Pet Care Alliance

TEMPLATE: have a lawyer review before launch. This text is a starting point, not legal advice.

Data Processing Addendum

Last updated: [DATE]. Between [COMPANY LEGAL NAME, ADDRESS] ("Pet Care Alliance", "we") and the business that holds the Account ("you"). It forms part of the Terms of Service.

1. Who does what

You decide why and how your clients' and their pets' information is used. We process it for you, only to run the service. Under privacy laws that use these words, you are the controller or "business" and we are the processor or "service provider".

2. What we process

Your clients' names, contact details, addresses and access instructions; their pets' details, vaccine and health notes; visit, invoice and payment records; messages and photos; your team's details; and records of how the service is used (such as the audit log).

3. Our promises

We process the data only on your documented instructions: the Terms, this addendum and what you do in the service. If we think an instruction breaks the law we will tell you.
We do not sell the data, and we do not use it for advertising or for purposes other than providing the service to you.
Everyone at Pet Care Alliance who can reach the data is bound to keep it confidential.
We help you answer your clients' requests to see, correct, export or delete their data. The service has tools for this, and we will help with anything the tools do not cover.

4. Security

We protect the data with measures that include: each business's data kept separate from other businesses'; encryption in transit and encryption of sensitive fields at rest; sign-in protection with optional two-factor sign-in; role-based permissions; an audit log of sensitive actions; and regular backups. We review these measures as the service changes. [Lawyer and security lead: confirm this list matches what is true at launch.]

5. Other companies we use (subprocessors)

We use these companies to run the service: [Amazon Web Services (hosting, storage, email); Stripe (payments); Twilio (text messages); Google (maps and push notifications); Anthropic (the Ziggy assistant)]. [Confirm the list at launch.] We make sure each is bound by terms that protect the data to the same standard. We will tell you before we add or replace one, and you may object on reasonable grounds; if we cannot resolve it you may close your Account.

6. If something goes wrong

If we learn that the data has been accessed or lost without authority, we will tell the Account owner without undue delay, and aim to do so within 72 hours, with what we know and what we are doing about it. [Lawyer: confirm the commitment.]

7. International transfers

The data is stored in the United States. [Lawyer: add transfer terms if you accept customers outside the US.]

8. When you leave

You can export your data at any time. When the Account is closed we keep it for 30 days so you can change your mind, then permanently delete it, except records we must keep by law (such as our own billing records).

9. Checking on us

On reasonable request, and not more than once a year unless there has been a breach, we will give you the information you need to check that we meet this addendum. [Lawyer: audit rights.]

10. Everything else

The liability limits, governing law ([JURISDICTION]) and the other terms of the Terms of Service apply to this addendum. If the two conflict on how personal data is handled, this addendum wins. Questions: info@petcarealliance.com.