Security & Compliance
How PetChart protects your clinic's data today.
Last updated: October 28, 2026
Encryption
AES-256 encryption at rest. TLS 1.2+ for all data in transit. All production data paths are encrypted.
Access Controls
Admin and staff roles, with each clinic's records walled off in the database itself.
Change History
Changes to medical records, prescriptions and invoices are kept with who made them and when.
Important Notice
PetChart provides security tools and infrastructure controls to help veterinary practices manage their data. Each practice is responsible for configuring these controls appropriately for their specific regulatory obligations, including AVS requirements and data protection laws such as Singapore's PDPA. PetChart does not provide legal, regulatory, or compliance advice. Practices should consult qualified legal counsel to determine their specific obligations.
1. Security Architecture
PetChart's infrastructure is built on a defense-in-depth security model. The platform employs multiple layers of technical controls to protect data confidentiality, integrity, and availability. The controls below describe how PetChart works today.
2. Technical Safeguards
Data Encryption
- All data encrypted at rest using AES-256 encryption via the underlying infrastructure provider.
- All data transmitted over TLS 1.2 or higher. No plaintext data transmission paths exist.
- Encrypted backups of the database run every night.
Authentication & Access Control
- Row-level security (RLS) policies keep each clinic's records walled off from every other clinic at the database layer, and an automated test checks every table for this.
- Two roles: admins and staff. Only admins manage the team, the price list, stock counts and write-offs, refunds, voids and GST filing.
- Roles are stored on each clinic membership, and only a clinic's admins can change them.
- Accounts are invite-only; there is no public sign-up.
- Public forms and the AI vet reference are rate-limited.
Monitoring & Audit
- Changes to medical records, prescriptions and invoices are kept in a history with who made them and when.
- Controlled-drug and stock entries are kept in a permanent ledger: they can't be edited or deleted, and each records who made it.
- Payments can't be deleted; refunds are recorded as new entries by admins.
3. Administrative Safeguards
- Admins invite staff by email and choose their role.
- Removing someone from the clinic ends their access immediately.
- Role changes must be confirmed, and a clinic always keeps at least one admin.
4. Infrastructure & Physical Security
PetChart is hosted on cloud infrastructure provided by established third-party providers that maintain industry-standard certifications (including SOC 2 and ISO 27001). Physical security of data center facilities, including access monitoring, environmental controls, and redundancy, is managed by these infrastructure providers under their respective compliance programs.
PetChart does not independently certify, audit, or guarantee the physical security controls of its infrastructure providers. Practices requiring specific infrastructure certifications should review the compliance documentation of the underlying providers directly.
5. Data Protection & Privacy
- Clients, pets and visits are archived rather than deleted.
- Invoices in a GST period marked as filed are locked against changes until an admin reopens the period with a reason.
- The AI vet reference sends only the question. Phone numbers, emails, NRICs and microchip numbers are removed first, and question text isn't stored.
- Owners can stop reminder emails from a link in each email.
6. Regulatory Alignment
PetChart provides technical controls that may assist practices in meeting various regulatory requirements, including AVS requirements and Singapore's Personal Data Protection Act (PDPA).
The platform includes technical and administrative controls for securing sensitive veterinary data. Practices are responsible for determining applicable regulatory requirements and ensuring their own compliance program meets all obligations.
The controlled-drug log records each use against a patient and prints a register to keep alongside your bound register. It doesn't replace the bound register, and practices remain responsible for their own controlled-drug record keeping.
7. Incident Response
PetChart maintains incident response procedures for identified security events. In the event of a confirmed data breach affecting practice data, PetChart will notify impacted practices in accordance with applicable laws and the terms of any applicable agreements. Notification timelines and procedures are subject to the requirements of the applicable jurisdiction.
PetChart's incident response obligations are limited to events within PetChart's direct control. Practices are responsible for their own incident response procedures related to their use of the platform, including unauthorized access resulting from compromised practice-managed credentials.
8. Shared Responsibility
Security is a shared responsibility between PetChart and the practices using the platform.
PetChart Responsibilities
- Platform infrastructure security
- Encryption implementation
- Access control enforcement at the application layer
- Security patching of platform components
- Audit logging infrastructure
Practice Responsibilities
- Configuring appropriate user roles and permissions
- Managing staff credentials and access
- Removing people who leave the clinic
- Compliance with applicable laws and regulations
- Staff security awareness and training
9. Limitation of Liability
The security controls and compliance-related features described on this page are provided as part of the PetChart platform and are subject to the terms and limitations set forth in PetChart's Terms of Service. Nothing on this page constitutes a warranty, guarantee, or certification of compliance with any specific regulatory framework. PetChart's liability is limited as set forth in the applicable agreement between PetChart and the practice.
10. Contact
Security & Compliance Inquiries
For security concerns, vulnerability reports, or compliance inquiries, contact us at support@pet-chart.com.