Privacy Policy

Scan ("Scan", "we", "us") is operated by Dial A Vet Pty Ltd (ABN 23 657 754 375) and provides the Scan canine visual wellness screening platform at scan.dialavet.com (the "Service"). This Privacy Policy describes what personal information we collect, how we use it, how we protect it, and what rights you have. By using the Service, you agree to the practices described below.

1. Information We Collect

1.1 Pet photographs

When you run a Scan wellness screening, you submit one or more photographs of your dog. These images are:

• Transmitted to our servers over TLS 1.2 or higher (encrypted in transit)
• Processed by our proprietary computer vision pipeline
• Stored in an access-controlled object store encrypted at rest using AES-256

Following processing, your images are anonymised and incorporated into our Canine Visual Wellness Database (the "Research Database") — a longitudinal dataset used to improve screening accuracy and advance preventative veterinary science. See Section 3 for full detail on how anonymisation works and what this means for your deletion rights.

1.2 Pet profile data

You may provide information about your dog including age, sex, breed, geographic climate zone, diet type, exercise frequency, hydration habits, and general wellness history. This information is used to calibrate your scan results and, in anonymised form, contributes to population-level wellness research.

1.3 Account and billing data

If you create an account or complete a purchase, we collect your email address and a payment token issued by our PCI-DSS Level 1 compliant payment processor, Stripe. We never receive, transmit, or store full card numbers, CVV codes, or raw banking credentials.

1.4 Technical and usage data

We automatically collect device type, operating system, browser version, referring URL, IP address (truncated after 30 days to prevent re-identification), and aggregated usage events. This data is used solely to operate, secure, and improve the Service. It is never used for advertising profiling.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver your screening results — generating your Scan Score, tiered wellness indicators, and accompanying report
• To facilitate your telehealth consultation — routing your results summary to our triage team where you have requested a follow-up
• To communicate with you — delivering your report, receipts, and service updates you have opted into
• To build and improve our Research Database — training and validating our computer vision models using anonymised canine wellness data to improve screening accuracy over time
• To conduct and publish veterinary research — contributing to peer-reviewed preventative veterinary science using aggregated, anonymised population data
• To detect and prevent fraud and abuse — protecting the integrity and security of the Service
• To comply with legal obligations — responding to lawful requests from regulatory authorities and meeting our obligations under applicable law

We do not use your data for behavioural advertising, third-party profiling, or any purpose not listed above.

3. Anonymisation, Research Use, and the Research Database

3.1 How anonymisation works

Before any data is added to our Research Database, we apply a multi-stage de-identification process:

• All direct identifiers (name, email address, account ID, IP address) are permanently severed from the image and pet profile data
• Location data is generalised to climate zone level only
• Breed, age, and sex are retained as anonymised categorical variables for research validity
• Images are processed to remove any metadata (EXIF data including GPS coordinates, device identifiers, and timestamps)

Following this process, what remains is visual wellness data — pixel-level structural information about the assessed body areas — paired with anonymised calibration inputs. This residual data cannot reasonably be used to identify you or your pet.

3.2 Research Database retention

Anonymised data incorporated into the Research Database is retained indefinitely. This is necessary to maintain the longitudinal integrity of the dataset, which improves in scientific value over time as population health trends emerge. Because this data is fully anonymised and cannot be linked back to you or your pet, it falls outside the scope of individual deletion rights under the Australian Privacy Act 1988, UK GDPR, EU GDPR, and CCPA.

3.3 Your identifiable data

Your personal account data, email address, billing records, and any scan results linked to your account are retained only for as long as your account is active, plus any period required by law (typically 7 years for financial records under Australian law). This data is fully subject to your deletion rights under Section 7.

3.4 Research opt-out

If you do not wish your anonymised scan data to be used for model training or research purposes, you may email us at privacy@dialavet.com.au with the subject line "Research Opt-Out" before your scan is processed. We will exclude your submission from the Research Database. Note that once anonymisation has been completed and data incorporated into the database, individual extraction is not technically feasible.

4. What We Never Do

We operate under the following absolute restrictions:

• We never sell, rent, or trade your personal data or identifiable imagery to any third party
• We never share identifiable photographs with advertisers, data brokers, or marketing platforms
• We never use your data for third-party behavioural advertising or retargeting
• We never publish identifiable imagery of you or your pet without explicit, written, revocable consent
• We never attempt to re-identify anonymised data or link it back to individual users
• We never transmit raw card numbers, banking credentials, or sensitive payment data — all payment processing is handled entirely by Stripe

5. Data Retention Summary

6. Sub-Processors

We use the following vetted sub-processors to deliver the Service. Each is bound by a Data Processing Agreement and may only process your data as directed by us:

Where sub-processors are located outside Australia, we rely on Standard Contractual Clauses or equivalent safeguards as described in Section 8.

7. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Deletion — request that your identifiable personal data be deleted (see Section 3.2 for Research Database limitations)
• Portability — request your data in a structured, machine-readable format
• Restriction — request that we restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — withdraw consent at any time where processing is consent-based

To exercise any of these rights, including requesting deletion of your personal data, email us at privacy@dialavet.com.au. Please include your account email address and the nature of your request. We will respond within 30 days. We may need to verify your identity before actioning your request.

Applicable jurisdictions include but are not limited to: Australia (Privacy Act 1988), United Kingdom (UK GDPR), European Economic Area (EU GDPR), California (CCPA/CPRA), Singapore (PDPA), and Canada (PIPEDA).

8. International Data Transfers

Our primary infrastructure is hosted in AWS ap-southeast-2 (Sydney, Australia). Where data is transferred to sub-processors located outside Australia — including the United States — we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK International Data Transfer Agreement (IDTA) where applicable
• Binding Corporate Rules or equivalent mechanisms where SCCs are not available

We conduct periodic reviews of our sub-processors' compliance with these transfer mechanisms.

9. Security

We implement technical and organisational measures appropriate to the risk presented by our processing activities, including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for all data at rest
• Role-based access controls limiting staff access to personal data
• Regular penetration testing and vulnerability assessments
• ISO 27001-aligned information security management practices
• Incident response procedures with mandatory breach notification timelines

In the event of a data breach affecting your personal information, we will notify you and relevant regulatory authorities as required by applicable law.

10. Children

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has submitted data through the Service, please contact us at privacy@dialavet.com.au and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. Material changes will be notified by email to registered users and posted here with a revised "Last updated" date at least 14 days before taking effect. Your continued use of the Service after that date constitutes acceptance of the updated policy.

12. Contact and Complaints

For any privacy-related questions, requests, or concerns:

Dial A Vet Pty Ltd — Privacy
privacy@dialavet.com
support@dialavet.com.au

If you are located in Australia and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in the UK, you may contact the Information Commissioner's Office (ICO) at ico.org.uk.