Privacy Policy

Website and online forms

At Hôpital Vétérinaire Métro Iberville Inc. (hereinafter "the Clinic", "we"), we place great importance on protecting the personal information of our clients and their animals.

This policy explains how we collect, use, disclose, retain, and protect your personal information when you use:

• our website montreal.vet;
• our online forms (appointment requests, new client, medical questionnaires, etc.) provided by Tally BV;
• as well as associated communication channels (notably Google Workspace – Gmail).

Table of contents

1. 1. Privacy Officer
2. 2. Personal information we collect
3. 3. Purposes of collection and use
4. 4. Storage locations and information flows
5. 5. Disclosure of your information
6. 6. Transfers of personal information outside Québec
7. 7. Consent
8. 8. Retention of information
9. 9. Security measures
10. 10. Your rights
11. 11. Changes to this policy
12. 12. Contact us

1. Privacy Officer

The person responsible for the protection of personal information within the Clinic is:

• oversees the application of this policy and our internal governance policies;
• is consulted for any project involving personal information or new technological tools;
• handles access requests, correction requests, consent withdrawals, and privacy-related complaints.

2. Personal information we collect

2.1. Information provided through online forms (Tally BV)

We use online forms for:

• appointment requests;
• opening a file (new client / new patient);
• medical or clinical questionnaires (pre-surgical, quality of life, follow-up, etc.);
• contact requests.

Depending on the form, the information collected may include:

Owner / client information

• first and last name;
• contact details (mailing address, phone, email);
• preferred language of communication;
• billing information, where applicable.

Animal information

• name, species, breed, sex;
• age or date of birth;
• living conditions (indoor/outdoor, other animals in the household, etc.).

Medical information and attached files

• reason for visit;
• observed symptoms, medical history, previous and current treatments;
• diet, allergies, specific behaviors;
• answers to medical questionnaires (pain, mobility, appetite, quality of life, etc.);
• uploaded files: photos, videos, PDFs or other documents (e.g., video of a limp, photo of a wound, examination report).

Information about third parties

If you share information about another person (e.g., co-owner of the animal, emergency contact), you must ensure that person consents to this disclosure.

2.2. Technical information collected during browsing

When you visit our website, certain technical information is collected automatically:

• IP address used to access the site;
• date and time of the visit;
• pages viewed;
• browser type and operating system;
• any technical errors.

This information is recorded in logs and used only to:

• ensure the security and stability of the site;
• prevent and investigate security incidents;
• diagnose technical problems.

2.3. Cookies and similar technologies

• Our site uses Google Analytics 4 (Google LLC) only if you have given your consent via our cookie banner. This service measures site audience (pages visited, session duration, traffic source) using tracking cookies.
• If you decline analytics cookies, Google Analytics is not loaded and no browsing data is transmitted to Google.
• Forms provided by Tally BV may use strictly necessary technical cookies for the proper functioning of the form. These cookies are not used for targeted advertising.

3. Purposes of collection and use

We use your personal information only for serious and legitimate purposes, including:

• Creating and updating your animal's veterinary medical record;
• Assessing your animal's health and planning care (preventive, medical, surgical, palliative);
• Managing appointments and client relationships (reminders, follow-ups, important communications about your animal);
• Administrative management (billing, receipts, consent records, accounting and tax compliance);
• Meeting our professional and legal obligations, particularly regarding record-keeping and retention;
• Ensuring security and proper functioning of our website.

4. Storage locations and information flows

4.1. Tally forms (servers in Europe + email copy)

1. Information entered is transmitted in encrypted form to Tally BV servers located in the European Union.
2. A copy of the responses is automatically emailed to our professional Google Workspace (Gmail) account.
3. An authorized team member reviews these responses in Tally or Gmail and, if needed, manually enters relevant information into our internal systems.

4.2. Veterinary management software (secure local server)

Our veterinary management software runs on a secure local server located on our premises, accessible only from our authorized workstations. This system contains primarily:

• your animal's medical records;
• appointment management, procedures, and billing.

If needed, our veterinary software provider may access certain information solely for technical support and maintenance purposes, always subject to confidentiality agreements.

4.3. Website hosting (Vercel + Cloudflare + GitHub)

Our website is developed and versioned on GitHub (private source code), deployed via Vercel (global low-latency infrastructure), and distributed through Cloudflare's CDN network, which also provides protection against attacks (DDoS, malicious bots, application firewall). These three platforms are recognized for their high security and availability standards.

• GitHub: source code hosting and CI/CD deployment management;
• Vercel: Next.js site execution and server-side rendering;
• Cloudflare: CDN, caching, WAF/DDoS protection, and montreal.vet domain management.

Access to the source code is restricted to authorized team members. Production deployments go through a controlled process.

5. Disclosure of your information

5.1. Internally

Within the Clinic, your information is accessible only to those who need it to perform their duties, including:

• veterinarians;
• veterinary technicians;
• reception and administrative staff;
• management personnel.

5.2. Service providers

• Tally BV: provider of our online forms (hosting, storage, and display of responses).
• Google Workspace (Gmail): professional email service used to receive forms and communicate with you.
• Google Analytics 4 (Google LLC): web audience analytics service, used only with your consent. Data collected (browsing behaviour, pages visited, session duration) is transmitted to Google and stored on its servers.
• Vercel: website hosting and deployment platform.
• Cloudflare: CDN network, security protection (WAF/DDoS), and DNS management.
• GitHub: source code hosting and deployment management.
• Our veterinary management software provider: possible access for technical support and maintenance.
• Other IT providers (backups, security, maintenance), as needed.

We only disclose your information to other third parties (e.g., authorities, insurers, laboratories, specialists) when required by law or necessary for your animal's care or follow-up, with your consent where required.

6. Transfers of personal information outside Québec

Some providers may process or host information outside of Québec, including:

• Tally BV and some of its sub-processors, located in the European Union, for form hosting;
• Google Workspace (Gmail), which may process emails in various data centers outside Québec;
• Google Analytics 4 (Google LLC), whose data is processed on servers located primarily in the United States — only if you have consented to analytics cookies;
• Vercel, whose global infrastructure may process data in various regions;
• Cloudflare, whose global CDN distributes content from international points of presence;
• GitHub (Microsoft), whose servers are primarily located in the United States.

We document this assessment in an internal record and only retain providers that offer an adequate level of protection with a low residual risk to the individuals concerned.

7. Consent

7.1. Online forms

Each online form includes:

• a link to this policy or a summary of how your information will be used;
• a mandatory consent checkbox.

You must check this box to confirm you have read our policy and consent to your information being used for the described purposes.

7.2. Withdrawal of consent

In certain cases, you may withdraw your consent to the use or disclosure of your information, subject to:

• our legal or professional obligations (e.g., medical record retention for a minimum period);
• the possible impact on our ability to provide certain services.

To withdraw your consent where possible, contact our Privacy Officer (see section 1).

8. Retention of information

We retain your personal information only for as long as necessary for the purposes for which it was collected, subject to legally required retention periods.

8.1. Veterinary medical records

8.2. Online forms (Tally BV) and associated emails (Gmail)

Information submitted through forms is stored at Tally BV and emailed to our Google Workspace account. Once the information has been used (scheduling an appointment, opening a file):

• we retain responses in Tally BV and corresponding emails in Gmail for a maximum of three (3) months, unless required otherwise (e.g., litigation);

After this period:

• responses are deleted from our Tally BV account;
• associated emails are deleted from our Gmail inbox, or integrated into the medical record (then subject to the same retention rules).

8.3. Technical logs and Google Analytics data

Logs generated by our infrastructure (Vercel, Cloudflare) including technical metadata (IP addresses, dates, pages viewed) are retained in accordance with these providers' retention policies, generally for a maximum of thirty (30) days. This data is used only to:

• ensure the security and availability of the site;
• analyze and prevent security incidents;
• diagnose technical problems.

If you have consented to analytics cookies, Google Analytics 4 retains browsing data for 14 months (the retention period configured in our GA4 property), after which it is automatically deleted. You may withdraw your consent at any time by clearing your browser cookies or using the Google Analytics opt-out browser add-on.

9. Security measures

We implement administrative, technical, and physical security measures to protect your personal information, including:

• access controls to premises and systems (restricted to authorized personnel);
• strong passwords, firewalls, malware protection, and regular updates;
• secure backups of critical data;
• staff awareness of confidentiality obligations.

Secure web infrastructure

Privacy incidents

• In the event of a privacy incident (unauthorized access, loss, unauthorized disclosure) likely to cause serious harm, we will promptly take measures to limit the impact.
• We will record the incident in our internal register.
• Where required, we will notify the affected individuals and the competent supervisory authority in accordance with the law.

10. Your rights

Under the law, you have the following rights, among others:

To exercise these rights, please contact our Privacy Officer (see section 12).

11. Changes to this policy

We may update this policy to reflect:

• legislative or regulatory changes;
• changes in our services or practices;
• the addition of new features or service providers.

12. Contact us

For any questions about this policy or to exercise your rights, please contact: