This notice explains what personal data Casoa collects, why we collect it, what we do with it, and the rights you have over it under the General Data Protection Regulation (EU) 2016/679. It is written to be read, not to be survived - if anything here is unclear, ask us.
Last updated: 31 July 2026.
Casoa Ltd is the data controller for the personal data described in this notice. We operate the Service through the casoa.vet and casoa.org domains and our mobile applications.
We have not appointed a Data Protection Officer; we are not required to. Privacy questions go to the address above and reach a person, not a queue.
Worth stating plainly, because it is the most common question we get. The GDPR protects natural persons. A patient's name, species, breed, age, clinical signs, and case history are not personal data on their own, and an animal has no rights under this regulation.
What does fall under the GDPR is the human attached to the record. If a case you enter identifies an owner, a colleague, or a referring practitioner - by name, contact details, or any detail that makes them identifiable - that part is personal data and this notice applies to it. Our advice: do not enter owner or third-party identifying details into a case. Casoa does not need them to reason about the patient, and leaving them out is the cleanest way to keep the case free of personal data entirely.
When you register we collect your name, email address, country, and a password. The password is stored only as a salted hash - we cannot read it, and neither can anyone who obtains the database. We also store your subscription plan, account creation date, and any preferences you set, such as interface language and theme.
If you joined the waitlist before signing up, we hold your email address and your answers to the short questions we asked (platform preference, free or paid interest, student or practising). Every waitlist email carries a one-click link to remove yourself.
What you type or dictate into the Agent - clinical signs, findings, questions - is sent to our servers and forwarded to our AI provider so a response can be generated. We do not store your case conversations in our database. They exist for the duration of the exchange and are not retained on our side afterwards. Voice input, where you use it, is transcribed and handled the same way.
Our servers keep standard access logs: IP address, timestamp, requested page, browser and device type. We use Google Analytics to understand which pages are used and how people move through the site. We keep a limited internal audit log of significant account actions - registration, login, password reset - for security and support purposes.
For paid subscriptions we hold invoice records: what was purchased, when, and for how much. These are retained for the period our tax and accounting law requires, independently of anything else in this notice.
Providing your name, email, and password is necessary to hold an account; without them we cannot create one. Everything else is optional.
We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of processors, each of which handles data only on our instructions:
We may also disclose personal data where we are legally required to - for instance in response to a valid order from a competent authority.
Your account data stays in the European Union. The application and database are hosted on EU-located infrastructure operated by Google and Motabo GmbH, and we do not replicate or back them up outside the EU.
Two of the processes described above do involve a transfer outside the European Economic Area: sending case content to Anthropic to generate an Agent response, and website usage measurement through Google Analytics. Those transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent Art. 46 safeguard. You can ask us for details of the safeguard applying to any specific transfer.
Under the GDPR you have the right to:
Write to casoavet@gmail.com to exercise any of these. We respond within one month. There is no charge, and we will not ask you why.
You also have the right to lodge a complaint with a supervisory authority - normally the data protection authority of the EU or EEA country where you live or work. We would rather you came to us first, but that is your choice, not a precondition.
We use the minimum storage the Service needs to work: a session identifier to keep you logged in, and local storage for your interface preferences such as language and theme. These are strictly necessary and set without consent. Google Analytics sets its own cookies for usage measurement; where consent is required for these, we ask for it, and you can decline without losing any functionality. You can also block or clear cookies in your browser at any time.
Casoa produces clinical suggestions - localisations, differentials, recommended work-ups. These are decision support for a qualified professional, not decisions about you or any person, and they carry no legal or similarly significant effect on an individual within the meaning of Art. 22. We do not profile users.
Traffic is encrypted in transit. Passwords are stored as salted hashes and never in readable form. Access to production data is limited to those who need it to operate the Service. No system is beyond compromise; if a breach occurs that is likely to put your rights at risk, we will tell you and the relevant supervisory authority within the time the GDPR requires.
Casoa is intended for veterinary professionals and students and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.
We may update this notice as the Service changes. Material changes will be announced by email or in the Service itself, and the date at the top of this page will always reflect the current version.
Questions, requests, or complaints about privacy: casoavet@gmail.com.