Privacy Policy

1. Introduction and scope

Nidana, Inc. ("Nidana", "we", "us") operates the nidana.io website and Nidana Loop, an AI-powered post-visit follow-up service used by veterinary clinics, together with a practice-management platform ("PIMS") used by some clinics. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices available to you. It applies to the website, the Service and all related communications.

We handle personal data in two different roles, and which one applies depends on who you are:

If you are a pet owner. Your veterinary clinic uses Nidana to follow up with you after a visit. The clinic decides to contact you, provides your details and your pet's records, and is the "controller" (or "business") of your personal data. Nidana processes that data on the clinic's behalf as its "processor" (or "service provider"), under a contract with the clinic. For questions about your data or to exercise your rights, contact your clinic first; we will help them respond. Section 4 describes how our messages and calls work.

If you are a clinic user or website visitor. When you create an account, book a demo, subscribe to our content, pay an invoice or browse nidana.io, Nidana is the controller of the personal data you provide, and this Policy applies directly.

Use of the Service is also governed by our Terms of Service at nidana.io/terms.

2. Data we collect

Pet owner data (provided by your clinic or generated by the Service). Name, mobile phone number and preferred language; your pet's name, species, breed, age and the veterinary record your clinic shares with us for the visit, including discharge notes, diagnoses, medications and appointment details; the content and metadata of SMS messages we send and receive, including your reply to a confirmation link and the time you tapped it; audio recordings of follow-up calls, their transcripts, and the AI-generated summaries and flags we produce for your clinic; call metadata: numbers, time, duration, outcome and retry attempts; and your opt-out and consent records.

Clinic user data (provided by you). Name, work email, phone number, role and clinic name; login credentials and, where you enable an integration, access tokens or credentials for your practice-management system, calendar or email account; billing details such as business name, billing address and tax identifiers; and support requests and correspondence with us. Payment card details are handled by our payment processor and are not stored by Nidana.

Website visitor data (collected automatically). Device and browser type, IP address, pages viewed, referring page, and timestamps; cookies and similar technologies used for analytics and to remember preferences; and information you submit through forms, such as a demo booking or newsletter signup. You can control cookies through your browser settings.

3. How we use data

We use personal data to deliver the Service to clinics: read the veterinary record, send messages, place and record calls, transcribe and summarize them, and present results in the clinic dashboard; schedule and manage follow-ups, including through practice-management system integrations the clinic has authorized; operate, secure, troubleshoot and support the Service, and prevent fraud and abuse; bill clinics, manage subscriptions and send operational notices; send marketing emails to clinic users and website visitors who have opted in or whom we may lawfully contact; and comply with legal obligations, including keeping consent and opt-out records. Every marketing email includes an unsubscribe link.

Improving the Service and training models. We create de-identified data from call recordings, transcripts, summaries and veterinary records by removing information that identifies the clinic, its staff, the pet owner or the specific animal. We use this de-identified data to measure and improve the Service, develop new features, and train, evaluate and refine the artificial-intelligence and speech models the Service relies on. We do not attempt to re-identify this data and do not use pet owner personal data for our own marketing.

Legal bases (where required, e.g. EEA/UK). We process clinic user and website data to perform our contract with you, for our legitimate interests in operating and promoting our business, with your consent where we ask for it, and to comply with law. Pet owner data is processed on the instructions of your clinic, which is responsible for its own legal basis.

4. SMS messages and voice calls

How Loop contacts you. After a visit, your clinic may schedule a follow-up. Nidana sends you an SMS on the clinic's behalf with a link to confirm a call. Nothing is called until you confirm, or unless your clinic has told us you have already agreed to be called. The call is placed by an AI assistant using a synthetic voice, which introduces itself as the clinic's AI assistant at the start of the call. You can decline, hang up, or ask to be connected to the clinic at any time. Unanswered calls may be retried a limited number of times.

Consent. Your clinic collects your consent to receive messages and calls at intake or during your visit and keeps a record of it. When you tap a confirmation link or reply to a message, we also record that confirmation with its timestamp. Consent records are kept for the clinic's active account plus seven years, or longer where veterinary record-keeping laws require.

Recording. Follow-up calls are recorded, transcribed and summarized so your clinic can review them. Where the law requires it, the assistant tells you the call is recorded before the conversation begins. Recordings and transcripts become part of your pet's record at the clinic.

Opting out. Reply STOP to any message to stop messages from that clinic; you will get one confirmation. If more than one clinic you use runs Nidana Loop, reply STOP to each separately. You may also tell your clinic directly or email shivam@nidana.io. Opt-outs are applied within 24 hours. Reply HELP to any message for assistance.

Rates and carriers. Message and data rates may apply. The program operates on major U.S. and Canadian carriers; delivery is not guaranteed and carriers are not liable for delayed or undelivered messages.

No marketing use. Mobile numbers and SMS consent are used only to provide the follow-up service for your clinic. They are not shared with or sold to third parties for marketing or promotional purposes.

Canada. Messages and calls to Canadian pet owners are handled in accordance with PIPEDA and CASL. Data may be stored and processed in the United States.

5. Google API Services

Clinics using the Nidana practice-management platform may connect Google services. This section describes how we access and use data from Google APIs.

Google Calendar. Clinics may connect Google Calendar to sync appointments. We request access to create, read and modify calendar events, and use calendar data solely for appointment scheduling and synchronization within the Nidana platform.

Gmail (send-only). Clinics may use their own Google Workspace account to send transactional emails from their own address: appointment confirmations and updates, invoices, prescriptions, vaccination certificates, diagnostic reports and other clinic-to-client communications. We request the gmail.send permission to send these emails, and the email and openid scopes to identify the connected account in clinic settings. We do not read, access or store the contents of the clinic's inbox, sent folder, drafts, contacts or any existing emails.

Limited Use. Nidana's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Nidana: uses Google user data only to provide and improve user-facing features of the Service; does not use it for advertising or retargeting; does not use it to train artificial-intelligence or machine-learning models; does not use it for credit, lending or insurance decisions; does not sell it; does not allow humans to read it except with the user's consent, for security, to comply with law, or for internal operations on aggregated and anonymized data; and does not transfer it to third parties except to provide or improve user-facing features, to comply with law, or as part of a merger, acquisition or asset sale with user notice.

Revoking access. Clinic administrators may disconnect Google Calendar or Gmail at any time from clinic settings; we then revoke and delete the stored OAuth tokens and transactional emails revert to Nidana's default sending address. Users may also revoke access from their Google Account permissions page.

6. Who we share data with

We do not sell personal data. We share it only as follows:

Your clinic. Everything the Service produces about a pet owner (messages, recordings, transcripts, summaries, flags) is shared with the clinic that scheduled the follow-up.

Service providers (subprocessors). Companies that process data on our behalf and are bound by contract to use it only to provide their service to us: telephony and SMS delivery (Twilio), AI speech and language models (OpenAI), cloud hosting and storage (Amazon Web Services), Google (calendar and email integrations, analytics), and payment processing (Stripe). Pet owner audio and record data sent to AI model providers is processed under terms that prohibit the provider from using it to train their own models.

Practice-management systems. When a clinic authorizes an integration, we exchange appointment and record data with that system.

Legal and safety. When required by law, subpoena or valid government request, or to protect the rights, safety or property of Nidana, our clinics, pet owners or others.

Business transfers. In connection with a merger, acquisition, financing or sale of assets, with notice to affected clinics.

With consent. Where you ask us to or agree.

7. Retention and deletion

Pet owner data, recordings and transcripts. Kept while the clinic's account is active, since they form part of the clinic's patient record. When a clinic's account ends, the clinic may export its data for 30 days; after that we delete it, except for consent and opt-out records (kept for seven years or as law requires), de-identified data (Section 3), and routine backups until they are overwritten.

Consent and opt-out records. Clinic's active account plus seven years, or longer where veterinary record-keeping laws require.

Clinic account and billing data. For the life of the account and as long afterwards as needed for tax, accounting and legal purposes.

Website and analytics data. Typically up to 26 months.

Marketing contacts. Until you unsubscribe or we have had no engagement for an extended period.

A clinic may ask us at any time to delete a specific pet owner's data from the Service; we will do so within 30 days unless law requires retention.

8. International transfers and security

Nidana is based in the United States and our providers store and process data there. If you are outside the United States, including in Canada, the United Kingdom, the EEA, Australia or New Zealand, your data will be transferred to and processed in the United States. Where the law of your region requires, we rely on recognized transfer mechanisms (such as standard contractual clauses or the UK addendum) and contractual safeguards with our providers.

We protect personal data with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption in transit and at rest, access controls, logging, and time-limited links for shared documents. No method of transmission or storage is completely secure. If we confirm a security incident affecting personal data, we will notify the affected clinic without undue delay and, where required, regulators and individuals.

9. Your rights

Wherever you live, you may ask us to tell you what personal data we hold about you, correct it, delete it, give you a copy in a portable format, or stop processing it for marketing. Email shivam@nidana.io. We may need to verify your identity, and we will respond within the time the applicable law allows (generally 30 days). Pet owners should contact their clinic first, as the clinic controls the data; we will support the clinic's response and will act directly where the law requires us to.

United States. Residents of states with comprehensive privacy laws (such as California, Colorado, Connecticut, Virginia, Texas and others) may have rights to access, correct, delete and port their data, to opt out of the sale or sharing of personal data and of targeted advertising, and not to be discriminated against for exercising those rights. We do not sell personal data or use it for targeted advertising. You may appeal a decision on your request by replying to our response.

Canada. Under PIPEDA and applicable provincial laws, you may access and correct your personal data and withdraw consent, subject to legal and contractual restrictions.

United Kingdom and EEA. Under the UK GDPR and GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You may also complain to your supervisory authority (in the UK, the ICO).

Australia and New Zealand. Under the Privacy Act 1988 (Cth) and the Privacy Act 2020 (NZ), you may access and correct your personal information and complain to the OAIC or the Privacy Commissioner respectively.

We will not treat you differently for exercising any of these rights.

10. Children

The Service is for veterinary clinics and their adult clients. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact shivam@nidana.io and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will post the new version at nidana.io/privacy-policy with a new "Last updated" date and, for material changes, notify clinic account holders by email at least 30 days before the change takes effect. Continued use of the Service after that date is acceptance of the updated Policy.

12. Contact

Nidana, Inc.
Attention: Privacy
Email: shivam@nidana.io

We aim to respond to every privacy request within 24 hours.