Data processing agreement
This agreement covers the client and patient records a business keeps in TailBridge. The business decides what is recorded and why; TailBridge processes those records only to provide the service. Accepting it is part of signing up.
Who this agreement is between
This agreement is between [legal entity name], [registered address], Hyderabad, Telangana (“TailBridge”, “we”) and the veterinary clinic, grooming studio, pet store or other business that signs up to TailBridge (“the business”, “you”). It forms part of our terms of service. Where the two differ on personal data, this agreement wins.
Words such as Data Fiduciary, Data Processor, Data Principal and personal data breach have the meanings given in India’s Digital Personal Data Protection Act, 2023 (“the Act”) and the rules made under it.
What it covers
| Item | Details |
|---|---|
| Purpose | Providing TailBridge to the business: appointments and tokens, pet records and visit notes, vaccines and reminders, prescriptions, bills and payments, stock, reports and messages to pet owners |
| Data Principals | The business’s clients (pet owners and their contacts) and, where the business records them, other people such as referring vets |
| Personal data | Names, mobile numbers, addresses, preferred language, consent choices, pets’ visit, vaccine, prescription and billing records linked to their owners, payment references, and messages sent to owners |
| Processing | Storing, organising, syncing between the business’s devices, backing up, displaying, sending messages and payment links, exporting and deleting |
| Duration | While the business uses TailBridge, and until the records are deleted after it leaves |
It does not cover data TailBridge handles for its own purposes, such as staff logins, billing the business and our website. For those we are the Data Fiduciary, as our privacy policy explains.
Your instructions
We process the business’s personal data only to provide TailBridge and on the business’s documented instructions: these terms, the settings the business chooses in the app, and anything else it asks in writing. We tell you if we believe an instruction breaks the law.
We do not sell this data, use it to advertise, show one business’s clients to another business, or contact the business’s clients for our own purposes. Messages to pet owners go out only as the business has set them up.
What your business does
- Tells each client what it records and why, and gets the consents it needs, including consent to WhatsApp reminders. TailBridge provides the notice and the consent screens; the business uses them.
- Records only what it needs, keeps it accurate, and corrects it when a client asks.
- Gives staff their own logins with the right role, and removes access when someone leaves.
- Records a parent or guardian, not a child, as a pet’s owner.
- Answers its clients’ requests to see, correct or erase their data, with our help.
Security and confidentiality
We keep reasonable security safeguards in place, as the Act requires, including:
- each business’s records kept apart at the database level;
- encryption in transit and at rest;
- personal logins with roles, and two-step login for administrators;
- a log of who viewed or changed records, kept for at least one year;
- nightly backups, with restores tested regularly.
Our staff can open a business’s records only to support it, when it asks, and every such access is logged. Everyone who works for us is bound by confidentiality. More detail is on our security page.
Sub-processors
You agree that we may use these companies to provide TailBridge. Each is bound by a contract that protects the data at least as well as this agreement.
| Company | What it does | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage and backups | India (Mumbai, with a backup copy in a second Indian region) |
| Meta Platforms (WhatsApp Business Platform) | Delivering reminders, bills and prescriptions on WhatsApp | India and other countries, as for any WhatsApp message |
| Razorpay | UPI and card payments, payment links and payouts to the business | India |
| Sentry | Error reports from the app, with personal details removed where possible | [region to confirm] |
We will tell the business at least 30 days before adding or replacing a sub-processor. If it objects for a reasonable data protection reason and we cannot address it, the business may end the service without charge for the rest of its notice period.
Where the data is kept
We store the business’s records, files and backups in India. Copies on the business’s own devices stay on those devices. WhatsApp messages pass through Meta’s systems, which may process them outside India. We will not move stored records outside India, and we follow any restriction the Government of India places on transfers to particular countries.
Requests from pet owners
If a pet owner asks us directly to see, correct or erase their data, or withdraws consent, we pass it to the business within 2 working days and do not answer for it unless it asks us to. TailBridge gives the business the tools to answer: a summary of a client’s data, correction, export and erasure. A STOP reply on WhatsApp stops that owner’s reminders within one working day.
Personal data breaches
If we become aware of a personal data breach affecting the business’s records, we will tell the business without delay, and in any case within 24 hours of confirming it. We will explain what happened, which data and people are affected, the likely consequences and what we are doing about it, and update the business as we learn more.
We will help the business inform the people affected and the Data Protection Board of India, including the detailed report the rules require within 72 hours.
Return and deletion
The business can export all its records in standard formats at any time, and for 90 days after the service ends. We then delete them; backups expire within a further 30 days. We keep only what the law requires us to, such as invoices we issued to the business, and protect it as this agreement describes until it is deleted. We confirm deletion in writing on request.
Information and audits
We will give the business the information it reasonably needs to show it meets the Act, including a description of our safeguards and any independent security reports we hold. Once a year, on 30 days’ written notice, the business or an auditor bound by confidentiality may review how we meet this agreement, at the business’s cost and without access to other businesses’ data.
General
This agreement lasts as long as we hold the business’s personal data. Each side’s liability under it follows the limits in our terms, except where the law does not allow a limit. Indian law governs it, and the courts at Hyderabad, Telangana have jurisdiction. A business that needs a signed copy can ask at privacy@tailbridge.in.