Privacy Policy

Effective date: 24 May 2026 Last updated: 24 September 2026 Version: 1.8

This Privacy Policy explains how Kakariki Technology Limited (“Kakariki”, “we”, “us”, or “our”), a company registered in New Zealand, collects, uses, and protects information when you access Librevet and any related services we provide through librevet.com and its subdomains (together, the “Service”).

If you have any questions about this Policy or our handling of your information, contact us at info@ktech.co.nz.

1. Who this Policy applies to

The Service is intended for veterinary professionals and personnel working under their direction. You must be a qualified veterinarian, veterinary surgeon, veterinary technician, or comparable professional to create an account. The Service is not directed to consumers, members of the public, or children under 18.

2. Information we collect

We collect the following categories of information.

Account information. When you register, we collect your name, email address, and confirmation that you are a veterinary professional. If you sign in using Google, we receive your basic Google profile (name, email, profile picture URL) via the OAuth scope you authorise.

Case and imaging data. When you create a case in Librevet, we store the radiographic images you upload, together with the metadata and notes you choose to associate with that case. This metadata may include patient (animal) details, owner name, clinic name, anatomical region, free-text notes, measurements, annotations, and saved planning artefacts (reference lines, implant placements, osteotomies).

Technical information. We collect standard application logs needed to operate the Service, including timestamps of requests, error reports, browser and device identifiers, and the Internet Protocol address associated with your sessions. We use these for security, debugging, and abuse prevention.

Communications. When you contact us by email or submit feedback through the in-app feedback widget, we store the content of those communications.

The Ortho 3D list. If you ask on librevet.com/ortho-3d to be told when Librevet Ortho 3D is ready, we keep the name and email address you give us, and the date you gave them. We do not ask for anything else, and you do not need an account.

We do not intentionally collect special-category personal data about you (such as health or biometric data about a human subject). We do not knowingly collect or process personal data of children.

3. How and why we use your information

We use the information we collect for the following purposes, on the following legal bases.

4. The Machine Learning Programme (opt-out)

To improve diagnostic and planning algorithms in our products, we use de-identified veterinary imaging data uploaded to the Service to develop, train, evaluate, and improve machine learning and artificial intelligence models. As Librevet is provided at no cost, contribution of de-identified data is part of how we sustain and improve the Service, and is enabled by default.

You may opt out at any time. To do so, turn off the “Contribute imaging data to AI development” switch under Account → Privacy & Data. Opting out stops any future use of your data for the ML Programme but does not require us to retrain or remove your contributions from models that have already been trained at the time you opt out.

Status as at 22 August 2026: the ML Programme is paused and no data has ever been used for it. No model has been trained on your data, and nothing has been exported for training. An earlier version of this section described the de-identification process below as already in place. It is not yet built, and we have corrected this statement rather than leave it standing.

Before any of your data is used in the ML Programme, we will de-identify it to the DICOM PS3.15 confidentiality profile, including removal of text burned into the image itself: case identifiers, patient names, owner names, microchip numbers, clinic identifiers, and the free-text content of your notes. Only the imaging data and structured non-identifying clinical metadata (anatomical region, species, age category, measured angles, and similar) will be retained for training. We will not restart the programme until that process is built, tested and independently reviewed.

If you would like specific previously-uploaded cases excluded from future training cycles, contact us using the details in section 13.

If and when the programme restarts, we intend to rely on legitimate interests (Article 6(1)(f) GDPR / equivalent UK GDPR provision). An earlier version of this section said a balancing test had been conducted. That was inaccurate: the assessment is being carried out now, with legal advice, and the programme stays paused until it is complete and passes. If it does not pass, the programme will not restart on that basis.

Two things we want to be plain about, because they affect people who are not our users. Where imaging carries information about an animal’s owner, the owner is the person whose data it is — and the surgeon’s account toggle is not that person’s objection. Any restart will include a route for owners themselves, arranged through their veterinary practice. Separately, while we hold the original clinical files alongside any training copy, that copy is pseudonymised rather than anonymous in our hands, and we treat it as personal data accordingly.

Users in the EU/UK/Switzerland have the right under Article 21 GDPR to object; the switch under Account → Privacy & Data remains available and takes effect immediately.

5. Email communications

Transactional emails (account verification, password reset, security notices, critical service announcements) are necessary to operate your account and are sent without separate marketing consent.

Marketing emails (product news, feature announcements, educational content, surveys) are sent to all users as part of the existing service relationship under the soft opt-in exception permitted by the EU ePrivacy Directive, UK PECR, and equivalent provisions in other jurisdictions. Every marketing email includes a one-click unsubscribe link. You may also opt out at any time with the “Marketing Emails” switch under Account → Privacy & Data. Opting out takes effect within 48 hours.

The Ortho 3D list. If you joined it, we will email you when Librevet Ortho 3D is ready. That is the only thing the list is used for. We do not send an email when you join.

6. Sharing with third parties

We do not sell your personal information. We share information only with the categories of recipient below, and only as needed to operate the Service.

Infrastructure and platform providers.

• Google LLC and its affiliates — we host the Service on Google Cloud Platform, including Firebase Authentication, Cloud Firestore, Cloud Storage, and Cloud Run. Google processes your data on our behalf under data processing terms.

• Google LLC — Google Workspace — we send transactional and marketing emails through our Google Workspace account. Email addresses and message content are processed by Google on our behalf.

• Google LLC — AI models (Vertex AI on Google Cloud, and the Gemini API) — three features use them, and each runs only when somebody asks it to; if nobody does, nothing is sent.

  • Drafting a history. The clinical notes on the case are sent to produce a draft. We remove the patient’s and owner’s names before the request is built, but free text is free text and that removal cannot be guaranteed to be complete, so please do not rely on it to enter identifying details you would not otherwise share. Any attached document you tick — a referral letter, scanned pages, a Word document — is read as it is, including any names and addresses in it; the app says so beside the documents before you draft. Documents go only to Vertex AI.
  • Help answers. The question you type in the Help panel, together with extracts from our own help articles.
  • The specialist’s desk. When a specialist answering a case asks for a summary or a draft of their report, the material the referring vet sent — including attached documents — and the specialist’s own notes. This goes only to Vertex AI.

  Vertex AI is part of Google Cloud, under the same data processing terms as the hosting above. Where Vertex AI cannot answer, a draft history or a help answer may be produced by the Gemini API instead, a separate Google product with its own terms.

• Stripe, Inc. — we use Stripe to take payment for paid tiers and specialist opinions. Stripe receives your name, email address, billing details, and the card details you enter directly into Stripe’s own payment form. We do not receive or store your full card number. Stripe acts as an independent controller for fraud prevention and regulatory purposes, under its own privacy policy.

Specialists you send a case to. If you request a specialist opinion, the case you select — including its imaging, your measurements, and any clinical notes you attach to that request — is made available to the board-certified specialist who takes it, and to no one else. Specialists are independent professionals bound by confidentiality obligations to us and by their own professional obligations. This sharing happens only when you initiate it, case by case. If you never request an opinion, no specialist sees any of your data.

Suppliers you send a case to. If you send a case to a supplier — a manufacturer or a wholesaler — for its recommendation, that supplier sees your name, your practice, your country, your question, the films and videos and your plan on them, and the animal and its clinical record — its name, species, breed, age and weight, and what you have recorded about it, such as its history, examination, assessment, plan and medications. By default the owner’s details are hidden — their name and contact details, which are also taken out of the case’s name and the animal’s — and the case’s attachments are sent only if you choose to send them. What you have typed into the record, the videos and any attachment you send go as they are, so a name in them is not hidden. If you untick “Hide the owner’s details”, the supplier sees the whole case, with its attachments. A supplier that takes cases from its own customers only also sees the account number you give it. This happens only when you send a case, one case at a time. A supplier’s advice is not independent: it sells what it recommends.

Colleagues you share a case with. A case is visible to another user only where you share it or invite them to it. We do not share cases between users on our own initiative.

Suppliers with a template library. Where a supplier maintains an implant template library in the Service, it receives aggregate counts of how often its own templates were placed, bucketed by month. The counts identify no animal, owner, clinician, clinic or case, and a monthly bucket touched by fewer than five distinct surgeons is not returned at all. A supplier cannot see anything about another supplier’s templates.

Apart from those counts, a supplier learns about you only from what you send it. If you message a supplier, it sees your name and what you write, never your email address, and a supplier cannot start a conversation with you. If you send it a case for a recommendation, it sees what is described under Suppliers you send a case to above.

Legal and safety recipients. We may disclose information if compelled by a valid legal order, where necessary to protect the safety of any person, to investigate fraud or abuse of the Service, or to enforce our Terms of Service. We will challenge overbroad requests where appropriate.

Successor entity. If we are involved in a merger, acquisition, asset sale, or insolvency, your information may be transferred to a successor entity, subject to a privacy policy at least as protective as this one.

We do not share your information with advertising networks, data brokers, or analytics platforms beyond what is described above.

7. Where your data is stored, and international transfers

Imaging data (radiographs, CT studies, case attachments, and specialist reports) is stored in the Google Cloud Storage bucket for your region. Since 21 August 2026 there are three, and which one your images go to is decided by the country on your account:

We chose regional storage primarily so that large studies load quickly for the person reading them, and holding data closer to you follows from that. Two limits on it, which we would rather state than leave you to discover:

• Images uploaded before 21 August 2026 stayed where they were written, which for almost every case means Sydney. Moving them would break the links that find them. If you need an existing case’s images moved to your region, contact us using the details in section 13.
• The region applies to images only. The records in the next paragraph are not regional, and neither is your sign-in record.

Account, case-metadata, and operational records (Cloud Firestore — including patient and owner names, your clinical notes, measurements and planning data) are stored in a Google Cloud region in the United States (us-west1), for every user wherever you are. Your authentication record (email address, name, and sign-in history) is held by Google Firebase Authentication, also in the United States. Neither of these can be moved to another region on the platform we use, and we are not going to imply otherwise: if you need European-only storage of case records, tell us before you subscribe. So your data crosses borders in the ordinary course of using the Service. Where personal data of users in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not been recognised as providing an adequate level of protection, the transfer is conducted under the European Commission’s Standard Contractual Clauses (2021) (or the UK Addendum thereto) as supplemented by appropriate technical and organisational safeguards (encryption in transit and at rest, access controls, and audit logging).

You may request a copy of the relevant transfer mechanism by contacting us.

8. How long we keep your data

We retain your account information for as long as your account remains active. If you delete your account, we delete or anonymise your personal data within 90 days, except where we are required to retain it to comply with a legal obligation, to resolve disputes, or to enforce our agreements.

Case and imaging data that you delete from within the Service is removed from active storage within 30 days and from backup storage within a further 90 days.

Your name and email address on the Ortho 3D list are kept until we have sent the email telling you Librevet Ortho 3D is ready, and the list is then deleted. To be taken off it sooner, email info@ktech.co.nz. If you close a Librevet account that uses the same email address, you are taken off the list at the same time.

Anonymised data used in the ML Programme is retained as part of the trained models indefinitely; once data has been anonymised, we cannot re-associate it with you.

9. Your rights

Depending on where you live, you have the following rights with respect to your personal information. To exercise any of these rights, contact us at info@ktech.co.nz. We will respond within 30 days.

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may ask us to correct information that is inaccurate or incomplete.
• Deletion. You may ask us to delete your personal information, subject to legal limitations.
• Portability. Where the data is held on the basis of consent or contract and is processed by automated means, you may request a machine-readable export.
• Objection and restriction. You may object to, or ask us to restrict, certain processing.
• Withdraw consent. Where processing is based on your consent, you may withdraw that consent at any time. Note that the two settings people most often ask about do not run on consent: the ML Programme relies on legitimate interests (section 4) and marketing email on the soft opt-in exception (section 5). Both are switched off by the toggles described in those sections, and for the ML Programme that toggle is how you exercise the Article 21 right to object.
• Complain. If you are unhappy with our handling of your information, you have the right to lodge a complaint with your local supervisory authority — for example, the Office of the Privacy Commissioner of New Zealand (privacy.org.nz), the Information Commissioner’s Office in the United Kingdom (ico.org.uk), the Office of the Australian Information Commissioner (oaic.gov.au), or the relevant data protection authority in your EU member state.

10. Security

We protect your information using industry-standard safeguards, including:

• Transport-layer encryption (HTTPS) on all connections
• Encryption at rest for all Cloud Storage objects and Firestore documents
• Mandatory account-level access controls enforced by Firebase Authentication
• Multi-factor authentication available on all accounts via Google Sign-In
• Principle-of-least-privilege access for our staff
• Continuous logging and monitoring of administrative actions

No system is ever perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the timeframes required by applicable law.

11. Cookies and similar technologies

The Service uses only the cookies and local storage strictly necessary to operate the application — primarily, the session cookie set by Firebase Authentication to keep you signed in. We do not use advertising cookies, tracking pixels, third-party analytics cookies, or social-media trackers.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in the Service or applicable law. When we make material changes, we will notify you by email and update the “Effective date” at the top of the page. The current version is always available at librevet.com/privacy.

13. Contact

Questions, complaints, and rights requests:

Kakariki Technology Limited Email: info@ktech.co.nz Postal: Kakariki Technology Limited
c/o BDO Auckland
Level 2, 116 Harris Road
East Tamaki
Auckland 2013
New Zealand

For users in the European Economic Area, the United Kingdom, or Switzerland: we have not appointed a representative under Article 27 GDPR at this time. We will appoint a representative if and when our user base in those regions reaches the threshold that requires one.