Privacy Policy
Last updated: May 21, 2026
Summary (Plain Language)
We collect your email, name, pet name, and pet photos to provide the health triage service. Photos are processed by AI and are not stored permanently. We do not sell your data. You have full control over your data and can request deletion at any time. We comply with EU GDPR.
1. Data Controller
PawsAI Health ("we", "us", "our") is the data controller responsible for your personal data.
Contact: Pawsaihealth@gmail.com
For EU/EEA users, you may also contact us regarding data protection matters at the above email.
2. Data We Collect
We collect and process the following personal data:
•
Email address — used for authentication and account management
•
Display name and pet name — used to personalise your experience
•
Pet photos — uploaded by you, sent to our AI model for analysis, not stored permanently after analysis
•
Scan results — triage level, AI-generated summary, questions and answers, stored in your account history
•
Device/usage data — anonymous analytics (page views, feature usage) via privacy-compliant tools
•
Referral codes — if you use or generate a referral link
3. Legal Basis for Processing (GDPR Art. 6)
We process your data on the following legal bases:
•
Performance of a contract (Art. 6(1)(b)): Processing your photos and returning triage results is necessary to deliver the service you requested.
•
Legitimate interests (Art. 6(1)(f)): Fraud prevention, service security.
•
Consent (Art. 6(1)(a)): Analytics cookies (PostHog) and advertising cookies (Google AdSense) — each requires your explicit opt-in via the cookie consent banner.
4. How We Use Your Data
•
To provide AI-powered pet health triage assessments
•
To maintain your scan history and account profile
•
To manage your subscription and free scan quota
•
To process referrals and grant bonus scans
•
To improve the service through aggregate, anonymised analytics
•
To communicate important service updates (not marketing without consent)
5. Pet Photos — Special Note
Your pet photos are the most sensitive data we handle. Here is exactly what happens:
•
Photos are compressed and converted to base64 on your device before upload
•
Compressed photos are stored in our secure cloud storage (Supabase) so you can view past scans
•
Photos are transmitted to Anthropic's Claude AI API for visual analysis
•
Anthropic does not retain your photos for AI training purposes under their API terms
•
Photos in cloud storage are deleted when you delete your account
6. Data Retention
•
Account data: when you delete your account via Settings, your profile, pets, and scan history are soft-deleted immediately. Hard deletion occurs after a 30-day grace period, during which you may contact support@pawsai.health to cancel.
•
Scan history and photos in storage: retained for 12 months from the date of account deletion, then permanently removed. Scans are inaccessible to you from the moment of deletion.
•
Individual pet records: soft-deleted immediately on removal; permanently purged after 30 days.
•
Authentication logs: 30 days
7. Third-Party Processors
We use the following sub-processors:
•
Supabase Inc. — database, authentication, and file storage. Data processed in EU regions where available. Data Processing Agreement (DPA) in place.
•
Anthropic PBC — AI image and text analysis. API usage terms prohibit training on your data. Data is not retained after processing.
•
Vercel Inc. — web application hosting. Processes request metadata (IP, user agent).
We do not sell, rent, or share your personal data with advertisers or unrelated third parties.
8. Cookies and Tracking
We use a cookie consent banner on first visit to this website. You can accept or reject non-essential cookies at that time, and change your preferences anytime via the "Cookie preferences" link in the footer or in Settings.
Essential cookies (always active, no consent required):
•
Supabase session cookies (sb-*) — keep you signed in. Legal basis: legitimate interest for service delivery. Duration: up to 7 days.
•
Consent preference storage (pawsai-consent-v1) — remembers your cookie choice so the banner does not reappear. Duration: persists until cleared.
Analytics cookies (require consent):
•
PostHog (ph_*, posthog-*) — privacy-focused product analytics. Purpose: understand how features are used so we can improve the service. Data collected: page views, feature interactions, errors, and your user ID after sign-in (IP addresses are not collected). Provider: PostHog Inc. (posthog.com). Retention: 1 year (PostHog default). Legal basis: consent (GDPR Art. 6(1)(a)). Data transferred to PostHog in the United States is protected by Standard Contractual Clauses approved by the EU Commission and by PostHog's self-certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions). PostHog does not sell your data. You can review PostHog's Data Processing Agreement at https://posthog.com/dpa.
Advertising cookies (require consent, currently paused):
•
Google AdSense — we plan to show relevant ads via AdSense to keep the service free. AdSense cookies are not currently loaded. When advertising is active, Google's cookie policy will apply. Legal basis: consent (GDPR Art. 6(1)(a)). You will be prompted before advertising cookies are introduced.
PostHog analytics are only initialised after you grant analytics consent. If you reject analytics, no PostHog scripts are loaded and no usage data is sent.
Session cookies expire when you close your browser or after 7 days of inactivity.
9. Your Rights Under GDPR
If you are in the EU/EEA, you have the following rights:
•
Right of access (Art. 15): Request a copy of all data we hold about you
•
Right to rectification (Art. 16): Correct inaccurate data via Settings → Edit profile
•
Right to erasure (Art. 17): Request deletion of your account and all associated data
•
Right to data portability (Art. 20): Request your data in a machine-readable format
•
Right to object (Art. 21): Object to processing based on legitimate interests
•
Right to restrict processing (Art. 18): Request we limit how we use your data
•
Right to withdraw consent (Art. 7(3)): Where processing is based on consent (e.g. analytics cookies), you may withdraw at any time via the "Cookie preferences" link without affecting the lawfulness of prior processing
To exercise any of these rights, email: Pawsaihealth@gmail.com. We will respond within 30 days.
10. International Transfers
Some of our processors (Anthropic, Vercel, Supabase Inc.) are based in or may process data in the United States. Where we transfer data outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection.
11. Children's Privacy
PawsAI Health is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact Pawsaihealth@gmail.com and we will promptly delete it.
12. Supervisory Authority
If you are in the EU/EEA and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local Data Protection Authority (DPA). A list of EU DPAs is available at: ec.europa.eu/justice/data-protection/bodies/authorities
13. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via email or an in-app notice at least 30 days before they take effect. Continued use of the service after the effective date constitutes acceptance.
14. Contact Us
For privacy-related questions or to exercise your rights:
Email: Pawsaihealth@gmail.com
Response time: within 30 days