Privacy Policy
1. Who we are
Artiprax is a B2B software-as-a-service product for veterinary professionals. It is operated by Fernando Artiach Tarascon, a sole trader (individual entrepreneur), trading as Artiprax, established in Spain.
- Data controller: Fernando Artiach Tarascon
- Spanish tax number (NIF): 05436928G
- Registered address: Calle Enrique Granados, 12 · 28690 Brunete (Madrid), Spain
- Contact email: info@artiprax.com
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD). Our supervisory authority is the Spanish Data Protection Agency (AEPD).
We are the data controller for the account, billing and browsing data described in this policy. For the clinical data you enter into the Service (patients and their owners), we act as data processor on behalf of your clinic, as set out in section 8 of the Terms of Use.
For any privacy-related questions, contact us at: info@artiprax.com
2. What data we collect
2.1 Data you provide when registering
- Email address (used for authentication and service communications)
- Full name
- Veterinary registration number and registering body
- Clinic name, address, phone and email
- Preferred language
2.2 Data generated when you use the service
- Voice recordings: Audio recorded after consultations. These are sent to our transcription provider, converted to text, and then automatically deleted from our servers. We do not retain audio files.
- Text input: If you use the text input mode instead of voice dictation, your written notes are sent to our AI provider, used to generate the clinical report, and then automatically deleted. We do not retain raw text input.
- Clinical notes: The structured clinical reports generated from your dictations. These are stored in your account so you can access and edit them.
- Usage data: Timestamps of sessions, number of consultations processed, language used. No keystroke logging, no screen recording.
- Anonymous session telemetry: To debug technical issues and improve the service, we collect anonymous session metadata using PostHog (EU region). All form inputs and text content are masked at the browser level before transmission — we never see your clinical notes, patient names, passwords, or any other text content. Only DOM structure, click positions, and console errors are recorded. Legal basis: legitimate interest in maintaining service reliability (Art. 6(1)(f) GDPR).
2.3 Data collected automatically on our website (artiprax.com)
We use Google Analytics 4 (GA4) to understand how visitors use our website — which pages are visited, how long, and from which country. This only applies to the public website, not to the app (app.artiprax.com).
GA4 uses cookies. We only activate GA4 if you explicitly accept cookies via our cookie banner. You can withdraw your consent at any time by clearing your browser cookies or clicking the cookie settings link in the footer.
3. Legal basis for processing (GDPR)
| Data | Legal basis |
|---|---|
| Account and profile data | Performance of contract (Art. 6(1)(b) GDPR) — necessary to provide the service |
| Voice recordings (transient processing) | Performance of contract (Art. 6(1)(b) GDPR) |
| Clinical notes | Performance of contract (Art. 6(1)(b) GDPR) |
| Website analytics (GA4) | Consent (Art. 6(1)(a) GDPR) — only if you accept cookies |
| Service communications (e.g. password reset) | Performance of contract (Art. 6(1)(b) GDPR) |
4. Third-party service providers
We use the following third-party services to operate Artiprax. All are bound by data processing agreements and operate in compliance with GDPR.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Authentication, database, file storage | Account data, clinical notes | EU (Ireland) |
| OpenAI (Whisper API) | Voice-to-text transcription | Audio recordings (transient processing, no permanent storage) | USA (SCCs apply) |
| Anthropic (Claude API) | Clinical note generation | Text transcription (transient processing, no permanent storage) | USA (SCCs apply) |
| Google Analytics | Website analytics | Anonymised visitor data (only with cookie consent) | USA (SCCs apply) |
| Vercel | Website and app hosting | IP address (server logs) | USA (EU-US DPF + SCCs apply) |
| Google Workspace | Operational email inbox (info@artiprax.com) | Email address | USA (EU-US DPF + SCCs apply) |
| PostHog | Product analytics + anonymous session replay | Anonymous session metadata (DOM structure, clicks, console errors) — text inputs masked at browser level before transmission | EU (Frankfurt) |
| Resend | Transactional email from the app (password reset, notifications) | Email address | USA (EU-US DPF + SCCs apply) |
| Stripe (Stripe Payments Europe, Ltd.) | Payment processing and subscription billing | Name, email, tax and billing details, amount and payment identifiers. Full card details are entered directly into Stripe's environment and never reach Artiprax. No clinical data. | EU (Ireland) and USA (EU-US DPF + SCCs apply) |
SCCs = EU Standard Contractual Clauses, a legal mechanism that allows data transfers outside the EU under GDPR.
We do not sell your data to any third party. We do not use your data to train AI models. OpenAI and Anthropic do not use API inputs to train their models. They process data transiently and may retain it only for a limited period, solely for abuse and service-safety monitoring in line with their API data usage policies, after which it is deleted.
5. How long we retain your data
- Voice recordings: Not retained. Automatically deleted from our servers immediately after transcription.
- Raw transcripts: Retained encrypted for up to 7 days. This short retention window enables you to reformat existing reports (for example, switch between consultation and surgery format) and supports our clinical debugging if you report an issue. After 7 days, raw transcripts are automatically deleted by our system.
- Clinical notes: Retained for as long as your account is active. You can delete individual notes at any time.
- Account data: Retained for the duration of your account. If you request deletion, we will erase your data within 30 days.
- Billing data: Retained for the periods required by Spanish tax and commercial law, even after you close your account. This is the only exception to the deletion period above.
- Website analytics (GA4): Retained for 14 months, as per Google's default settings.
6. Your rights under GDPR
If you are in the EU/EEA, you have the following rights regarding your personal data:
- Access: Request a copy of the data we hold about you.
- Rectification: Ask us to correct inaccurate data.
- Erasure: Request deletion of your account and all associated data.
- Portability: Request your data in a machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdrawal of consent: For cookie-based analytics, withdraw consent at any time by clearing cookies.
To exercise any of these rights, email us at info@artiprax.com. We will respond within 30 days.
You also have the right to lodge a complaint with the competent supervisory authority. Ours is the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid, Spain). If you live in another EU or EEA country, you may equally contact the data protection authority in your own country.
7. Cookies
The Artiprax app (app.artiprax.com) uses only strictly necessary cookies for authentication (Supabase session). These do not require consent under GDPR.
The Artiprax website (artiprax.com) uses Google Analytics cookies only if you consent via our cookie banner. You can change your preference at any time via the cookie settings link in the page footer.
8. Data security
All data is transmitted over encrypted connections (HTTPS/TLS). Data at rest is encrypted at the database level (Supabase). We follow principle-of-least-privilege for internal access to production data.
9. Children
Artiprax is a professional tool for licensed veterinary surgeons. It is not directed at individuals under 18. We do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy as the service evolves. When we make material changes, we will notify active users by email and update the "Last updated" date at the top of this page.
11. Contact
For any privacy-related questions or data requests:
info@artiprax.com
Fernando Artiach Tarascon (Artiprax) — NIF 05436928G
Calle Enrique Granados, 12 · 28690 Brunete (Madrid), Spain