. A practice cannot reach another clinic’s data, and a user cannot see a pet outside the group they belong to.
• Private storage — photos, documents and recordings sit in private buckets that are never publicly addressable.
• Mandatory MFA — multi-factor authentication is required for every role in the clinic workspace.
• Controlled staff registration — veterinary staff cannot open an account themselves; a verified clinic administrator must invite them.

5. How long we keep it

We keep your account and its contents for as long as your account is open. When you ask us to delete it:

• A 14-day grace period — your data is held for a fortnight after a deletion request. Nothing is destroyed immediately and you can cancel at any point in that window.
• Permanent deletion — after 14 days the data is erased: your pets, photos, logs, routines, messages and profile settings.
• Clinic retention — a connected clinic keeps its own clinical records of a pet it treated, to meet its medical record-keeping obligations. That copy is held with your name and contact details removed.
• Anonymised AI records — logs of AI safety decisions are kept without a fixed expiry so we can track and improve the safety rules. They record the outcome only and carry nothing that identifies you.

6. Your choices, and how to manage your data

• Delete your account — from Settings in the mobile app, at any time.
• Correction and portability — you can export a full report of a pet’s medical log from the app, and edit your pets, entries and profile settings in the app. To change your sign-in email, ask us.
• Withdraw consent — turn off notifications, disconnect a practice, or close your account at any time. No paid feature depends on giving access to data beyond what that feature needs.

Depending on where you live — India, the UK and the EU among others — you may have further rights to object to or restrict how we use your data, or to complain to your local data protection authority.

7. Children’s privacy

One Heart Pet is not directed at children and is not intended for anyone under 13. We do not knowingly collect personal data from children. If you believe a child has created an account, tell us through the contact form and we will remove it.

8. Data controller and contact

One Heart Pet is owned, developed and operated by Flumestack Private Limited, a private limited company incorporated and registered under the laws of India.

We do not publish a direct email address, because a published address is harvested for spam. Our data privacy point of contact is the contact form, which routes straight to the people who handle these requests. We answer privacy enquiries and rights requests within the timeframes the law requires.

9. Changes to this policy

If we change this policy we will update the date at the top of this page. If a change materially affects your privacy rights, we will tell you prominently — in the app, or by email to your registered address.