Effective date: 01/03/2025

Vetalis (“we”, “our”, “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable laws.

This policy applies to clients, website visitors, and any individuals whose personal data we process in the course of providing veterinary services.

1. Information We Collect We may collect and process the following categories of personal data:

• Client information: name, postal address, telephone number, email address • Pet information: name, species, breed, age, microchip number, medical history, clinical notes, treatment and vaccination records • Financial information: invoices, payment status, and transaction references (card details are not stored by us and are processed securely by third‑party payment providers) • Communications: emails, messages, phone call notes, and other correspondence relating to your pet’s care or our services • Website and technical data: IP address, browser type, device information, pages visited, and usage data collected via cookies and analytics tools • Marketing preferences: consent records and communication preferences where applicable

2. Lawful Basis for Processing Under UK GDPR, we process personal data only where there is a lawful basis. These include:

• Performance of a contract – to provide veterinary services you request • Legal obligation – to comply with professional, regulatory, and financial requirements • Legitimate interests – to manage and improve our services, ensure continuity of care, and protect our business • Consent – where required, such as for optional marketing communications

3. How We Use Your Information We use your personal data to:

• Provide veterinary services, including home visits, consultations, treatment, and aftercare • Create and maintain accurate medical records for your pet • Manage appointments, reminders, and health plans • Process payments, invoices, and accounts • Communicate with you regarding your pet’s health, treatment options, and service updates • Refer samples or cases to laboratories, referral practices, cremation services, or specialists when clinically necessary • Meet legal, professional, insurance, and regulatory obligations (including RCVS requirements) • Improve our website, services, and client experience

4. Sharing of Personal Data We do not sell or rent personal data. We may share relevant information with:

• Veterinary laboratories, referral hospitals, cremation providers, and other third parties directly involved in your pet’s care • Practice management systems, IT providers, cloud storage services, and payment processors • Insurers, accountants, professional advisers, or legal representatives where necessary • Regulatory or statutory bodies (e.g. RCVS, HMRC, law enforcement) when legally required

All third parties are required to process personal data securely, confidentially, and only in accordance with our instructions and applicable law.

5. Data Retention We retain personal and veterinary medical records only for as long as necessary and in line with legal and professional guidance. As a general rule:

• Clinical records are retained for a minimum of 7 years from the last entry • Financial records are retained in accordance with HMRC requirements • Marketing data is retained until consent is withdrawn or it is no longer relevant

Data is securely deleted or anonymised when no longer required.

6. Data Security We implement appropriate technical and organisational measures to protect personal data from accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures include secure systems, access controls, encryption where appropriate, and staff confidentiality obligations.

Access to personal data is restricted to those who need it to perform their role.

7. Your Rights Under UK GDPR, you have the right to:

• Access your personal data • Rectify inaccurate or incomplete data • Request erasure of your data (where legally permitted) • Restrict processing in certain circumstances • Data portability, where applicable • Object to processing based on legitimate interests • Withdraw consent at any time where processing is based on consent

Requests can be made using the contact details in Section 10. We may need to verify your identity before responding.

8. Cookies and Website Tracking Our website uses cookies and similar technologies to ensure functionality, analyse website traffic, and improve user experience. You can manage or disable cookies via your browser settings. Further details are provided in our Cookie Policy, where applicable.

9. International Data Transfers We do not routinely transfer personal data outside the UK. If any data is processed outside the UK (for example via IT service providers), appropriate safeguards such as adequacy regulations or standard contractual clauses will be in place.

10. Contact Details If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Vetalis Email: office@vetalis.co.uk Phone: +44 07508 308307 Correspondence address: 35 Perivale, Monkton Park, Milton Keynes, MK10 9PE

11. Complaints If you are dissatisfied with how we handle your personal data, please contact us first so we can address your concerns. You also have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office (ICO) Website: https://ico.org.uk Helpline: 0303 123 1113

12. Changes to This Policy We may update this Privacy Policy from time to time. Any changes will be published on our website with an updated effective date.