What we store, and who can see it.

Who this policy covers

Vet Logbook is recordkeeping software for U.S. veterinary clinics, available at vetbooklog.com. This policy explains what the website and the register collect, how the data is used, and the choices a clinic has.

The clinic that subscribes — not Vet Logbook — controls the register and decides who is on its member list. If you are a staff member, your clinic administrator is the first stop for access, correction, or deletion questions.

What we collect

Account and access

When you sign in with Google, we receive your Google account identifier, email address, and display name. We use them to authenticate you, check the clinic member list, assign a role, and record who made a change. The first account may claim an empty clinic and become its owner.

Clinic register data

The clinic provides the register content: clinic profile, staff records, drug catalog, bottle counts, dispense and waste entries, receipts, reconciliations, inventories, incidents, attachments, PMP packets, and audit rows. Some of this includes patient and client names and clinical details. The clinic is responsible for the information it enters and for any notices or permissions its own operations require.

Staff PINs

Staff PINs are stored as salted hashes, not plain text. The browser never receives a PIN hash or a staff session secret. PIN sessions expire, and repeated failures trigger a lockout.

Technical and usage data

Firebase Hosting, Authentication, Firestore, Cloud Functions, and Cloud Storage process request logs, device and browser information, approximate region, and error data to run and secure the service. The register also uses Firebase Analytics (GA4) for product usage; the public marketing pages do not load an advertising tag by default.

If a clinic enables browser alerts, a push token is stored so the clinic can send compliance reminders. If SMS alerts are enabled, a phone number is stored for that purpose. If the clinic sends a Form 106 notice by email, the recipient address and message content pass through the email provider.

Cookies and local storage

The marketing site stores your light/dark preference in localStorage under the key vet-theme, and keeps campaign parameters in sessionStorage for the current tab. These are not advertising cookies.

The register uses browser storage and IndexedDB for Firebase authentication and the local read cache. Those are part of how the signed-in app works, not a separate ad profile.

How we use it

• Authenticate users and enforce the clinic member list and role matrix.
• Run the register, compute balances, and write the audit trail.
• Send the alerts and notices a clinic has enabled.
• Keep the service secure, investigate abuse, and fix errors.
• Understand aggregate product usage so the product can be improved.

We do not sell clinic or personal data. Vet Logbook has no AI feature and does not send register data to AI training services. Infrastructure providers process data on our behalf under their terms.

Who can see it

Within a clinic, access follows the role matrix: owner, clinic admin, pharmacist, technician, or read-only. The server enforces the role on every action. PIN hashes, staff sessions, idempotency records, and rate-limit records are denied to browser clients.

Vet Logbook personnel may access data only when needed to operate, secure, or support the service — for example, to investigate an error or a security incident. The infrastructure providers listed below process data to provide their services.

Service providers

• Google Firebase — authentication, database, file storage, server functions, hosting, analytics, and push messaging.
• Resend — transactional email for clinic-triggered notices, where configured.
• Twilio — SMS compliance reminders, where configured by the clinic.
• Google Maps / Places — address autocomplete, where configured.

These providers may process data in the United States or other locations where they operate. Their own privacy terms apply to their processing.

Retention

Clinic records are retained while the clinic uses the service and according to the clinic’s instructions. Federal rules require certain controlled-substance records to be kept at least two years, and some states require longer; the clinic decides its retention policy. Export the register before closing a clinic or changing vendors.

Account and technical logs are kept only as long as needed for security, operations, and legal obligations. Audit rows are designed to be append-only.

Security

The browser can read the register but cannot write it. Every change goes through one authenticated Cloud Function that checks membership, role, PIN session, rate limits, and idempotency before committing. Firestore rules deny client writes. See Security for the full model and its limits.

No system is perfectly secure. If you believe an account or clinic has been compromised, contact the clinic owner and the Vet Logbook team.

Your choices

• Access and correction: clinic members can view the register; owners and admins manage the member list and roles.
• Export: the register can be downloaded as a portable record.
• Deletion: ask the clinic owner, or contact us. Some records may need to be retained to meet legal obligations or preserve an audit trail.
• Marketing pages: no account is required, and the tour saves nothing.

Children

The service is for veterinary professionals and is not directed to children under 13. We do not knowingly collect personal information from children.

Changes

If this policy changes materially, the “Last updated” date will change and the clinic owner will be told before the change takes effect. The current version is always at this URL.

Contact

Questions about this policy, a clinic’s data, or a security concern? Email the Vet Logbook team at ashishbhukal4@gmail.com.

Effective October 20, 2026. This policy is a plain-language description of current practice, not legal advice.