Privacy Policy

Cairn Pet Health LLC (“Cairn,” “we,” “us,” or “our”) provides software that helps pet owners and veterinary teams follow companion-animal health information between veterinary visits. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Cairn mobile application, veterinary-clinic dashboard, cairnpethealth.com, or other Cairn services that link to this Privacy Policy (collectively, the “Services”).

Cairn Pet Health LLC is a Colorado limited liability company. You may contact us at [email protected] or by mail at:

Cairn Pet Health LLC
1212 Country Acres Ct
Johnstown, CO 80534
United States

The Services are intended for adults age 18 or older and are currently offered for use in the United States.

This Privacy Policy describes Cairn’s current privacy practices. It is not a HIPAA Notice of Privacy Practices. Cairn provides veterinary software and does not provide human medical care.

At a glance

• Cairn does not sell personal information.
• Cairn does not use personal information for targeted or cross-context behavioral advertising.
• Cairn does not use advertising networks, advertising pixels, or advertising SDKs as part of the current Services.
• Cairn does not collect device GPS or precise geolocation.
• Pet and veterinary information used to provide the ordinary Cairn service remains associated with the relevant pet and owner and, where the pet is linked to one, the participating veterinary clinic.
• Research Data Contribution is optional and off by default. If enabled, a separate coded copy of eligible veterinary information may be used for research used to improve veterinary care.
• Turning Research Data Contribution off while your account is active deletes the corresponding Research Core information.
• If you delete your account while Research Data Contribution remains enabled, contributed Research Core information may remain after Cairn permanently removes the direct technical link between that research record and your Cairn account. If you want contributed Research Core information removed, turn off Research Data Contribution before deleting your account.
• You may contact [email protected] to exercise applicable privacy rights or appeal a privacy-rights decision.

1. Scope and our roles

This Privacy Policy applies to personal information processed through the Services, including information relating to pet owners, veterinary-clinic users, website visitors, and people who contact Cairn.

Cairn’s legal role depends on the processing activity.

Cairn generally determines the purposes and means of processing for activities such as owner account creation and administration, owner-direct customer support and Cairn’s own support administration, product analytics, Cairn’s own legal and compliance obligations, clinic subscription administration, Cairn-wide security and fraud-prevention activities that Cairn determines independently, and optional Research Data Contribution.

Some functions, such as security, troubleshooting, support, and reliability, may involve either Cairn’s independent processing or processing performed on behalf of a participating veterinary clinic depending on the purpose of the specific activity.

When a participating veterinary clinic uses Cairn to process information solely as part of the clinic’s veterinary relationship with an owner or pet, the clinic may determine the purposes of that processing and Cairn may process the information on the clinic’s behalf. Cairn and a veterinary clinic may therefore have different legal responsibilities for different processing activities involving the same account or pet.

Nothing in this Privacy Policy changes a veterinary clinic’s independent responsibilities for its veterinary records, professional obligations, or relationship with its clients.

2. Information we collect

We seek to limit collection to information that is adequate, relevant, and reasonably necessary for the purposes described in this Privacy Policy.

Depending on how you use Cairn, we may collect or process the following categories of information.

Account and contact information

This may include:

• first and last name;
• email address;
• optional phone number;
• account and authentication identifiers;
• account status; and
• information needed to authenticate or administer an account.

Passwords and authentication

Cairn uses Supabase Auth for account authentication.

A password may temporarily exist in device or browser memory while a user enters it and is transmitted to Supabase for authentication. Cairn’s application databases, analytics systems, and logs do not intentionally store plaintext account passwords.

Cairn stores or uses authentication sessions or tokens as needed to keep users signed in and operate authenticated features. Those tokens are different from a user’s plaintext password.

Veterinary-clinic and professional information

For clinic users, this may include:

• clinic name;
• staff name;
• staff email address;
• staff role and permissions;
• clinic membership information; and
• clinic subscription or billing status.

Pet profile information

This may include:

• pet name;
• species;
• breed;
• date of birth or estimated age;
• sex and reproductive status; and
• clinic relationships.

The current Cairn mobile application may allow a user to select or display a pet photo locally on the device. Cairn does not currently upload pet photos to Cairn’s servers.

Veterinary and longitudinal information

Depending on the features used, this may include:

• veterinary conditions;
• condition status or severity information;
• survey and check-in responses;
• calculated scores and longitudinal trends;
• weight;
• resting respiratory rate;
• seizure logs;
• good-day or difficult-day logs;
• medications, dose information, frequency, and dates;
• outcomes;
• owner-entered notes; and
• other structured observations submitted through Cairn.

Pet medical information concerns a companion animal rather than the human account holder. However, when pet information is associated with an identifiable owner, household, or clinic relationship, Cairn treats that association as privacy-relevant information and protects it accordingly.

Communications and support information

This may include:

• support-ticket subject and body;
• email communications;
• questions, feedback, and other correspondence; and
• information you choose to include when requesting support.

Technical, usage, and diagnostic information

This may include:

• application or browser events;
• screen-view events, such as recording that a user viewed a particular Cairn screen;
• device or authentication identifiers;
• push-notification tokens;
• product-usage information;
• crash and diagnostic information;
• security and audit information; and
• network information, including IP addresses that may be received by infrastructure providers as part of ordinary internet communications.

Cairn does not use PostHog to capture screenshots, visual screen contents, text displayed on the screen, touch targets, button labels, screen recordings, or session replay.

Cairn does not collect device GPS coordinates or request iOS or Android precise- or coarse-location permissions. Infrastructure providers such as Supabase or Cloudflare may receive IP addresses as part of ordinary network requests and may infer an approximate network location from those requests for infrastructure, security, or related service purposes.

Cairn uses PostHog for mobile product analytics. PostHog is used for screen-view and product-usage event tracking within Cairn. Cairn configures the PostHog project so that GeoIP enrichment is disabled.

Cairn uses Sentry for mobile application error monitoring and diagnostics. Cairn configures Sentry not to retain IP addresses and disables Sentry’s default collection of personally identifiable information. Cairn does not use Sentry session replay.

Billing information

Cairn uses Stripe for clinic subscription billing. Stripe processes payment information needed to complete billing transactions. Cairn may receive or retain information such as customer identifiers, subscription status, invoices, payment status, and transaction records.

Privacy, consent, and legal-evidence records

Cairn may retain records showing:

• acceptance or acknowledgment of Terms and privacy notices;
• veterinary telehealth consent;
• VCPR or clinical-role attestations;
• Research Data Contribution choices;
• Research Study Opportunities choices;
• the notice version presented;
• timestamps;
• content hashes or similar evidence of the notice presented; and
• related audit information.

These records may be retained separately from ordinary account information when reasonably necessary to document a legally or operationally significant action.

3. Human sensitive information

Cairn’s ordinary veterinary-service fields do not request:

• human medical diagnoses or treatment information;
• racial or ethnic origin;
• national origin;
• religious beliefs;
• sexual orientation;
• transgender or nonbinary status;
• citizenship or immigration status;
• genetic information;
• biometric identifiers used to identify a person; or
• precise device geolocation.

Please do not include unnecessary sensitive information about yourself or another person in pet notes, support requests, or other free-text fields.

If you voluntarily provide human sensitive information in a free-text field or support communication, Cairn may process that information only as reasonably necessary to provide the requested feature, respond to the communication, protect the Services, comply with law, or otherwise as permitted by applicable law.

Pet veterinary information is not treated by Cairn as the human account holder’s medical information merely because it is associated with that person’s account.

4. Sources of information

We collect information:

• directly from pet owners and clinic users;
• from participating veterinary clinics and authorized clinic personnel;
• automatically when a device, browser, or application interacts with Cairn;
• from service providers that support authentication, billing, communications, notifications, analytics, diagnostics, security, hosting, or similar operations; and
• from records generated by Cairn when users make account, privacy, consent, or clinical-workflow choices.

Cairn does not purchase consumer profiles from data brokers.

5. How we use information

Cairn may use personal information to:

• create, authenticate, administer, and secure accounts;
• provide and maintain the Services;
• create and maintain pet profiles;
• store owner-entered veterinary information;
• deliver surveys, check-ins, and reminders;
• calculate and display trends, scores, findings, and attention states;
• display information to authorized veterinary personnel;
• support communication and follow-up between owners and veterinary teams;
• provide customer support;
• send transactional, service, account, security, and legal communications;
• process clinic subscriptions and billing;
• troubleshoot errors and improve reliability;
• understand how Cairn features are used;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, or unauthorized access;
• maintain legally or operationally significant records;
• comply with applicable law, court orders, regulatory obligations, and lawful requests;
• establish, exercise, or defend legal claims; and
• conduct optional veterinary research as described in Section 9 when the owner has enabled Research Data Contribution.

We do not process personal information for a purpose that is not reasonably necessary to or compatible with the purposes disclosed when the information was collected unless we provide appropriate additional notice and obtain consent where required by applicable law.

Cairn does not sell personal information and does not use personal information for targeted or cross-context behavioral advertising.

Cairn does not process personal information for profiling in furtherance of decisions that produce legal effects or similarly significant effects concerning an individual.

6. Veterinary clinics and authorized access

If you link a pet to a participating veterinary clinic, authorized personnel associated with that clinic may access information concerning that pet as necessary to use Cairn in connection with the clinic’s veterinary services.

Cairn uses access controls, role-based authorization, and database security controls intended to restrict users to information they are authorized to access.

Owners can access their own account and pet information. Authorized clinic personnel can access information made available through the relevant clinic relationship. Authorized Cairn personnel may access information when reasonably necessary to operate, secure, troubleshoot, maintain, or support the Services.

Clinic-controlled veterinary records may be subject to legal, professional, or record-retention requirements independent of an owner’s Cairn account. Deleting a Cairn account therefore does not necessarily require a veterinary clinic to delete records that the clinic independently controls or is permitted or required to retain.

7. Analytics, diagnostics, and support tools

PostHog

Cairn uses PostHog for mobile product analytics, including screen-view events and feature-usage events within Cairn.

PostHog is not configured by Cairn to capture visual screen contents, screenshots, screen recordings, displayed text, touch targets, or session replay. Cairn configures the PostHog project so that GeoIP enrichment is disabled.

Sentry

Cairn uses Sentry to identify and troubleshoot software errors and crashes in the mobile application.

Cairn configures Sentry not to retain IP addresses, disables Sentry’s default collection of personally identifiable information, and does not use Sentry session replay.

AI-assisted customer support

Cairn uses OpenAI for limited owner-direct support-ticket classification and response drafting.

For this owner-direct support workflow, Cairn may send:

• the support-ticket subject and body as entered by the user;
• a minimized context string describing pet species counts; and
• condition codes when the support ticket itself already indicates relevant pet or condition context.

Cairn does not add the owner’s name, pet name, or veterinary-clinic identity to this support context.

Research Core information is not provided to OpenAI through this support workflow.

Cairn does not intentionally route Clinic-submitted support tickets that Cairn processes on a Clinic’s behalf through this OpenAI workflow unless that processing is separately authorized and documented.

Because the support-ticket subject and body are submitted as typed, users should avoid including unnecessary personal or sensitive information about themselves or other people.

This support workflow is separate from Research Data Contribution. Research Data Contribution is not consent to use contributed veterinary information for general-purpose AI training.

8. Research Study Opportunities

Cairn may allow owners to choose whether they would like to hear about potential future research opportunities.

This preference is separate from Research Data Contribution.

Enabling Research Study Opportunities:

• does not itself enroll a pet in a study;
• does not itself cause veterinary information to enter Research Core; and
• is not consent to participate in a particular future study.

If Cairn later offers enrollment in a particular prospective study, additional study-specific information and consent may be required before participation.

9. Optional Research Data Contribution

Research Data Contribution is optional

Research Data Contribution is optional and is off by default.

Declining Research Data Contribution does not prevent an owner from using Cairn’s ordinary clinical and account functionality.

Cairn’s current Research Data Contribution notice explains that eligible contributed veterinary information may be used for “research used to improve veterinary care.” It also explains that contribution may include eligible veterinary information already recorded in Cairn and information added in the future.

Cairn does not treat this choice as authorization for advertising, sale of data, general-purpose AI training, unrelated product development, or unrelated secondary purposes.

Every change to the Research Data Contribution preference is recorded with information such as the choice made, the version of the notice shown, and the time of the choice.

What may enter Research Core

When Research Data Contribution is enabled, Cairn may copy approved structured veterinary information into a separately protected Research Core.

Only information that Cairn is separately authorized to use for the research purpose is eligible for Research Core. Clinic-entered or Clinic-authored information that Cairn holds solely on behalf of a participating veterinary Clinic is not eligible for Cairn’s independent Research Data Contribution unless that research use is separately authorized. Where the source of information cannot reasonably be distinguished from Clinic-entered Processor data, Cairn does not treat the information as research-eligible solely on the basis of these Terms, the Clinic relationship, or the owner’s general use of Cairn.

Research Core may include:

• species;
• breed;
• sex and reproductive status;
• exact birth date when known;
• veterinary condition information;
• structured survey responses;
• survey instrument and version information;
• scores and longitudinal change or attention states;
• normalized findings and clusters;
• weight;
• resting respiratory rate;
• normalized medication name, medication class, dose, frequency, and dates;
• structured seizure information;
• structured wellbeing-log information; and
• outcome information.

Research Core does not include:

• owner name;
• owner email address;
• owner phone number;
• Cairn owner-account identifier;
• production pet identifier;
• pet name;
• veterinary-clinic identifier;
• unrestricted free-text notes;
• pet photos; or
• file-storage paths.

For technical consistency, Cairn assigns each pet a random internal research identifier. Assignment of that identifier does not mean that the pet is participating in Research Data Contribution. No veterinary information is copied into Research Core unless Research Data Contribution is enabled.

The mapping between the ordinary Cairn pet record and the random research identifier is stored separately from Research Core and is not available to ordinary owners, clinic users, or application clients.

Turning Research Data Contribution off

You may turn Research Data Contribution off through Cairn while your account is active.

When you turn it off, Cairn deletes the corresponding Research Core information for your pets before the preference change completes. The separate random identifier mapping may remain so the same random identifier can be reused if you later choose to contribute again.

If you later turn Research Data Contribution back on, eligible veterinary information then stored in Cairn, including qualifying historical information, may again be copied into Research Core in accordance with the notice presented at that time.

Account deletion while Research Data Contribution is enabled

Research Data Contribution and ordinary account deletion have different effects.

If you delete your Cairn account while Research Data Contribution remains enabled, Cairn may retain contributed Research Core information. Before ordinary account information is scrubbed, Cairn may perform a final Research Core update so that the contributed veterinary record reflects the eligible information present at the time of deletion.

Cairn then permanently removes the direct technical mapping between the pet’s ordinary Cairn record and the Research Core identifier.

After that mapping is removed, the retained research record is no longer directly linkable through Cairn’s research linkage system. Cairn does not represent that this automatically makes the retained record fully deidentified, anonymous, or impossible to re-identify. Whether another reasonable reassociation route exists would require separate validation.

If you want contributed Research Core information removed, turn off Research Data Contribution before deleting your Cairn account.

Statutory deletion requests

An ordinary request to delete a Cairn account and a verified request to exercise a statutory privacy right may have different legal effects.

If you submit a verified request to exercise an applicable legal right to delete personal information while Cairn can still associate contributed Research Core information with your account, Cairn will apply that right to associated information as required by applicable law, subject to lawful exceptions.

Cairn does not maintain or recreate identifying information solely to make data identifiable when applicable law does not require it to do so.

10. Service providers and other recipients

Cairn discloses information only as reasonably necessary for the purposes described in this Privacy Policy, at your direction, or as permitted or required by law.

Current categories of recipients include:

Recipient or category	Information that may be disclosed	Purpose
Participating veterinary clinics	Owner/contact information, clinic relationship information, pet profile information, relevant veterinary information	Veterinary use of Cairn and clinic-owner workflows
Supabase	Account, authentication, operational, database, network, and storage information	Database, authentication, storage, and backend infrastructure
Stripe	Clinic billing and payment information	Clinic subscription billing and payment processing
Postmark	Email address and email/message information	Transactional and support email
Google Workspace	Email address, sender information, and email content	Inbound and outbound business and support email hosting for Cairn-managed mailboxes
Expo, Apple Push Notification Service, and Google notification services	Push token, device/notification routing information, notification payloads as applicable	Push-notification delivery
PostHog	Mobile screen-view and product-usage event information	Product analytics
Sentry	Crash and diagnostic information	Error monitoring and troubleshooting
Cloudflare	Website and network-request information	Website delivery, security, and network services
OpenAI	Support-ticket content and the minimized support context described in Section 7	Support-ticket classification and response drafting
Professional advisers and authorities	Information reasonably necessary for the relevant matter	Legal advice, security, compliance, disputes, or lawful process

Cairn may also disclose information in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law and appropriate protections.

Cairn does not disclose personal information to data brokers or advertising networks for targeted advertising.

11. Sale, targeted advertising, profiling, and browser privacy signals

Cairn does not sell personal information.

Cairn does not process personal information for targeted or cross-context behavioral advertising.

Cairn does not process personal information for profiling in furtherance of decisions that produce legal effects or similarly significant effects concerning an individual.

Cairn does not currently use advertising networks, advertising pixels, advertising SDKs, advertising identifiers, or similar advertising technology.

Cairn does not knowingly permit advertising networks or similar third parties to collect personally identifiable information through the Services for the purpose of tracking a user’s activity over time across unaffiliated websites, applications, or online services for behavioral advertising.

Service providers may receive ordinary request metadata, such as IP addresses or device/browser information, when necessary to provide infrastructure, authentication, security, content-delivery, analytics, diagnostic, communication, or similar services. Cairn does not authorize those service providers to use Cairn personal information for Cairn-directed behavioral advertising.

Because Cairn does not engage in sale or targeted advertising, browser “Do Not Track” signals do not cause a separate change to those practices.

Cairn will honor legally applicable universal opt-out signals, such as Global Privacy Control, if Cairn engages in a processing activity to which such a signal applies. At present, Cairn does not engage in sale or targeted-advertising processing for which such an opt-out is needed.

12. Data retention

Cairn retains personal information only for as long as reasonably necessary for the purposes for which it is processed, subject to legal, professional, security, evidentiary, contractual, and technical requirements.

Cairn does not currently operate a single automated retention engine that deletes every category of information after one uniform period. Retention therefore depends on the category and purpose of the information.

Category	Retention criteria
Account and contact information	Generally retained while the account is active and thereafter only as reasonably necessary to complete account closure, protect security, investigate abuse or fraud, satisfy legal obligations, resolve disputes, or establish or defend legal claims.
Pet and operational veterinary information	Generally retained while needed to provide Cairn and maintain the applicable owner/pet/clinic relationship. Records independently controlled by a veterinary Clinic may remain with that Clinic according to its legal, professional, contractual, or veterinary-record obligations. Where Cairn Processes Clinic Personal Data solely on a Clinic’s behalf, return or deletion at the end of the applicable Processor Services is governed by Cairn’s DPA, the Clinic’s lawful instructions, and Applicable Data Protection Law.
Authentication sessions and security information	Retained only as necessary to authenticate users, maintain sessions, protect accounts and systems, investigate security events, and satisfy applicable security or legal requirements.
Support communications	Retained only as reasonably necessary to respond to and document the request, troubleshoot the Services, protect security, resolve disputes, and satisfy legal obligations.
Analytics and diagnostics	Retained according to operational need and applicable provider settings for product analytics, error diagnosis, reliability, security, and related purposes.
Billing, invoice, tax, and transaction records	Retained for periods reasonably required by financial, tax, accounting, contractual, or legal obligations.
Privacy, consent, telehealth, VCPR, research-choice, and legal-evidence records	May be retained after ordinary account deletion for as long as reasonably necessary to demonstrate compliance, document a legally significant action, resolve disputes, or satisfy legal obligations.
Backups and disaster-recovery copies	May remain for a limited period after deletion from active systems and are overwritten, expired, or removed according to the applicable infrastructure-provider backup cycle.
Research Core information	Deleted synchronously when Research Data Contribution is turned off while Cairn can still associate that contribution with the active account. If an account is deleted while contribution remains enabled, Research Core information may be retained for the research purpose described in Section 9 after the direct linkage is removed. Cairn has not established a single fixed expiration period for retained Research Core information.

Cairn may retain a minimal record of a deletion or privacy request where reasonably necessary to ensure compliance with the request, document that it was handled, or satisfy legal obligations.

13. Account deletion

Owners may initiate ordinary account deletion through the Cairn application or through Cairn’s account-deletion page at cairnpethealth.com/delete-account. You may also contact [email protected] for assistance with a privacy or deletion request.

When Cairn’s ordinary account-deletion process is completed:

• direct owner-identifying information in the active Cairn account is removed or scrubbed as applicable;
• associated operational pet records and Clinic relationships are deactivated or disassociated from the owner as applicable;
• the direct pet-to-Research-ID linkage is permanently removed;
• information Cairn lawfully Processes in an independent Controller capacity may remain where retention is permitted or required for the purposes described in this Privacy Policy; and
• records independently controlled by a veterinary Clinic may remain with that Clinic according to the Clinic’s legal, professional, contractual, or veterinary-record obligations.

Where Cairn Processes Clinic Personal Data solely on a Clinic’s behalf, the return or deletion of that Processor-side data at the end of the applicable Processor Services is governed by Cairn’s DPA, the Clinic’s lawful instructions, and Applicable Data Protection Law.

Account deletion does not necessarily delete records independently controlled by a veterinary Clinic.

If Research Data Contribution remains enabled when the account is deleted, Research Core information may remain as described in Section 9.

If you want contributed Research Core information removed through the ordinary account-deletion flow, turn off Research Data Contribution before deleting your Cairn account.

A verified request to exercise an applicable statutory right to delete personal information will be evaluated separately and handled as required by applicable law, subject to lawful exceptions.

14. Your privacy rights

Privacy rights vary by state. To provide a consistent baseline, Cairn accepts privacy requests from U.S. users for the rights described below, subject to identity verification, the nature of the information, applicable legal exceptions, and circumstances in which Cairn processes information solely on behalf of a veterinary clinic.

You may request:

• confirmation of whether Cairn processes personal information concerning you;
• access to personal information Cairn processes concerning you;
• a copy of personal information where required by applicable law;
• correction of inaccurate personal information;
• deletion of personal information, subject to lawful exceptions;
• a portable copy of personal information you previously provided to Cairn, to the extent technically feasible and applicable;
• information about categories of personal information Cairn processes and discloses;
• withdrawal of consent where processing depends on your consent; and
• information about specific third parties to which Cairn has disclosed personal information, where Cairn maintains or can reasonably provide that information and where required by applicable law.

Where applicable law provides additional rights, Cairn will honor those rights.

Cairn does not discriminate against users for exercising privacy rights. Exercising a right may, however, make a feature unavailable when the information at issue is necessary to provide that feature.

How to submit a privacy request

You may submit a privacy request by emailing:

[email protected]

Please describe the right you wish to exercise and provide enough information for Cairn to identify and reasonably authenticate the request.

Cairn may ask an existing user to authenticate through an existing account or may request additional information reasonably necessary to verify identity. Cairn will not require you to create a new account solely to submit a privacy request.

Where applicable law permits an authorized agent to act for you, Cairn may require reasonable evidence of the agent’s authority and may separately verify your identity where permitted.

Response timing

Cairn will respond to authenticated privacy requests without undue delay and within the period required by applicable law. As a general operating standard, Cairn aims to respond within 45 days after receiving a request.

Where legally permitted and reasonably necessary, Cairn may extend the response period and will provide notice of the extension and the reason for it.

Cairn provides ordinary privacy-rights responses without charge. Where permitted by applicable law, Cairn may charge a reasonable fee or decline to act on a request that is manifestly unfounded or excessive, including because of its repetitive character.

If Cairn cannot authenticate a request using commercially reasonable efforts, Cairn may ask for additional information reasonably necessary to authenticate the request or may decline the request where permitted by law.

Appeals

If Cairn denies a privacy request, you may appeal by emailing:

[email protected]

Use the subject line “Privacy Appeal.”

Cairn will review the appeal and respond within the period required by applicable law.

If an appeal is denied, Cairn will provide a written explanation and, where required by applicable law, information about how to contact the appropriate state regulator or attorney general.

Requests involving clinic-controlled information

If your request relates to information that Cairn processes solely on behalf of a veterinary clinic, Cairn may refer or forward the request to the clinic, or ask you to contact the clinic directly, as appropriate. The clinic may be responsible for responding to requests concerning records it independently controls.

15. U.S. state privacy disclosures

The following disclosures are provided for transparency and to support rights available under U.S. state privacy laws. Whether a particular state law applies to a specific person or to Cairn may depend on statutory definitions, exemptions, and applicability thresholds.

During the preceding 12 months, Cairn may have collected or processed the following general categories of personal information:

• identifiers and contact information;
• account and authentication information;
• internet or electronic-network activity and application-usage information;
• professional or employment-related information for veterinary-clinic users;
• commercial or transaction information relating to clinic subscriptions;
• user-provided communications and content;
• pet and veterinary information associated with an identifiable account or household;
• inferences or derived veterinary trend information generated from pet data; and
• privacy, consent, security, and legal-evidence records.

Cairn does not collect device GPS or precise geolocation through the Services.

Cairn does not sell these categories of personal information and does not share them for cross-context behavioral advertising.

Cairn may disclose applicable categories to service providers, contractors, veterinary clinics, professional advisers, or authorities for the purposes described in this Privacy Policy.

Cairn does not intentionally request human sensitive personal information through its ordinary veterinary-service fields, except for authentication information necessarily used to secure an account. If a user voluntarily places human sensitive information in a free-text field or communication, Cairn handles it as described in Section 3.

16. Security

Cairn maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These safeguards include, as appropriate:

• encrypted communications using TLS;
• encryption at rest where supported by the relevant infrastructure;
• authenticated access controls;
• role-based authorization;
• database row-level security;
• audit logging;
• least-privilege access practices;
• infrastructure and error monitoring;
• software and dependency maintenance; and
• secure-development practices.

No electronic transmission, information system, or storage technology can be guaranteed to be completely secure.

If Cairn becomes aware of a security incident that requires notice under applicable law, Cairn will provide legally required notifications.

17. Children and teenagers

The Services are intended only for adults age 18 or older. Persons under 18 may not register for or use Cairn.

Cairn does not knowingly permit persons under 18 to create accounts.

If Cairn learns that an under-18 user has created an account in violation of Cairn’s Terms, Cairn will take appropriate steps to close the account and handle the associated information consistent with applicable law.

If you believe a minor has improperly created an account or provided personal information to Cairn, contact [email protected].

18. United States processing and international access

Cairn is a United States company and the Services are currently offered for use in the United States.

Cairn’s primary service infrastructure is hosted in the United States, although service providers may process information in other jurisdictions as part of their operations.

If you access the Services from outside the United States, information may be transferred to and processed in the United States.

This Privacy Policy is written for Cairn’s current United States service. Expansion into Canada, Mexico, the European Economic Area, the United Kingdom, or another jurisdiction may require additional notices, contractual terms, transfer safeguards, or other compliance measures before Cairn offers the Services there.

19. Changes to this Privacy Policy

Cairn may update this Privacy Policy as the Services, our privacy practices, or applicable law changes.

We will update the “Last updated” date when the Privacy Policy changes. The effective date shown at the beginning identifies when the current version takes effect.

If Cairn makes a material change to how personal information is collected, used, retained, or disclosed, we will take reasonable electronic measures to notify affected users, such as through the application, website, or email, as appropriate to the nature of the change and our relationship with the user.

Where required by law, Cairn will provide a reasonable opportunity to withdraw consent to materially different future processing or will obtain additional consent before beginning processing that requires it.

20. Contact us

For privacy questions, requests, complaints, or appeals:

Cairn Pet Health LLC
1212 Country Acres Ct
Johnstown, CO 80534
United States

Email: [email protected]