This Privacy Policy describes how Laudin AI ("the platform") handles personal data related to the creation and delivery of veterinary reports. The platform operates globally and seeks compliance with the data protection laws applicable in each jurisdiction — in particular Brazil's Lei Geral de Proteção de Dados (LGPD - Law 13.709/2018), the European Union/EEA General Data Protection Regulation (GDPR - EU 2016/679), and applicable U.S. state privacy laws. Jurisdiction-specific notices are in section 10.
1. CONTROLLER AND PROCESSOR
The veterinary clinic using the platform is the data controller for tutor and patient data. Laudin AI acts as a data processor, handling data under the clinic's instructions. For EU/EEA residents, the clinic or Laudin AI will designate an EU representative where applicable. For clinic account data used in the customer base record (section 3), Zoee AI LTDA. is the controller.
2. DATA COLLECTED
We collect personal data (name, contact), animal identification (species, breed, age), exam images and clinical report text. On the tutor portal, we also collect IP and user-agent at the time of consent, for auditing purposes.
3. PURPOSE AND LEGAL BASIS
Data is processed exclusively for: (a) generating and delivering the veterinary report; (b) clinical communication between clinic and tutor; (c) compliance with legal and regulatory obligations of veterinary practice; (d) Zoee AI's customer base record. The legal basis for processing varies by jurisdiction (see section 10): performance of a contract and consent, compliance with a legal obligation, and legitimate interests, subject to the specific requirements for sensitive/health data.
Customer base record: we record which clinics subscribed to Laudin AI and when they activated, paid for and closed their account, for company metrics and reports. The data is the account name, product, plan, country and dates. The legal basis is legitimate interests (LGPD, art. 7, IX; GDPR, art. 6(1)(f)).
4. SHARING AND SUB-PROCESSORS
We do not share data with third parties, except: (a) infrastructure and service providers under data processing agreements — Supabase (database, authentication and storage), Hostinger (hosting and image PACS), Cloudflare R2 (image backup), OpenRouter/Anthropic (artificial intelligence), OpenRouter/Google (voice dictation transcription, when the clinic turns the feature on), ZapSign (electronic signature), Resend (email delivery), Google (maps/addresses), Sentry (error monitoring), Stripe (clinic payments) and Cloudflare Workers and D1 (customer base record); (b) when required by law; (c) in an investment, merger or acquisition: investors only see aggregate figures about the customer base, without identifying any account; the list of accounts is only shown during an investment, merger or acquisition review (due diligence), under a confidentiality commitment; and if Zoee AI LTDA. is merged, sold or acquired, the data passes to the successor company, which is bound by this Policy. An up-to-date list of sub-processors is maintained by the platform.
5. INTERNATIONAL DATA TRANSFERS
The platform's primary database (Supabase, on AWS) is hosted in the United States, which is an international transfer for data subjects in other countries. The application and the image PACS (Hostinger) are also hosted in the United States, in Boston. Some sub-processors handle data outside the country of origin (United States and European Union) — for example, image (DICOM) backups are stored in the European Union (Cloudflare R2, Frankfurt). The customer base record is kept on Cloudflare (Workers and D1), in the United States, and does not receive email, phone, document, report or tutor data. These international transfers are covered by contractual safeguards, including Standard Contractual Clauses (SCCs) and equivalent mechanisms provided for under applicable law.
6. USE OF ARTIFICIAL INTELLIGENCE
The platform uses artificial intelligence models (Claude, by Anthropic) to assist in generating and reviewing reports. When the clinic turns on voice dictation, the audio recorded by the veterinarian is transcribed by a Google model (Gemini), with zero data retention at the provider; the audio is not stored by the platform. Input data is not used by the AI provider for model training.
7. NO MODEL TRAINING
We do not use platform data, including exam images and reports, to train artificial intelligence models, whether our own or third parties'.
8. YOUR RIGHTS
You may, at any time, request from the responsible veterinary clinic: access to your data, correction, deletion, anonymization, portability, or revocation of consent. Depending on your jurisdiction, additional rights may apply (see section 10), such as the right to object to processing, not to be subject to automated decisions, to lodge a complaint with a supervisory authority, and to opt out of the "sale" or sharing of data. Requests about the customer base record (section 3), for which Zoee AI LTDA. is the controller, are made directly to Zoee AI LTDA., by email at hello@zoee.ai.
9. RETENTION
Clinical data is retained for the period required by veterinary legislation. Consent audit data is retained for the applicable statutory period. The customer base record is kept with no time limit, including after the contract ends, because it is Zoee AI's business record; when the person who owns the account asks for deletion, the name is removed and only the product, plan, country and dates remain.
10. JURISDICTION-SPECIFIC NOTICES
(a) Brazil (LGPD - Law 13.709/2018): processing relies on the legal bases of articles 7 and 11 (consent, performance of a contract, compliance with a legal obligation, and protection of health) and, for the customer base record, on legitimate interests (article 7, IX). Data subjects have the rights under article 18 and may petition the National Data Protection Authority (ANPD).
(b) European Union/EEA (GDPR - EU 2016/679): processing relies on article 6 (consent, contract, legal obligation, legitimate interests) and, for health data, on article 9. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the supervisory authority of your Member State. International transfers use SCCs (see section 5). Data Protection Officer (DPO) contact: [to be defined].
(c) United States: under applicable state laws (for example, the California Consumer Privacy Act/CPRA), you may have the right to know, access, correct and delete personal data, and to opt out of the "sale" or sharing of data. Laudin AI does not sell personal data. There is no discrimination for exercising these rights.
11. CONTACT AND DATA PROTECTION OFFICER (DPO)
For questions, please contact the veterinary clinic responsible for your appointment. For platform-related questions or questions about this policy, contact Laudin AI. DPO: [to be defined].
Last updated: November 2026.Privacy policy