Privacy Policy

Last updated: 23 July 2026 · Version 1.1

This policy explains what personal data ResidencyTrack collects, why, how we protect it, and the rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR).

1. Who we are

ResidencyTrack is operated by ResidencyTrack, a company based in France, which is the “data controller” for the purposes of the GDPR. It is the residency-management platform for the European College of Veterinary Anaesthesia and Analgesia (ECVAA). For any privacy question or to exercise your rights, contact us at privacy@residencytrack.com.

2. Who this policy is about

This policy covers the personal data of the people who use ResidencyTrack — residents, diplomates, supervisors, and administrative staff. It does not relate to animals or their owners: clinical records you upload must be anonymised (see section 5).

3. The data we collect

• Account & identity: name, title, email, phone number, nationality, and gender (where you provide it).
• Professional details: your role, ECVAA registration number, training centre or institution, diplomate status, residency dates, and committee positions.
• Training records: the case logs, rotations, reports, presentations, publications, evaluations, and documents you create or upload as part of your residency — which must be anonymised of any client (owner) information.
• Activity: calendar entries, forum posts, and notifications within the platform.
• Security & technical: sign-in events, device and browser information, IP address, and approximate location — used to protect your account (new-device alerts, two-factor verification) and to diagnose errors.
• Consent records: a timestamped record that you accepted this policy and our Terms.

4. Why we use your data, and our lawful basis

• To provide the platform and manage your residency and ECVAA certification — performance of a contract with you.
• To keep your account and our systems secure (authentication, 2FA, alerts, monitoring) — our legitimate interest in protecting the service and its users.
• To support ECVAA’s administration of the residency and certification programme — legitimate interest.
• To meet legal obligations, and where we ask for it, on the basis of your consent (which you may withdraw at any time).

5. Client (owner) data & anonymisation

Clinical case records are for training and must be anonymised. You must remove any animal owner’s personal data — name, address, phone number, or other identifying details — before uploading. The platform requires you to confirm this each time you attach a record. We do not intend to collect owners’ personal data; if such data is uploaded contrary to this policy, please tell us and we will delete it.

6. Who we share it with

We do not sell your data or use it for advertising. We share it only with the service providers that run the platform, acting as our processors under contract:

• Supabase — secure database, authentication, and file storage (your profile, training records, uploaded documents and photos).
• Vercel — application hosting and execution.
• Cloudflare — network routing and security.
• Sentry — error monitoring, to detect and fix technical faults.
• Resend — delivery of account and notification emails (your name and email address, and the content of each message sent to you). Our emails use no open-tracking pixels (see section 11).
• Anthropic — AI assistance used only to help our team draft short internal summaries of bug reports (see section 12). It makes no decisions about you, and your data is not used to train AI models.
• Google (Google Wallet) — only if you choose to add your digital ID card to Google Wallet: your name, role, certification status, training centre, registration number, and photo (if you’ve added one) are sent to Google to create and update that pass. If you never use this feature, nothing is sent to Google.

We may also disclose data where required by law, or to ECVAA for the legitimate administration of your residency.

7. Where your data is stored & international transfers

Your database is hosted in the European Union (Frankfurt, Germany), and error monitoring is also hosted in the EU. Some providers (such as content-delivery and edge networks) may process limited technical data elsewhere; where that occurs outside the European Economic Area, it is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

8. How long we keep it

We keep your data for as long as your account is active and as needed to maintain your residency and certification record, plus any period required by law. You can ask us to delete your account and associated personal data (see section 10); some records may be retained where we have a legal obligation to do so.

9. How we protect it

Security is enforced at multiple layers: encrypted connections (TLS); passkey-based sign-in with two-factor verification for password logins and alerts on new devices; strict database-level access controls so each person sees only what they should; and tamper-resistant logs of sensitive administrative actions.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to certain processing;
• receive a copy of your data in a portable format;
• withdraw consent where processing relies on it.

To exercise any of these, email privacy@residencytrack.com. You also have the right to complain to your data protection authority — in France, the CNIL (www.cnil.fr).

11. Cookies and email tracking

We use only essential cookies needed to sign you in and keep your account secure. We do not use advertising or third-party tracking cookies — so we show no cookie banner, because we set no non-essential trackers.

Our emails do not use open-tracking pixels: we do not detect whether or when you open a message. Links in our emails may pass through a secure redirect that lets us confirm a link was clicked and that messages are being delivered correctly. We use this only for deliverability and security, on the basis of our legitimate interest — never for advertising or profiling.

12. Artificial intelligence

We use one AI feature: an assistant (provided by Anthropic) that helps our team draft a short, member-friendly note from a bug report before it is published on the “What’s new” page. It is used internally, its output is always reviewed and edited by a person, and it is clearly marked as AI-assisted. This AI does not make automated decisions about you, and your personal data is not used to train AI models. If we ever add AI that you interact with directly (such as a chatbot) or that generates content shown to you, we will make clear that you are dealing with AI.

13. Children

ResidencyTrack is a professional tool for qualified veterinary professionals, intended for adults, and is not directed at children or minors.

14. Changes to this policy

We may update this policy. If we make a material change, we will update the date and version above and, where appropriate, ask you to review it again.

15. Contact

Questions about this policy or your data: privacy@residencytrack.com. You also have the right to complain to the CNIL, the French data protection authority (www.cnil.fr). See also our Terms of Service.