Privacy Policy

1. Introduction

Medpaw.co is operated by Medpaw Inc., a Delaware corporation ("Medpaw", "we", "us", "our").

This Privacy Policy explains how we collect, use, store, and share personal information when you use the Medpaw platform, including our website at medpaw.co and our mobile application.

By registering for or using Medpaw, you agree to the collection and use of information in accordance with this policy.

This policy applies to all users: provider administrators, provider staff, and pet owners.

2. Information We Collect

• From pet owners: full name, email address, mobile phone number, preferred language, and information about your animals including species, breed, date of birth, weight, vaccination history, and medical appointment records.
• From provider staff: full name, email address, mobile phone number, professional role, and activity logs related to provider operations within the platform.
• From providers: business name, address, phone number, WhatsApp number, tax information, bank account or payment details, and operational data including appointment records, invoices, and service catalogues.
• Usage data: device type, browser type, IP address, pages visited, and actions taken within the platform. Collected automatically using standard web server logs and analytics tools.
• Communications: records of WhatsApp messages, email notifications, and in-platform messages sent through Medpaw.

3. How We Use Your Information

• To provide the Medpaw service: scheduling appointments, managing medical records, processing payments, sending notifications, and generating reports.
• To verify your identity: phone number OTP verification during registration.
• To communicate with you: appointment confirmations, reminders, vaccination alerts, payment receipts, and system notifications via WhatsApp and email.
• To improve the platform: analysing usage patterns to identify and fix issues and develop new features.
• For anonymised analytics and research: we use aggregated, de-identified data across all providers using Medpaw to generate statistical insights about animal care patterns in Southeast Asia. This data does not identify individual animals, owners, or providers.
• To share with third parties in aggregated form: we may share anonymised, aggregated data with research institutions, pharmaceutical companies, insurance providers, public health agencies, and other partners. This data cannot be used to identify any individual person, animal, or provider. See Section 5 for details.
• To comply with legal obligations: responding to lawful requests from government authorities and meeting regulatory requirements in the jurisdictions where we operate.

4. Legal Basis for Processing

• Consent: we process your personal data based on your explicit consent provided at registration. You may withdraw consent at any time by contacting us, but this may affect your ability to use the platform.
• Contract performance: processing necessary to deliver the Medpaw service you have contracted for.
• Legitimate interests: processing for fraud prevention, platform security, and anonymised analytics that does not override your fundamental rights.
• Legal compliance: processing required by applicable law in Thailand, Vietnam, Indonesia, Singapore, and other jurisdictions where Medpaw operates.

5. Third-Party Data Sharing

• We do NOT sell your personal data to third parties.
• We do NOT share identifiable personal data (name, phone, email, specific animal records) with third parties without your explicit additional consent.
• We MAY share the following anonymised, aggregated, de-identified data with third parties:
  • Statistical veterinary care trends by species, region, and season
  • Aggregated appointment volumes and service category breakdowns by city and country
  • Anonymised vaccination coverage rates by species and vaccine type
  • Aggregated disease pattern data with public health agencies for surveillance purposes
  • Platform usage statistics for research and industry reports
• All third-party data sharing agreements require the recipient to maintain the data in anonymised form and prohibit any attempt to re-identify individuals.
• Service providers: we share personal data with our technology service providers (cloud hosting, email delivery, SMS/WhatsApp messaging) solely to operate the platform. These providers are contractually bound to protect your data.

6. Data Storage and Security

• All Medpaw data is stored on servers located in Singapore (Render Singapore region), which operates under Singapore's Personal Data Protection Act (PDPA).
• Data is encrypted at rest and in transit using industry-standard encryption (TLS 1.3 for data in transit, AES-256 for data at rest).
• Access to personal data is restricted to Medpaw personnel who require it for legitimate business purposes.
• We implement technical and organisational measures to prevent unauthorised access, disclosure, alteration, or destruction of your data.
• In the event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of the breach, as required by applicable law.

7. Your Rights

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request correction of inaccurate personal data.
• Right to erasure: you may request deletion of your personal data, subject to our legal obligations to retain certain records.
• Right to data portability: you may request your data in a structured, machine-readable format.
• Right to withdraw consent: you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint: you may lodge a complaint with the relevant data protection authority in your country.
• To exercise any of these rights, contact: privacy@medpaw.co

8. Data Retention

• Owner and animal records: retained for 7 years from the date of last activity to comply with veterinary record-keeping requirements in SEA jurisdictions.
• Appointment and medical records: retained for 7 years from the date of the appointment.
• Financial records (invoices, payments): retained for 7 years to comply with tax and accounting requirements.
• Account credentials: deleted within 30 days of account closure.
• Usage logs: retained for 90 days then anonymised.

9. Children's Privacy

Medpaw is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@medpaw.co and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email and an in-platform notification at least 14 days before the change takes effect.

Continued use of Medpaw after the effective date of a revised policy constitutes your acceptance of the changes.

The current version and last updated date are shown at the top of this page.

11. Contact

• Data Controller: Medpaw Inc., a Delaware corporation
• Privacy enquiries: privacy@medpaw.co
• Mailing address: To be updated after Delaware incorporation (October 2026)