Privacy Policy

1. Personal data controller

The personal data controller is Limited Liability Partnership "PetOS", BIN 260740037323, located at: 27/1 Alikhan Bokeikhan Street, apt./office 60, Yesil district, Astana, 010000, Republic of Kazakhstan (the "Operator", "PetOS").

For questions relating to the processing of personal data, the exercise of data subjects' rights, withdrawal of consent, and other matters relating to this Policy, the User may contact legal@petos.care.

The Operator determines the purposes and principal methods of processing personal data in respect of those processing activities for which it is responsible as the personal data controller.

In respect of personal data transferred to PetOS by a Clinic for processing within the scope of the B2B functionality, the allocation of the parties' roles and responsibilities is determined by a separate agreement between PetOS and the respective Clinic.

2. What data we collect

2.1. Data of pet owners (individual Users):

Depending on the Platform features used, the Operator may process the following personal data of the User:

• full name;
• phone number;
• email address;
• profile photo, if uploaded by the User;
• information provided by the User during registration and use of the Platform;
• information about the Pet provided by the User, including name, species, breed, date of birth or age, sex, and other identifying information;
• information about the Pet's state of health, vaccinations, prescriptions, clinic visits, and other information related to the Pet's veterinary care;
• information about permissions and access settings granted by the User;
• information about the User's interaction with the Platform;
• technical data necessary to ensure the operation and security of the Platform.

The User independently determines what information about the Pet to post on the Platform, except for data necessary to use certain features.

Information about the Pet's health may contain information relating to the User or other individuals, where such information is contained in veterinary records or other materials uploaded to the Platform.

2.2. Data of Family members

When using the feature for granting access to a Pet profile, the User may send an invitation to another person to grant them access.

Before the invitation is accepted, the Operator may process the minimum data necessary to send the invitation, including the phone number or email address of the invited person.

After accepting the invitation, such person becomes a User of the Platform and provides the necessary consents and confirmations independently, in the manner provided by the Platform.

The scope of information available to a Family member is determined by the access settings and the Platform's functionality.

2.3. Data of Clinics and their representatives

When the Platform is used by a Clinic, the Operator may process:

Clinic data:

• the name of the legal entity or individual entrepreneur;
• BIN or other identifier;
• legal and actual address;
• contact phone number;
• email address;
• website;
• other information necessary to conclude and perform the agreement with the Clinic.

Personal data of the Clinic's representatives and staff:

• full name;
• position or role;
• photo, if provided;
• work phone number;
• work email address;
• data necessary to create an account and manage access rights.

A Clinic's legal and other internal data is used to conclude and perform contractual relationships, billing, analytics, and operational interaction, and is not shown to Users unless otherwise provided by the Platform's functionality or the agreement with the Clinic.

In the clinic catalog and profile, Users are shown only information intended for public access, including the name, address, specialization, working hours, and contact details.

2.4. Technical data

When using the Platform, the Operator may automatically collect:

• IP address;
• device type and model;
• operating system;
• application or browser type and version;
• session and device identifiers;
• date and time of use of the Platform;
• information about actions and interaction with the Platform's features;
• technical logs and error data;
• information necessary to ensure security and prevent abuse.

Technical data is used to the extent necessary for the operation, security, diagnostics, and improvement of the Platform.

2.5. Geolocation data

When using the feature to search for clinics near the User, the Platform may request access to the device's geolocation data.

Geolocation is used to determine the User's location and display relevant clinics and other objects in accordance with the selected feature.

Geolocation is used only with the User's relevant permission and to the extent necessary for the operation of the relevant feature. The User may disable access to geolocation via device settings, although certain Platform features may then be unavailable or limited.

PetOS does not use geolocation to continuously track the User's location, unless expressly stated in the description of the relevant feature and provided for by a separate consent.

2.6. Payment data.

When the User pays for Paid features, PetOS may receive information necessary to confirm the fact of payment, identify the payment, account for the tariff, and perform the relevant contractual obligations.

At the current stage, when paying via Kaspi Pay, payment data is processed by the payment service in accordance with its own rules and privacy policy.

Unless otherwise provided by the payment infrastructure used, PetOS does not request from the User or store full bank card details.

When other payment services are connected, information about the relevant providers and the procedure for processing data may be updated in this Policy.

3. Purposes of processing personal data

The Operator processes personal data for the following purposes:

3.1. Account registration and management:

• registration and identification of the User;
• verification of a phone number or other identifiers;
• creation and maintenance of an Account;
• management of access rights.

3.2. Provision of Platform functionality:

• creation and maintenance of a Pet profile;
• storage and display of information about the Pet;
• maintenance of health, vaccination, and visit history;
• generation and delivery of reminders;
• booking appointments with Clinics;
• enabling interaction between the User and the Clinic;
• provision of other Platform features.

3.3. Supporting B2B functionality:

• creation and management of Clinic staff accounts;
• management of roles and access rights;
• maintenance of schedules and records;
• operational interaction with Clinics;
• billing and settlements.

3.4. Communications:

• sending service notifications;
• confirming appointments;
• reminders;
• messages necessary for the use of the Platform;
• responding to User inquiries.

3.5. Analytics and Platform development:

• analyzing feature usage;
• identifying technical errors;
• improving the user experience;
• developing and testing new features;
• ensuring the stability and security of the Platform.

3.6. Security and abuse prevention:

• detecting suspicious activity;
• preventing unauthorized access;
• investigating incidents;
• protecting the Platform and its users.

3.7. Compliance with legislation and protection of rights:

• compliance with the requirements of the legislation of the Republic of Kazakhstan;
• compliance with court decisions and lawful requirements of government authorities;
• handling of claims and disputes;
• protection of the rights and legitimate interests of the Operator and third parties.

3.8. Marketing communications:

If the User has given separate consent to receive marketing communications, their personal data may be used to send information about products, services, special offers, and other marketing materials.

Opting out of marketing communications does not affect the User's ability to receive service notifications necessary for the operation of the Platform.

4. Legal grounds for processing

The Operator processes personal data where an appropriate legal ground exists, including:

• the consent of the data subject, given in the manner provided by the Platform;
• the necessity of processing to conclude and perform an agreement with the User;
• the necessity to comply with obligations established by the legislation of the Republic of Kazakhstan;
• the necessity to protect the rights and legitimate interests of the Operator or third parties in cases permitted by law.

Where processing is carried out on the basis of consent, the User may withdraw such consent in the manner provided by the legislation of the Republic of Kazakhstan and this Policy.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal and does not prevent further processing of data where the Operator has another legal ground provided for by law for such processing.

If withdrawal of consent or discontinuation of processing makes it impossible to provide a particular Platform feature, that feature may become unavailable.

5. Disclosure to third parties

5.1. To support the operation of the Platform, the Operator may engage third parties — providers of infrastructure, communication, analytics, payment, and other services.

Disclosure is carried out to the extent necessary for the relevant purpose, in compliance with applicable requirements of the legislation of the Republic of Kazakhstan.

5.2. Such providers may include:

Hosting provider — hosting and operation of the Platform; data necessary for the Platform's operation.

PostHog — product analytics and usage analysis; technical data, usage events, identifiers, depending on settings.

Resend — sending email; email address, name, and content of the service message.

GREEN-API — sending WhatsApp messages; phone number and data necessary to generate the message.

Kaspi Pay — payment processing; data necessary to identify and process the payment.

GitHub — development and management of source code; access is limited in accordance with settings and security procedures.

Railway — hosting of infrastructure and software components; data necessary for the operation of the relevant infrastructure.

5.3. The list of providers may change as the Platform develops. When new categories of recipients that materially affect the processing of personal data are added, the Operator updates this Policy and, where required by law, obtains the User's additional consent.

5.4. The Operator does not sell Users' personal data.

Personal data is not transferred to third parties for advertising or other marketing purposes without an appropriate legal ground and, where required by law, the User's separate consent.

5.5. The Operator may disclose personal data to government authorities, courts, and other persons in cases provided for by the legislation of the Republic of Kazakhstan, and to protect the Operator's rights and legitimate interests in cases permitted by law.

5.6. In connection with the use of certain infrastructure, communication, analytics, and other services, the Operator may carry out cross-border transfer of personal data outside the Republic of Kazakhstan.

Such transfer is carried out only to the extent necessary for the relevant processing purpose and in compliance with the requirements of the legislation of the Republic of Kazakhstan.

The User is informed of the existence of cross-border transfer within this Policy and the Platform's mechanism for obtaining consent to the processing of personal data.

The Operator takes reasonable organizational and technical measures to ensure the security of personal data when using foreign service providers.

Where the list of categories of foreign recipients or the purposes of cross-border transfer changes materially, this Policy is to be updated, and, where necessary, the Operator obtains the User's additional consent.

6. Data retention period

6.1. Personal data is retained for the period necessary to achieve the purposes of its processing, to use the relevant Platform feature, to perform contractual obligations, and for the periods established by the legislation of the Republic of Kazakhstan.

6.2. When an Account is deleted, the Operator ceases processing personal data that is no longer required for the purposes provided for in this Policy, and deletes or anonymizes such data within a reasonable time, unless otherwise provided by law or this section.

6.3. Certain data may be retained after an Account is deleted where its retention is necessary:

• to comply with legal requirements;
• to maintain accounting, tax, and other mandatory records;
• to perform or confirm contractual obligations;
• to handle claims and disputes;
• to protect the Operator's rights and legitimate interests;
• in backup copies for the established technical retention period.

6.4. Upon expiry of the relevant retention period, data is to be deleted or anonymized in accordance with the Operator's applicable procedures.

6.5. Retention periods for certain categories of data may vary depending on the purpose and legal ground of processing.

7. Rights of the data subject

In accordance with the legislation of the Republic of Kazakhstan, the User has the right to:

• obtain information about the processing of their personal data;
• obtain information about the purposes and methods of processing;
• obtain information about the categories of personal data processed and the recipients of such data, in cases provided for by law;
• request correction of incomplete, outdated, or inaccurate personal data;
• request blocking or destruction of personal data, in cases provided for by law;
• withdraw consent to the processing of personal data;
• request deletion of their Account and related data;
• exercise other rights provided for by the legislation of the Republic of Kazakhstan.

To exercise these rights, the User may send a request to legal@petos.care.

The Operator may request additional information necessary to identify the applicant and prevent unauthorized disclosure of personal data.

Requests are reviewed within the timeframes and in the manner established by the legislation of the Republic of Kazakhstan.

8. Data protection

8.1. The Operator takes the necessary organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination, and other unlawful actions.

8.2. Access to personal data by the Operator's employees and contractors is granted on the principle of least-privilege access and is limited in accordance with the tasks they perform.

8.3. Users' access to information on the Platform is segmented according to roles and established access rights, including pet owner, Family member, Clinic staff, and administrator.

8.4. The Operator applies access control, authentication, logging, and other security measures appropriate to the nature of the data processed and the risks associated with its processing.

8.5. The Operator regularly takes reasonable measures to identify and remediate vulnerabilities, control access, and maintain the security of the Platform.

8.6. In the event a personal data security incident is identified, the Operator takes the measures provided for by law and its internal procedures to contain, investigate, and remediate the incident, and to notify the relevant persons and authorities in the cases and manner provided for by the legislation of the Republic of Kazakhstan.

9. Access to Pet data

9.1. Access to a Pet profile is granted in accordance with the User's role and the access settings provided by the Platform's functionality.

9.2. A pet owner may grant access to a Pet profile to Family members and Clinics within the available features.

9.3. Clinic staff are given access to information only to the extent of the rights granted to them and in accordance with the purpose of the relevant Platform feature.

9.4. A Clinic staff member's access may be restricted or terminated upon a change in their role, termination of their employment or contractual relationship with the Clinic, revocation of the relevant authority, or on other grounds provided for by the system or the agreement with the Clinic.

9.5. The Operator may grant technical administrators or PetOS staff access to certain data to the extent necessary for technical support, ensuring security, investigating incidents, and performing other lawful duties.

9.6. The Operator takes measures to prevent access to Pet data by persons who do not have the appropriate rights.

10. Age restrictions

The Platform is intended for use by persons who have reached 18 (eighteen) years of age.

By registering on the Platform, the User confirms that they have reached the specified age.

PetOS does not aim to independently collect personal data of minors as Users of the Platform.

If the Operator becomes aware that a minor's personal data was provided in breach of the established age restrictions, the Operator takes reasonable measures to stop the relevant processing and delete such data, in the cases and manner provided for by the legislation of the Republic of Kazakhstan.

11. Cookies and analytics

The Platform may use cookies, SDKs, and similar technologies to:

• ensure the operation and security of the Platform;
• save user settings;
• analyze use of the Platform;
• diagnose technical errors;
• improve the user experience;
• assess the effectiveness of certain features.

PostHog and other similar tools may be used for analytics.

Depending on the settings of the relevant service, analytics data may include technical identifiers, device information, Platform usage events, and other technical information.

The User may manage the use of cookies and similar technologies through browser and device settings and, where such functionality is provided by the Platform, through the relevant consent management interface.

Restricting certain types of cookies or analytics technologies may result in certain Platform features being unavailable.

12. Changes to this Policy

12.1. The Operator may periodically update this Policy in connection with the development of the Platform, changes in the technologies and service providers used, changes in legislation, or other circumstances.

12.2. The current version of the Policy is published on the Platform, indicating the date of its last update.

12.3. If changes do not affect the material terms of the processing of personal data, the new version may apply from the moment it is published on the Platform, unless the Operator specifies a different date.

12.4. In the event of a material change in the purposes of processing, categories of personal data, categories of recipients, the existence of cross-border transfer, or other conditions for which the law requires separate consent, the Operator notifies the User and obtains the necessary consent in the manner provided by law.

12.5. A history of the Policy's versions may be retained by the Operator to confirm the content of the terms of processing of personal data and the consents given.

13. Marketing communications

PetOS may send the User marketing communications about products, features, special offers, events, and other materials only where an appropriate legal ground exists and, where such consent is required by the legislation of the Republic of Kazakhstan, separate consent has been given.

The User may opt out of receiving marketing communications via the unsubscribe feature provided by the Platform or by contacting legal@petos.care.

Opting out of marketing communications does not stop the delivery of service notifications necessary for registration, Account security, appointment confirmation, operation of the Platform, and performance of contractual obligations.

14. Information about the Pet

Information about the Pet, including information on health, vaccinations, clinic visits, and prescriptions, is provided by the User or the Clinic within the scope of using the Platform.

PetOS processes such information solely for the purposes provided for in this Policy, these Terms of Use, the agreement with the Clinic, and other applicable terms.

PetOS does not use information about Pets to independently provide veterinary services.

Information about the Pet may be available to the User, Family members, and Clinics in accordance with the access rights granted to them and the Platform's functionality.

15. Data of third parties

If the User provides the Operator with the personal data of another individual, the User must have an appropriate legal ground for providing it to the Operator.

The User must not provide third parties' personal data where its provision is not required to use the relevant feature and there is no legal ground for such disclosure.

If documents uploaded by the User contain the personal data of third parties, the Operator processes it to the extent necessary to provide the relevant feature and to comply with legal obligations.

16. Contact details

Limited Liability Partnership "PetOS"

BIN: 260740037323

Address: 27/1 Alikhan Bokeikhan Street, apt./office 60, Yesil district, Astana, 010000, Republic of Kazakhstan

Email for personal data matters: legal@petos.care

Website: petos.kz

Last updated: 26.08.2026