How we handle your data

EquiSketch Ltd. is the controller of the personal data described in this policy. The controller decides why and how your data is processed. For any question regarding this policy, contact us at privacy@equisketch.ie.

• Account data — name, email, veterinary registration number, practice name and address, phone number. Provided by you at registration.
• Chart data — microchip numbers, UELN, horse details (sex, colour, DOB), silhouette scans / drawings and AI-generated descriptions of the equine's markings.
• Authentication & security telemetry — session cookies, IP address (for rate-limiting and audit), failed-login counters.
• Usage logs — every login, chart access, download, edit, share and AI interpretation is recorded in the audit trail for the purposes of traceability and regulatory compliance.

We process your data under the following GDPR bases:

• Contract — providing the service you subscribed to (Art. 6(1)(b)).
• Legal obligation — retaining identification records for the periods required by Irish equine record-keeping regulations (Art. 6(1)(c)).
• Legitimate interest — securing the service and preventing abuse (Art. 6(1)(f)).

• Passwords are hashed with bcrypt (12 rounds).
• Microchip numbers and stored AI provider keys are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256).
• All traffic is served over HTTPS with HSTS enforcement.
• Sign-in cookies are HTTP-only, short-lived, and marked Secure + SameSite as appropriate for the deployment.
• Content Security Policy prevents inline script execution; recon endpoints are answered with connection-drop (444) at the ingress.

• Accepted charts — retained for 5 years from the acceptance date, to align with Irish equine identification record retention requirements.
• Draft charts — abandoned drafts are automatically deleted 90 days after their last edit.
• Shareable links — expire after the vet-selected TTL (max 30 days); expired rows are purged 6 months later.
• Audit trail — retained for the lifetime of your account for security and compliance purposes.

You may exercise the following rights at any time:

• Access & portability — download a complete ZIP archive of your data from Settings › Data & privacy.
• Rectification — correct any inaccurate data via your Profile page, or contact us.
• Erasure (“right to be forgotten”) — request permanent deletion of your account from Settings › Data & privacy. Statutory retention obligations may require certain records to be retained.
• Restriction & objection — email us at privacy@equisketch.ie.
• Lodge a complaint — with the Data Protection Commission (Ireland).

We use a small number of trusted service providers to run the platform. A full list, including the categories of data each processes and the location of processing, is maintained on our sub-processors page.

The service and its primary database are hosted within the EEA. Some sub-processors (identified on the sub-processors page) may process limited data outside the EEA under GDPR-compliant safeguards such as the EU Standard Contractual Clauses.

EquiSketch uses only essential cookies for authentication and session management. We do not deploy advertising, marketing, or analytics cookies. No cookie banner is shown because none is required for strictly necessary cookies.

Material changes to this policy will be announced via email to registered vets and via an in-app banner. The date at the top of this document reflects the most recent revision.