This Privacy Policy explains how Equine Data Systems Inc. ("EDSI," "we," "us," or "our") collects, uses, discloses, and protects information when you use the EDSI VMS software platform, the equinedatasystems.co website, the edsivms.com application, and any related services (collectively, the "Services").
By using the Services, you agree to the practices described in this policy. If you do not agree, do not use the Services.
Plain-English summary: We collect what we need to run the software and serve our customers. We don't sell your data or your customers' data. Veterinary practice information you put into EDSI VMS belongs to your practice and is isolated from every other practice on the platform.
1. Information We Collect
Information you provide directly
- Account information: Name, email address, phone number, practice name, role, and password (stored encrypted).
- Billing information: Subscription plan, billing contact details, and payment information processed by our payment processor (Stripe). We do not store full credit card numbers on our servers.
- Communications: Messages you send to support, demo requests, and any other correspondence.
- Practice data: Information you enter into EDSI VMS as part of normal use — horse records, owner records, billing records, medical records, controlled substance logs, appointments, and related content. See section 4 for ownership terms.
Information collected automatically
- Usage data: Pages visited, features used, time and duration of access, actions performed in the application.
- Device and connection data: IP address, browser type and version, operating system, device identifiers, and approximate geographic location.
- Log data: Server logs, error reports, and performance metrics necessary to operate and improve the Services.
Information from third parties
- Email and authentication services: When you sign in or receive transactional emails from us, our infrastructure providers (Supabase, SendGrid) may process related metadata.
- Payment processor: Stripe provides us with confirmation that a payment was processed, the last four digits of the card, expiration date, and basic transaction metadata. We do not receive the full card number from Stripe.
2. How We Use Information
We use the information we collect to:
- Provide, operate, maintain, and improve the Services
- Authenticate users, manage accounts, and provide customer support
- Process subscription payments and send billing-related communications
- Send transactional emails (account confirmations, password resets, invoices, important service announcements)
- Diagnose and fix technical issues, prevent abuse, and enforce our Terms of Service
- Comply with legal obligations and respond to lawful requests
- With your consent, send occasional product updates or marketing communications you can unsubscribe from at any time
3. How We Share Information
We do not sell your personal information or your practice's data. We share information only in these limited situations:
Service providers
We share information with vendors who process data on our behalf under contractual confidentiality and data protection obligations. Current key service providers include:
- Supabase — application hosting, authentication, and database
- Vercel — web application hosting
- SendGrid — transactional email delivery
- Stripe — payment processing (Practice tier only)
Legal compliance
We may disclose information when required by law, subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of EDSI, our users, or others.
Business transfers
If EDSI is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, information held by us may be transferred to the successor entity. We will notify affected customers of any such change and any choices they may have.
4. Customer Practice Data and Ownership
This section describes how we treat the data you and your practice enter into EDSI VMS (referred to as "Customer Data" in our SaaS Agreement).
- Ownership: Your practice owns its Customer Data. We do not claim ownership of horse records, owner records, medical records, billing records, or any other content you create or upload.
- Isolation: Customer Data is logically isolated at the database level. One practice cannot view another practice's data. This is enforced by row-level security policies that we audit periodically.
- Limited use: We access Customer Data only to operate and support the Services, respond to your support requests, prevent abuse, and as required by law. We do not use Customer Data to train any AI models or sell it to third parties.
- Export and deletion: You may export your Customer Data at any time during your subscription. Upon cancellation, you have 30 days to export data, after which we will delete it from production systems within 60 days. Backups retained for disaster recovery may take up to 12 months to fully purge.
- Sensitive information: EDSI VMS is veterinary software for animal patients. It is not designed for, and you must not enter into it, protected health information (PHI) about human patients regulated under HIPAA.
5. Data Security
We use commercially reasonable administrative, technical, and physical safeguards to protect information, including:
- Encryption in transit (TLS 1.2+) for all data sent between your browser and our servers
- Encryption at rest for our production databases
- Row-level security policies that isolate each practice's data
- Access controls and authentication using industry-standard practices (bcrypt password hashing, session tokens)
- Regular software updates and dependency monitoring
- Restricted administrative access on a need-to-know basis
No system is perfectly secure. We cannot guarantee absolute security. If we discover a security incident that may have affected your information, we will notify you as required by applicable law.
6. Data Retention
- Active accounts: We retain Customer Data for as long as your subscription is active.
- After cancellation: You have 30 days to export data. After 30 days, we will delete production copies within 60 days. Backup copies are purged according to our 12-month backup rotation.
- Business records: We may retain billing records, tax records, and contractual correspondence for as long as required by law (typically 7 years).
- Aggregated data: We may retain de-identified, aggregated usage statistics indefinitely. This information cannot be used to identify you or your practice.
7. Your Rights and Choices
Access, correction, and deletion
You can view and update most account information directly in the EDSI VMS application. For other requests — including a copy of personal information we hold about you, correction of inaccurate information, or deletion — contact us at bcoulter@edsivms.com. We will respond within 30 days.
California residents (CCPA/CPRA)
If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right not to be discriminated against for exercising these rights. EDSI does not sell or share personal information for cross-context behavioral advertising.
EU/UK residents
If you are in the European Union, United Kingdom, or European Economic Area, you may have additional rights under GDPR or UK GDPR, including the right to lodge a complaint with a supervisory authority. EDSI VMS is not currently designed for use in the EU or UK; if you nevertheless choose to use the Services from those regions, you do so at your own discretion and accept that data may be processed in the United States.
Marketing communications
You can unsubscribe from marketing emails using the link in any such email. Transactional emails (password resets, account confirmations, billing notices) are required for service operation and cannot be unsubscribed from while you have an active account.
8. Cookies and Tracking
The EDSI VMS application uses essential cookies and similar technologies to keep you signed in, remember your preferences, and operate core features. The marketing website (equinedatasystems.co) uses minimal analytics to understand how visitors find us and use the site.
We do not use third-party advertising cookies or tracking pixels. We do not participate in cross-site behavioral advertising networks.
9. Children's Privacy
EDSI VMS is intended for use by licensed veterinarians, veterinary practice staff, and their authorized representatives. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will delete it.
10. International Users
EDSI VMS is operated from the United States. Data is processed and stored on infrastructure located in the United States. If you access the Services from outside the United States, you consent to the transfer and processing of your information in the United States.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify active subscribers by email and update the "Last updated" date at the top of this page. Continued use of the Services after the effective date of a revised policy constitutes acceptance of the updated terms.
12. Contact Us
Questions, requests, or complaints about this Privacy Policy or our handling of your information:
Equine Data Systems Inc.
Mount Laurel, New Jersey
Attn: Privacy Officer
bcoulter@edsivms.com
609-505-4028