Terms and conditions for veterinary clinics

1. Parties and acceptance

The service is provided by Tu Mascota ID, with the identification and contact details shown at tumascotaid.com/terminos (hereinafter "Tu Mascota ID" or "we"). The official channel for notices is hello@tumascotaid.com.

The Clinic accepts these terms by ticking the acceptance box on the platform. Acceptance by electronic means is fully valid (Law 527 of 1999, art. 14). We keep the accepted version, the date, the time, the person who accepted and the IP address.

2. Definitions

• Platform: the Tu Mascota ID cloud software, with its panel for clinics, each clinic's public page, online booking and the app for families.
• Clinic Users: the people the Clinic gives access to (administrator, veterinarians and assistants), each with their own user account.
• Families: the owners or guardians of the pets seen by the Clinic. They are the data subjects of the personal data.
• Clinic Data: the information that the Clinic and its users record on the Platform, including the medical records of their patients.
• Plan: the subscription option purchased, with its price and what it includes.

3. Purpose of the service

Tu Mascota ID grants the Clinic a non-exclusive, non-transferable license, for the term of the subscription, to use the Platform, which includes, depending on the Plan: scheduling and online booking, electronic medical records, prescriptions and consent forms, reminders to families, hospitalization, cash register and electronic invoicing through an authorized technology provider, the Clinic's public web page and management of identification tags.

The Platform is a tool. Clinical decisions, diagnoses, prescriptions and procedures are the sole responsibility of the Clinic's professionals.

4. Users, roles and credentials

• Current Plans include unlimited users: the Clinic may create as many administrator, veterinarian and assistant users as it needs, at no additional cost. If a Plan sets a number of users in the future, we will give the notice provided for in these terms and it will not affect the period already paid.
• Each user account is personal and non-transferable. Sharing passwords is prohibited: the medical record log identifies the person who recorded each entry.
• The administrator assigns roles and is responsible for them. Assistants may not record consultations or prescribe (Law 576 of 2000, art. 38).
• The Clinic is responsible for the use made by its users and for passing on to them the duty of confidentiality over medical records (Law 576 of 2000, art. 59).
• The Clinic must immediately deactivate users who stop working with it and notify us if it suspects unauthorized access.

5. Price, trial period, billing and payment

• The Plan price is the one published on the Platform at the time of purchase, plus any applicable taxes.
• The free trial lasts the number of days indicated at sign-up. When it ends, the Clinic decides whether to subscribe; without payment, access is suspended without deleting data.
• The subscription is monthly [or annual] and renews automatically at the end of each period, charged through the payment gateway chosen by the Clinic. Automatic renewal and recurring charges are expressly and separately accepted when subscribing. We send an email before each renewal.
• There is no minimum term and no cancellation fee. The Clinic may cancel at any time from the Platform or by email, with no more requirements than it had to subscribe; cancellation takes effect at the end of the period already paid and no further periods are charged.
• Card details are stored by the payment gateway; Tu Mascota ID does not store them.
• We give at least 30 days' notice of any price change. If the Clinic does not agree, it may cancel before the change applies.
• We issue an electronic invoice for each charge.
• If a payment cannot be collected, we notify the Clinic and retry. If it remains unpaid after [10] days, access is suspended until payment is made; data is kept as described in section 15.

6. Obligations of the Clinic

• Use the Platform in accordance with the law and these terms, and record truthful information.
• Comply with the rules of its activity: professional practice and ethics (Law 576 of 2000 and Law 073 of 1985), rules of the ICA (Colombian Agricultural Institute), of the National Narcotics Fund where applicable, on animal welfare, and DIAN (tax authority) invoicing rules.
• Obtain and keep the Families' authorization to process their data (Law 1581 of 2012, art. 9) and record it on the Platform when requested.
• Review and adjust the texts of consent forms, prescriptions and notices that the Platform offers as templates.
• Be responsible for the content of its public page (texts, photos, prices, opening hours) and for holding the rights to that content.
• Not use the Platform to send unauthorized advertising or to contact families outside the hours and channels permitted by law.
• Not register persons under 18 as account holders or as guardians of a pet.
• Not attempt to access other clinics' data, breach security or reverse-engineer the software.

7. Obligations of Tu Mascota ID

• Keep the Platform reasonably available and give advance notice of scheduled maintenance.
• Apply reasonable technical and administrative security measures: encryption in transit and at rest, role-based access control, audit log and daily backups.
• Process Clinic Data only to provide the service, as set out in Annex 1.
• Provide support through the published channels. To resolve a request from the Clinic, its support team may consult Clinic Data under the terms of Annex 1, section A1.5.
• Announce relevant changes to the Platform and to these terms.

8. Medical records

The medical record is mandatory, private and confidential (Law 576 of 2000, art. 61). To protect it, the Platform applies these rules:

• Whoever recorded a consultation, vaccination or deworming may correct it for 24 hours; each correction is logged with the previous and the new value.
• After that, only addenda with date, time and author are allowed.
• Nothing is deleted: records are voided with a reason and remain visible.
• The log records who opens each record and what is recorded, corrected, voided or clarified.
• The public profile opened by scanning a tag shows only what the family decides to publish; the medical record is never published.

The Clinic owns the information in the medical record and is responsible for its content. We recommend keeping it for at least five years from the last visit (National Professional Ethics Tribunal, 2018).

9. Consent forms and electronic signature

The Platform allows families to sign consent forms on screen or on paper, and records who signed, when, the IP address and a fingerprint of the document that reveals any later change (Law 527 of 1999 and Decree 2364 of 2012, compiled in Decree 1074 of 2015).

The Clinic defines the text of each consent form and is responsible for informing the family of the risks, alternatives and costs of the procedure (Law 576 of 2000, arts. 26 to 28). We recommend also keeping the paper original of the most sensitive documents.

10. The Clinic's electronic invoicing

• The Clinic is the party obliged to invoice its customers and is responsible for its tax data, its DIAN enablement and its numbering resolutions.
• Invoices are issued through the DIAN-authorized technology provider integrated into the Platform (currently Soluciones Alegra S.A.S.). The Clinic accepts that provider's terms insofar as they apply to it.
• Tu Mascota ID is not liable for DIAN rejections caused by the Clinic's data or for failures of the technology provider or the DIAN, but will help resolve them.

11. Communications to families

On behalf of the Clinic, the Platform sends appointment confirmations, reminders of appointments, vaccinations, check-ups and deworming, documents and hospitalization updates. Messages by WhatsApp and SMS are sent only to people who gave express permission; by email, service messages are sent.

Unless the Clinic connects its own WhatsApp number (section 20), WhatsApp messages are sent from the Tu Mascota ID line, on behalf of the Clinic. Families' replies reach Tu Mascota ID. When the Family confirms the appointment with the button in the message, the appointment is confirmed and Tu Mascota ID notifies the Clinic; when the Family asks to reschedule or cancel, Tu Mascota ID also notifies the Clinic, by WhatsApp or email. For anything else, it gives the Family the Clinic's contact details. Apart from those notices, Tu Mascota ID does not forward the content of those conversations to the Clinic.

Appointment reminders are sent 24 hours before the appointment; vaccination, check-up and deworming reminders at 8:00 a.m., Colombia time. Emails include a simple way to unsubscribe, and WhatsApp messages a button to stop receiving them.

The Clinic will not use these tools for advertising without the family's authorization. If it sends promotional messages, it is responsible for their content and for complying with the hours and the opt-out option required by Law 2300 of 2023, art. 5.

12. Personal data protection

• Families' data recorded by the Clinic: the Clinic is the data controller and Tu Mascota ID is the data processor, under the transmission agreement in Annex 1 (Decree 1377 of 2013, art. 25, compiled in Decree 1074 of 2015).
• Data of the Clinic and its users (contact, billing, use of the Platform): Tu Mascota ID is the controller and processes it according to its privacy policy published at tumascotaid.com/privacidad.
• Families who create or use their own account in the app (for example, to activate a tag, book an appointment online or view their pets): Tu Mascota ID is the controller of that account's data under its privacy policy, and its team may consult it to support them. The medical record and everything else recorded by the Clinic remain the Clinic's responsibility.
• The Clinic must have its own data processing policy and privacy notice. The Platform offers it a privacy notice with its details, which the Clinic must review.
• Tu Mascota ID does not use Families' data recorded by the Clinic for its own purposes, such as sending them advertising for Tu Mascota ID or third parties.
• Tu Mascota ID designates its support team, at hello@tumascotaid.com, as its data protection area (Decree 1377 of 2013, art. 23).

13. Intellectual property

• The software, the Tu Mascota ID brand, and the Platform's designs and texts belong to Tu Mascota ID or its licensors. These terms do not transfer any rights over them.
• Clinic Data belongs to the Clinic. The Clinic authorizes Tu Mascota ID to use it only to provide the service and, in aggregated and anonymous form, for statistics and product improvement.
• The Clinic authorizes Tu Mascota ID to display on its public page and in the clinic directory the name, logo, photos and data that the Clinic publishes, while the page is published.

14. Limitation of liability

• Tu Mascota ID is not liable for clinical decisions, diagnoses, treatments or outcomes of care, nor for the content that the Clinic records or publishes.
• It is not liable for interruptions caused by force majeure, acts of God, internet failures or third-party providers beyond its control, nor for misuse of credentials by Clinic users.
• In all other cases, Tu Mascota ID's total liability is limited to the amount paid by the Clinic in the [twelve] months prior to the event, and does not include loss of profits or unforeseeable damages (Civil Code, arts. 1604 and 1616).
• This limitation does not apply in case of willful misconduct or gross negligence (Civil Code, arts. 63 and 1522) or where the law does not allow it.

15. Suspension, termination and data handover

• The Clinic may terminate at any time by cancelling the subscription.
• Tu Mascota ID may suspend or terminate the service for serious breach of these terms, unlawful use or non-payment, with prior notice except in security emergencies.
• Upon termination, the Clinic may request, for [60] days, an export of its data in a commonly used electronic format. After that period, we delete the data, except what the law requires us to keep.
• We remind the Clinic that keeping the medical record is its responsibility; it should therefore export it before the period expires.

16. Confidentiality

Each party will keep confidential the other party's confidential information to which it has access through the relationship, during its term and for up to [five] years afterwards, unless the law or a competent authority requires its disclosure.

17. Changes to these terms

We may update these terms. Relevant changes are announced at least [15] days in advance by email and on the Platform, and require new acceptance by the Clinic's administrator. If the Clinic does not accept, it may cancel without penalty.

18. Governing law, disputes and notices

• These terms are governed by the laws of the Republic of Colombia.
• The parties will try to resolve any dispute directly for [30] days and, failing that, may resort to conciliation or to the competent courts of [city].
• Notices are given by email: to the Clinic, at its administrator's email address; to Tu Mascota ID, at hello@tumascotaid.com.

19. Assignment and severability

• The Clinic may not assign its position without Tu Mascota ID's authorization. Tu Mascota ID may assign these terms, with prior notice to the Clinic, to a company controlled or incorporated by its owner in order to continue providing the service on the same terms.
• If any clause is found ineffective or void, the others remain in force.

20. Optional connection of the Clinic's WhatsApp number

The Clinic may connect its own WhatsApp Business number to its Tu Mascota ID panel to send and receive its customers' messages from there. The connection is optional and is made through Meta's Embedded Signup, in which the Clinic chooses whether to move the number entirely to the WhatsApp Business Platform (Cloud API) or to keep using the WhatsApp Business app on its phone at the same time ("coexistence"), and whether it authorizes sharing its contacts and up to six (6) months of prior one-to-one chat history.

• Customer consent: the Clinic will only message, via WhatsApp, people who have given it prior authorization to be contacted through that channel, will keep proof of it, and will immediately honor requests to stop receiving messages.
• WhatsApp policies: the Clinic must comply with the WhatsApp Business Terms of Service (https://www.whatsapp.com/legal/business-terms), the WhatsApp Business Messaging Policy (https://business.whatsapp.com/policy) and the WhatsApp Commerce Policy (https://www.whatsapp.com/legal/commerce-policy), as well as Colombian law, including Law 2300 of 2023 for promotional messages.
• Content: the Clinic is solely responsible for the content of the messages it sends and the templates it creates or uses from its number.
• Meta charges: any charges Meta applies to messages sent from the Clinic's number are billed by Meta directly to the payment method the Clinic registers in its WhatsApp Manager. Tu Mascota ID does not charge those fees unless otherwise agreed in writing.
• Security and disconnection: the access tokens that Meta issues when the number is connected are stored encrypted and used only to provide this service. The Clinic may disconnect its number at any time from its panel; once disconnected, Tu Mascota ID stops sending and receiving messages through it.
• Suspension: Tu Mascota ID may suspend the connection if the Clinic misuses it, breaches these terms or WhatsApp's policies, or if Meta restricts or suspends the Clinic's account or number, with notice to the Clinic except in emergencies.
• Personal data: the Clinic is the data controller of its number's conversations and Tu Mascota ID acts as data processor, under Annex 1. Tu Mascota ID does not use those conversations for its own purposes, does not sell them, and does not use them for advertising or to train artificial intelligence models. Messages also pass through Meta, which processes them under its own terms and privacy policy.
• When the subscription ends, conversations are handed over and deleted like the rest of the Clinic Data (section 15). If the Clinic only disconnects its number, it may request deletion of the stored conversations, which will be carried out within thirty (30) days, unless the law requires keeping them.

Annex 1. Personal data transmission agreement

This annex governs the processing that Tu Mascota ID (the Processor) carries out on behalf of the Clinic (the Controller) of the Families' personal data, in accordance with Law 1581 of 2012 and Decree 1377 of 2013, art. 25 (compiled in art. 2.2.2.25.5.2 of Decree 1074 of 2015).

A1.1 Purpose and scope of processing

• Data processed: Families' identification and contact details (name, ID document, phone, email, address), their pets' data, medical records, appointments, documents, signatures, payment receipts and communication permissions. If the Clinic connects its WhatsApp number (section 20), also the conversations of that number: phone number, WhatsApp profile name, user ID assigned by WhatsApp, message content and media, timestamps and delivery and read statuses and, only if the Clinic authorizes it when connecting, its contacts and up to six (6) months of prior one-to-one chat history.
• Purposes, all on behalf of the Clinic: hosting the medical record, managing scheduling and bookings, sending confirmations, reminders and documents, issuing invoices, and the other Platform functions the Clinic uses.
• Operations: collection through the Platform, storage, consultation, updating, sending communications, backup and deletion.
• Term: that of the subscription, plus the data handover period in section 15.

A1.2 Obligations of the Processor

• Process the data only according to the Clinic's instructions and for the authorized purposes, without using it for its own purposes.
• Apply the Clinic's obligations under the processing policy set by the Clinic, and process the data according to the purpose authorized by the data subjects and the applicable laws.
• Process the data, on behalf of the Clinic, in accordance with the principles of Law 1581 of 2012, and comply with the duties of art. 18 of that law.
• Safeguard the security of the databases: encryption, role-based access control, access and change logs, and backups.
• Keep the data confidential and require the same of its staff and sub-processors.
• Forward to the Clinic, as soon as received, any inquiries and claims from data subjects, and support it in handling them within the legal deadlines (Law 1581 of 2012, arts. 14 and 15).
• Apply the updates, rectifications and deletions notified by the Clinic within five (5) business days of receiving them, and flag data as "claim in progress" or "information under judicial dispute" when the Clinic so indicates (Law 1581 of 2012, art. 18).
• Grant access to the data only to the people who need it to provide the service.
• Inform the Clinic, without delay and no later than [48] hours after becoming aware of it, of any security incident affecting the data, with the information available for the Clinic to manage it, and report it to the Superintendence of Industry and Commerce within the following fifteen (15) business days, as processor.
• Designate a person or area to handle data protection matters (Decree 1377 of 2013, art. 23).
• Upon termination, return the data to the Clinic and delete it as set out in section 15, unless there is a legal obligation to keep it.

A1.3 Obligations of the Controller

• Obtain and keep the Families' authorization and provide them with the privacy notice.
• Have a data processing policy.
• Provide the Processor only with data whose processing is authorized, and keep it up to date.
• Handle data subjects' inquiries and claims and inform the Processor of what it must apply.
• Register its databases in the National Database Registry if required (Decree 090 of 2018).

A1.4 Sub-processors and international transmission

The Clinic authorizes the Processor to rely on these providers, which process the data only to provide their service:

• Supabase Inc. (database and storage) — United States.
• Vercel Inc. (application hosting) — United States.
• Resend (email delivery) — United States.
• Meta Platforms, Inc. and WhatsApp LLC (WhatsApp Business Platform), for messages sent through the Tu Mascota ID WhatsApp line and, if the Clinic connects it, through its own number — United States.
• Text message (SMS) provider, when active — [to be defined].
• Soluciones Alegra S.A.S. and Alanube (electronic invoicing) — Colombia.
• Google (maps and addresses) and Cloudflare (bot protection) — United States.

The United States is among the countries with an adequate level of data protection according to the Superintendence of Industry and Commerce (External Circular 005 of 2017). Because this agreement exists, the transmission does not require informing each data subject or obtaining their consent (Decree 1377 of 2013, art. 24).

The Processor requires each sub-processor to meet security and confidentiality obligations equivalent to those in this annex, and will notify the Clinic before adding a new one that processes Families' data.

A1.5 Access by the support team

• When the Clinic or one of its users asks for help through the support channels, the Clinic authorizes the Processor's support staff to consult the Clinic Data needed to resolve that request, including the medical record only when the request requires it.
• Access is limited to what is necessary to handle the request, is carried out only by Processor staff bound by confidentiality, and is not used for any other purpose.
• Without a request from the Clinic, the Processor does not access its patients' or Families' data, except to handle a security incident, fix a Platform failure or comply with an order from a competent authority.
• Each access is recorded in a log that cannot be deleted, with the person, the date and what was consulted. The Clinic may request the log of accesses to its data.

A1.6 Verification

The Clinic may request reasonable information about the security measures and compliance with this annex. The Processor will respond within [15] business days.