Privacy Policy

What we collect

We collect what you send us on purpose, plus a small amount of anonymous usage data so we can see how the directory is used.

• Clinic applications on /join: contact details such as name, email, phone, and an optional public contact email, along with the clinic information you fill in.
• Hospital reviews: a star rating, an optional name, and an optional written comment.
• Anonymous visitor identifier: a random ID named vetspecialist-visitor-id, stored as a cookie for one year and also in your browser's local storage, only after you click Accept on the cookie banner. It is not your name or email.
• Optional analytics (only after Accept): page views, filter clicks, and contact-link clicks (phone, WhatsApp, website, email), tied to that anonymous identifier. Your browser sends these only after you accept, and our matching APIs refuse requests that do not include that consent.
• Referral hops through /go: when you use a "Refer a patient" or /go link, we record that a referral was started for that hospital (hospital name/slug, referral type, and time). That count is how we show hospitals their referral volume. It is not tied to the anonymous visitor identifier and is recorded as part of operating the referral link itself, whether or not you accepted analytics cookies.
• Other forms: waitlist signups and appointment requests are emailed and also stored in our application database. Site feedback is sent by email and is not written to the database today. Referral records that go through the app are stored (see below).

IP addresses on reviews

When you submit a hospital review, we hash your IP address together with a secret value and the hospital name. We do not store the IP in plain text. The hash is only used to stop spam — one review per IP address per hospital per 24 hours. It is kept on the review record for as long as that review exists; there is no separate timer that deletes the hash today.

Where data is stored

Form records that we keep — including clinic applications, reviews, waitlist signups, appointment requests, page views, and click events — are stored in Supabase. That database runs on Amazon Web Services (AWS) in Tokyo, Japan, not in Singapore or Hong Kong. If you use the site from Singapore or Hong Kong, this means your data is transferred to and processed in Japan.

We do this under Supabase's Data Processing Addendum, which includes encryption at rest and in transit, access controls, and breach-notification commitments. We do not sell your data.

Emails (appointment requests, waitlist signups, applications, reviews, and feedback) are sent through our email provider, Resend. We do not currently offer a self-serve page to download or delete your data; if you want access or deletion, email us and we will handle it manually.

Cookies and browser storage

We are not running advertising pixels or Google Analytics on this site today. We do use the following so the directory works and so we can count visits:

• A one-year visitor cookie (also saved in local storage) so page views and clicks can be counted without knowing who you are. This is set only after you click Accept on the cookie banner.
• A one-year consent cookie named vetspecialist-cookie-consent, plus a matching local-storage note, so we remember that you accepted the banner. The APIs that record optional analytics check for that consent cookie.
• Referral counts from /go hops are a separate operational log (hospital name/slug, referral type, time). They are not tied to the visitor ID and do not wait for the cookie banner.
• A local-storage flag after you review a hospital from this browser, so we do not keep asking you to review the same listing.
• A session-only note of a marketing src link parameter, so we can attribute that visit while your tab is open.
• A session-only note that you dismissed the directory disclaimer, so it does not pop up again during the same visit.
• If someone signs in to the internal admin area, a 30-day login cookie is stored so they stay signed in. That is not used for public visitors.

How we use this information

• Show and moderate hospital reviews
• Review clinic applications and keep listing records
• Forward appointment and referral emails to the relevant clinic
• Understand which listings and filters people use
• Reduce review spam

Your rights

You can email us to ask what we hold about you, or to ask us to delete it. We will do that by hand; there is no automated account dashboard yet.

Contact

For privacy questions, email stellan4270@gmail.com. This address is a temporary contact point until a dedicated privacy inbox on the live domain is set up.

Changes

We may update this policy when how the site works changes. The date at the top of this page is the latest version.