Privacy Policy

1. Data controller

1. The controller of your personal data is Mateusz Stopinski, running a sole proprietorship under the business name Mateusz Stopinski, Dobieszewice 7a, 88-170 Pakość, NIP 5562821087, REGON 544391580 (hereinafter: we, the Controller).
2. In all matters concerning personal data you can write to [email protected] or to the correspondence address given above, or call +48 574 386 150. We have not appointed a data protection officer, as we are not required to do so.
3. The Policy applies to the VetLek app - in the browser (app.vetlek.pet), for Android from the website vetlek.pet and from Google Play and for the iPhone (iOS) from the App Store - as well as to the e-mails we send. The forms on the website vetlek.pet are described in a separate document: the Website Privacy Rules (vetlek.pet/prywatnosc).
4. Terms used: GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation); App, Account, Basic Access, Full Access, Partner - as defined in the Terms of Service of the VetLek App.

2. Key points in brief

1. We transfer your data to Partners, i.e. veterinary companies, only with your express consent, given separately for each company and purpose; the Partner pays us for each request transferred. Without your consent we do not transfer your data to anyone for that party’s marketing purposes.
2. Patient data that you enter into the tools remain on your device and do not reach our server.
3. We do not use external analytics, advertising or tracking tools and we do not use the device’s advertising identifier.
4. You can download, change and delete your data yourself in the App’s Settings.
5. You may at any time object to the processing of your data on the basis of our legitimate interest, including the matching of advertisements to your profile (Settings → Ads) - details in point 8.2.
6. The App is free of charge: we do not accept payments from you and we do not process payment card data.

3. Purposes, legal bases and retention period of data

1. The Account and the provision of the App’s services (logging in, Basic Access and Full Access, saving data for work without the internet, the device limit). Data: e-mail address; password - we store only its cryptographic hash (scrypt with a random salt); first name and surname, profession and type of workplace (required); name of workplace, town and species treated (optional); sessions (hash of the session identifier, browser type, dates of login and of last activity); the days on which you use the App; products opened with Basic Access; requests for Full Access (“Ask for access”) - their content, date and status; the number of full SmPC texts read. Legal basis: art. 6(1)(b) GDPR (performance of a contract). We process the source of information about VetLek (optional) on the basis of art. 6(1)(f) GDPR (our legitimate interest - assessing where users learn about the App). Retention period: until the Account is deleted; sessions - until logout or expiry of the session; SmPC reading counters - 90 days.
2. Confirmation of the licence to practise number (PWZ) or of student status (Full Access, offers and advertisements for veterinarians). Data: PWZ number, first name and surname as they appear in the register, your declaration that the number belongs to you, the result and date of the check; university e-mail address. We compare the PWZ number manually with the publicly available register of veterinarians maintained by the competent veterinary chamber (the result of the check comes from this source) and check it again every year, and we confirm the university address with a link sent to that address. Providing these data is voluntary. Legal basis: art. 6(1)(b) GDPR (verification at your request, in connection with the contract - Full Access) and art. 6(1)(f) GDPR (our legitimate interest - directing advertisements and offers of prescription-only veterinary medicinal products exclusively to veterinarians, as required by art. 120 of Regulation (EU) 2019/6). Retention period: until the Account is deleted or until these data are deleted at your request sent to [email protected] (the declaration concerning the PWZ number - as in point 3.4); the confirmation is valid for 12 months.
3. Past payments. Records of payments made in the past, if any, are kept - on the basis of art. 6(1)(c) GDPR - for as long as accounting and tax law requires, also after the Account is deleted.
4. Proof of acceptance of the Terms, of the “Important before use” rules and of other declarations, and of the giving and withdrawal of consents. Data: date and time, version and cryptographic hash of the content of the document or declaration, IP address and information about the browser. We do not modify these entries. Legal basis: art. 6(1)(f) GDPR (our legitimate interest - demonstrating the conclusion of the contract and the giving of consents, and defence against claims) and art. 7(1) GDPR. Retention period: until the Account is deleted, and after its deletion - together with the Account’s e-mail address: the record of acceptance of the Terms and of the “Important before use” rules - until 31 December of the sixth year after the year in which the Account was deleted (defence against claims related to the use of dosing information, which may arise after the use of the App has ended); the declaration made before a past purchase of access (where the Account has ever paid for access) and consents to the transfer of data to a Partner that has received the data - until 31 December of the sixth year after the year in which they were made or given.
5. Security of the App and protection against abuse (limits on login attempts and other actions, protection of the database against copying). Data: IP address - processed in the server’s memory, without being recorded in the database; a hash (HMAC) of the IP address of a person who is not logged in - for the daily limits on ad impressions on the login screen; web server logs (IP address, date and time, requested URL, response code, browser); the number of full SmPC texts read. Legal basis: art. 6(1)(f) GDPR (our legitimate interest - security of the services and protection of the database). Retention period: limits in the server’s memory - up to a few hours; IP address hashes - about 2 days; web server logs - 14 days; reading counters - 90 days.
6. Service-related e-mails: confirmation of the address, password reset, change of e-mail address (including a notification to the previous address), the result of the check of the PWZ number and the reply to a request for Full Access, deletion of the Account, replies to reports and questions, decisions on proposed corrections, a reminder you have requested about a training course; at your request - a weekly e-mail with changes in SmPCs, which you can switch off in the App (SmPC changes) or with one click on the “Unsubscribe” link in each such e-mail. The weekly e-mail contains one labelled sponsored message (“Sponsor of this issue”) - you give your consent to it by switching this e-mail on and withdraw it by switching the e-mail off. Legal basis: art. 6(1)(b) GDPR; we send the sponsored message with your consent required by art. 398 of the Act of 12 July 2024 - Electronic Communications Law (Prawo komunikacji elektronicznej), and we record the giving and withdrawal of that consent (point 3.4). Retention period: until the Account is deleted.
7. Messages about VetLek news and messages from VetLek Partners (offers and training courses of veterinary companies, no more than 2 per month). Data: e-mail address, first name and surname, professional group and species treated (for selecting recipients), information about the messages sent; clicks on links are counted anonymously. Messages from Partners are sent by us - the companies do not receive your address. Legal basis: your consent (art. 6(1)(a) GDPR), also required by art. 398 of the Electronic Communications Law. You can withdraw consent at any time in Settings (Account details; My requests and consents) or via the link in each message. Retention period: until consent is withdrawn; information about the messages sent - 12 months.
8. Selection of advertisements in the App and their measurement. Data: professional group resulting from the profile and from the confirmation of the PWZ or of student status (veterinarian with a confirmed PWZ, veterinarian, technician, student, other), type of workplace and species treated from the profile; daily counters of the impressions and clicks of each advertisement, kept for your Account (linked to the Account) - used to count impressions and clicks and to limit how often advertisements are shown; they also operate after an objection. The screen context - patient species, product type, product being viewed - is matched by your device; we do not send it to the server for the purpose of selecting advertisements. Impressions, clicks and reach are counted in aggregate, per campaign and professional group, without any identifier of a person or device; Partners receive only such aggregate statistics. The matching of advertisements to the profile is profiling which does not produce legal effects concerning you or similarly significantly affect you. Legal basis: art. 6(1)(f) GDPR (our legitimate interest - financing the App through advertisements tailored to professional audiences). You may at any time object to the matching of advertisements to your profile by switching it off in Settings → Ads - you will then see only advertisements addressed to all users, and your impressions will be assigned to the “unspecified” group. Retention period: profile data - until the Account is deleted; daily counters - about 2 days; aggregate statistics - without data identifying individuals.
9. Aggregate statistics for Partners (the number of active Accounts in professional groups, by type of workplace and species treated; groups of fewer than 5 persons are shown as “fewer than 5”). Legal basis: art. 6(1)(f) GDPR (our legitimate interest - acquiring Partners). After you switch off ad matching in Settings → Ads, your Account is not counted in these statistics; you can also submit an objection to [email protected]. Retention period: the statistics do not contain data identifying individuals.
10. Reports of advertisements and of illegal content. Data: the advertisement, the reason for and the content of the report, the reporting person’s Account. Legal basis: art. 6(1)(c) GDPR in conjunction with art. 16 of Regulation (EU) 2022/2065 (Digital Services Act). Retention period: until the Account is deleted; after that, the report remains without a link to the Account.
11. Transfer of data to a Partner at your request (sample, contact with a representative, training course). Data that you see before sending: first name and surname, profession and information on whether the PWZ is confirmed (without the number), type and name of workplace, town, e-mail address, telephone number - if you provide it - and a request for a reminder about a training course. We transfer them to the company in a list that we send to it ourselves; from that moment the company is a separate controller of these data and is responsible for their further processing. For each request transferred, the company pays us an agreed fee. Legal basis: your consent (art. 6(1)(a) GDPR), separate for each company and purpose. You can withdraw consent at any time in Settings → My requests and consents; withdrawal does not affect the lawfulness of a transfer made earlier. If you withdraw consent before the transfer, we delete the data immediately; if after the transfer - we instruct the company to delete them. Retention period: until consent is withdrawn, and after transfer to the company - 12 months; after that only the information needed for settlement with the company remains, without personal data.
12. Error reports, questions (Write to us) and proposed corrections. Data: the content, the product concerned, contact details (for a question - the Account’s e-mail address) and the technical information needed to reproduce the problem: App screen, database version, operating mode, window size and browser type. Legal basis: art. 6(1)(b) GDPR (handling of reports) and art. 6(1)(f) GDPR (our legitimate interest - correctness of the Content). Retention period: until the Account is deleted; after that, reports and accepted corrections remain in the database without the author’s e-mail address, first name and surname and contact details (in the database change history, only the number of the deleted Account, which we never reassign, remains with an accepted correction).
13. The “Sprawdzaj” (“Check”) programme (if available for the Account). Data: answers and corrections of dosings pointed out, the number of answers per day, the answer reliability score (how far the answers to control questions conform with the SmPC) and information on a suspension of participation in the programme. We award no points or rewards for answers and publish no ranking of participants. Legal basis: art. 6(1)(b) GDPR. Retention period: until the Account is deleted.
14. Establishment, exercise and defence of legal claims - data from the points above, to the extent necessary. Legal basis: art. 6(1)(f) GDPR. Retention period: until the limitation periods for the claims expire.
15. Database backups - for the purpose of restoring data after a failure. Legal basis: art. 6(1)(f) GDPR and art. 32 GDPR. Retention period: on the server, daily backups - 14 days, and monthly backups - 6 months; on the Controller’s secured computer - the 30 most recent backups (about one month). Data deleted from the database disappear from the backups no later than after this time.
16. E-mail correspondence, complaints, statements of withdrawal from the contract, notices of illegal content and requests concerning personal data. Data: e-mail address and other data provided in the message, the content of the correspondence, our reply. Legal basis: art. 6(1)(b) GDPR (complaints and withdrawal from the contract), art. 6(1)(c) GDPR (obligations under the Consumer Rights Act (ustawa o prawach konsumenta), the Digital Services Act and the GDPR) and art. 6(1)(f) GDPR (our legitimate interest - replying to other messages). Retention period: complaints, statements of withdrawal from the contract and requests concerning data - until 31 December of the sixth year after the year in which the matter was closed; other correspondence - 2 years from the closure of the matter.
17. Delivery of e-mails. Data: recipient’s address, type of message, time and result of sending - without the content of the message, which we delete immediately after sending; if the e-mail sending provider informs us that the address permanently does not accept messages or that the recipient has marked our message as spam - a cryptographic hash of the address (without the address itself), so that we do not send further messages to it. Such marking of the weekly e-mail with changes in SmPCs or of a message from a Partner switches off that type of message, and we treat it as a withdrawal of consent (we record it like other withdrawals - point 3.4); service-related messages (point 3.6) continue to be sent, unless the address permanently does not accept them. Messages with changes in SmPCs and messages from Partners that are waiting to be sent are not sent to a person who has opted out of them in the meantime. Legal basis: art. 6(1)(f) GDPR (our legitimate interest - delivering messages, investigating complaints about their non-delivery and protecting our domain against sending to addresses that do not want it). Retention period: we keep the sending log for 30 days, also after the Account is deleted - as regards the message confirming the deletion and messages sent earlier to the Account’s previous e-mail address; the address hash - 3 years from the last rejection or report, or for a shorter time if you confirm this address again in the App.

4. What remains after the Account is deleted

1. Deletion of the Account erases the Account data, the profile, sessions, consents to messages, requests for Full Access, answers in the “Sprawdzaj” programme and usage history. We send a confirmation of the deletion to the Account’s e-mail address.
2. The following remain: records of past payments, if any (point 3.3) - without a link to the Account; the record of acceptance of the Terms and of the “Important before use” rules - until the end of the sixth year after the year in which the Account was deleted, the declaration made before a past purchase of access and consents to the transfer of data to a Partner that has received the data (point 3.4); the data of a request already transferred to a company - until they are deleted on our instruction, or for 12 months (point 3.11); reports, proposed corrections and reports of advertisements - without the author’s e-mail address, first name and surname and contact details (in the database change history, only the number of the deleted Account, which we never reassign, remains with an accepted correction); a cryptographic hash of the e-mail address together with the number of products opened with Basic Access, so that re-registration does not give a new limit of 10 products - for 3 years from the deletion of the Account, on the basis of our legitimate interest in preventing abuse (art. 6(1)(f) GDPR); entries in the admin activity log concerning the Account - 12 months; the log of sending the message confirming the deletion and of messages sent earlier to the Account’s previous e-mail address - 30 days, and the hash of an address that did not accept messages or reported them as spam - 3 years (point 3.17); data in backups - up to 6 months (point 3.15).

5. Data on your device and cookies

1. The App saves in the storage of your device (the storage of the browser or of the Android or iOS app: localStorage, IndexedDB and cache) data necessary for its operation: the downloaded product database and saved SmPC texts; patient data and calculation history entered into the tools; favourite and recently opened products; settings; a copy of the Account data which allows the App to start without the internet for up to 30 days; unsent reports; the list of advertisements with their images, information about advertisements you have hidden, a queue of events for the aggregate ad counters and the time of the last advertisement at launch.
2. The App in the browser uses one cookie - vl_session - which keeps you logged in (HttpOnly, Secure, SameSite=Lax). With the “Remember me” option it expires after 90 days without use of the App, and without that option - when the browser is closed (the session on the server expires after 24 hours at the latest). Instead of a cookie, the Android app and the iOS app store the session token in their own storage on the device. Cloudflare, through which traffic to the App passes, may set a technical cookie used solely for protection against attacks and automated traffic (e.g. __cf_bm); it is not used for tracking or advertising.
3. Storing the information described in paragraphs 1 and 2 on the device and accessing it are necessary to provide the service you use - including for displaying advertisements in the manner described in the Terms (§ 9), without a device identifier - and therefore, in accordance with art. 399 of the Electronic Communications Law, they do not require your consent. We do not use cookies or other tracking technologies of third parties.
4. Logging out removes from the device the product database, saved SmPC texts, patient data, calculation history, favourites, the copy of the Account data, unsent reports and advertisement data. The App settings, the number of the last logged-in Account and - until another Account is logged in on that device - saved anaesthesia protocols remain. You can also delete all data in the settings of your browser or phone.
5. Notifications about new SmPC versions of favourite and recently opened products require your consent in the browser. They are created by your device - the server does not store any data for them.

6. Recipients of data

1. The following process data on our behalf, on the basis of data processing agreements: OVH SAS (France) - the server on which the App and our e-mail run (including the [email protected] mailbox and the sending of e-mails from the App), in a data centre in France; Cloudflare, Inc. (USA) - protection and acceleration of the connections through which traffic to the App passes; Amazon Web Services EMEA SARL (Luxembourg) - sending of e-mails from the App (Amazon SES) from servers in the European Union (Stockholm, Sweden); entities providing us with accounting, legal and IT services - to the extent necessary.
2. The following receive data as separate controllers: Partners - only with your consent (point 3.11); public authorities - where an obligation to provide the data to them arises from the law.
3. The Android app from Google Play and the iOS app from the App Store are distributed by Google Ireland Limited (Ireland) and Apple Distribution International Ltd. (Ireland). They process the data related to downloading and updating the app from the store (e.g. your Google or Apple account) as separate controllers, under their own privacy policies; we do not transfer to them any data from your VetLek Account.
4. Without your consent we do not make your data available to other entities for their own purposes, in particular marketing purposes. For requests transferred to Partners at your request (point 3.11), Partners pay us an agreed fee.

7. Transfers of data outside the European Economic Area

1. Cloudflare, Amazon Web Services, Google and Apple may also process data in the United States. The transfer takes place on the basis of the European Commission’s decision finding an adequate level of data protection under the EU-U.S. Data Privacy Framework - in respect of certified entities - or on the basis of standard contractual clauses adopted by the European Commission. You can obtain a copy of the safeguards applied by writing to [email protected].

8. Your rights

1. You have the right of access to your data and to obtain a copy of them (art. 15 GDPR) - Settings → Account details, password, logging out → Download my data (data that are not in the file, e.g. the days of using the App, will be provided upon a request sent by e-mail); the right to rectification of data (art. 16 GDPR) - in Settings or by e-mail; the right to erasure of data (art. 17 GDPR) - by deleting the Account or by e-mail; the right to restriction of processing (art. 18 GDPR); the right to data portability (art. 20 GDPR) - a file with your data in JSON format.
2. Right to object (art. 21 GDPR). You may at any time object to the processing of your data for direct marketing purposes, including the matching of advertisements to your profile (point 3.8) - most simply by switching off the matching in Settings → Ads or by writing to [email protected]; after you object, we no longer use your data for that purpose. You may also, on grounds relating to your particular situation, object to other processing based on our legitimate interest (points 3.1 as regards the source of information about VetLek, 3.2, 3.4, 3.5, 3.9, 3.12, 3.14, 3.15, 3.16 and 3.17); we will then stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.
3. You may withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal: messages about news - in Settings → Account details; messages from Partners and the transfer of data to companies - in Settings → My requests and consents; the sponsored message in the weekly e-mail - by switching that e-mail off in the App (SmPC changes) or via the “Unsubscribe” link in each such e-mail.
4. We respond to a request without undue delay, and at the latest within one month of its receipt; in particularly complex cases this time limit may be extended by a further two months, of which we will inform you. We may ask you to confirm your identity - a message sent from the Account’s e-mail address is usually sufficient.
5. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO; ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

9. Do you have to provide data

1. Providing your e-mail address, password, first name and surname, profession and type of workplace is a condition for creating an Account and using the App. Other data are voluntary: without a PWZ number or a university address you will not get Full Access (unless we grant it at your request), and without the data required in a Partner’s offer - from that offer.

10. Automated decisions

1. We do not take decisions concerning you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR). PWZ numbers, reports, proposed corrections and decisions on blocking an Account are reviewed by a human. The following operate automatically: limits protecting against abuse (e.g. the daily limit on reading SmPC texts, the device limit, the limit of 10 products with Basic Access); the selection of advertisements described in point 3.8; in the “Sprawdzaj” programme - the calculation of the answer reliability score on the basis of control questions, on which the daily answer limit and the weight of the vote depend, and the temporary suspension of participation in the programme in the case of answers that are too fast or do not conform with the SmPC. You can challenge such an outcome by writing to [email protected] - a human will review it.

11. Data security

1. We apply technical and organisational measures appropriate to the risk, in particular: encryption of connections (HTTPS); storing passwords, session tokens and one-time links only in the form of cryptographic hashes; two-step login to the admin panel and an activity log in that panel; restricted access to the server; daily backups with verification of their integrity.

12. Changes to the Privacy Policy

1. We update the Policy when the way data are processed or the law changes. We inform you of material changes in the App. The current version is always available in the App and on the website vetlek.pet/polityka-prywatnosci.