Privacy Notice
Effective 3 September 2026 · Operated by Raidical Ltd.
At a glance
This summary highlights the key points. The full detail follows below and prevails in the event of any inconsistency.
- For most of the clinical data flowing through Ask Arlo (consultation audio, clinical notes, patient records, pet-owner details), your veterinary practice is the data controller and Raidical Ltd. is a processor acting only on the practice's instructions. For those matters, exercise your rights through your practice.
- Raidical Ltd. is the controller for your account, your Style Profile, your Brains reference uploads, and usage data. This notice is addressed to you in that capacity.
- Some data is transmitted to sub-processors located outside the United Kingdom. Where that happens, the transfer is governed by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Section 8 lists each sub-processor by name.
- Your clinical data is never used to train third-party AI models. We do not sell personal data.
- You can reach us at privacy@askarlo.co.uk and we respond to rights requests within one calendar month.
1. Who We Are and How to Contact Us
Ask Arlo is operated by Raidical Ltd., a company registered in England and Wales under company number 16694183, with its registered office at 3 Wimpole Street, London, W1G 9SQ.
| Data protection | privacy@askarlo.co.uk |
|---|---|
| Copyright and IP | For intellectual property and copyright matters relating to the Brains feature: copyright@askarlo.co.uk |
| ICO registration | Registered with the Information Commissioner's Office as a data controller, registration number ZC130367. |
2. Definitions
| Personal Data | Any information relating to an identified or identifiable living individual, as defined in UK GDPR Article 4(1). |
|---|---|
| Special Category Data | Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health data, sex life or sexual orientation data, as defined in UK GDPR Article 9(1). |
| Animal Health Information | Information about the health, treatment, diagnosis, or clinical history of an animal. Animal health information is not special category personal data under UK GDPR. It may, however, be linked to personal data about the animal's owner. |
| Voice / Audio Data | Recordings of speech captured through the AI Scribe feature during or before a consultation. |
| Clinical Notes Transcription Data | Structured clinical notes generated by the AI Scribe feature from voice/audio recordings. |
| Style Profile | A mathematical representation (embeddings) of a vet's writing style, created from examples of their previous notes or writing, used solely to personalise that vet's clinical-note output. |
| Brains Content | Reference documents (journals, research papers, clinical guidelines) uploaded by a vet or pre-loaded by Ask Arlo into the Brains feature for knowledge-recall purposes. |
| Pet Travel Data | The patient details (such as species, breed, microchip number, and vaccination or treatment dates) and any owner or destination details entered into, or used by, the AI Pet Travel feature to generate destination-specific travel and export requirement checklists. It also includes the travel queries submitted to that feature. |
3. Our Role
Raidical Ltd. acts as a data controller for the following categories of personal data:
- account data (name, email address, professional credentials, subscription details);
- authentication data (login credentials, session tokens);
- service-administration data (billing, support communications);
- usage and log data (feature usage, access logs, error reports); and
- marketing data (email addresses and preferences for marketing communications, where consent has been given).
Raidical Ltd. acts as a data processor for all clinical content and practice or pet-owner data that a vet or practice enters or syncs into Ask Arlo. This includes:
- consultation audio recordings and transcripts;
- clinical notes;
- patient records;
- pet-owner contact details;
- invoice data accessed via a practice management system (PMS) integration; and
- pet-owner and patient details pulled from your practice's PMS and processed by the AI Pet Travel feature to generate travel requirement checklists.
In each of these cases, the veterinary practice is the data controller. Raidical Ltd. processes this data solely on the practice's documented instructions, under a Data Processing Agreement (DPA).
Where an enterprise or institutional customer (such as a veterinary group, corporate practice, or educational institution) deploys Ask Arlo to its staff, that organisation is the data controller for account provisioning and related administrative data, and Raidical Ltd. acts as data processor for that data. This does not change the position for clinical, patient, or pet-owner data, which continues to be governed by the controller and processor roles set out elsewhere in this section.
This notice is addressed primarily to individual users, namely vets, veterinary nurses, and veterinary students, in relation to the data for which Raidical Ltd. is a controller, as set out above. For data processed on behalf of your practice, where Raidical Ltd. acts as a processor, please refer to your practice's own privacy notice.
4. What Personal Data We Collect
| You provide directly | Registration details: name, professional or student credentials, email address, job role (veterinary surgeon, veterinary nurse, or student), practice name, and subscription/payment information. Support and communications: messages you send to our team. Marketing preferences: your consent choices for marketing emails. |
|---|---|
| Collected automatically | Usage and log data: features accessed, query types (not content), timestamps, device and browser type, IP address, session duration, and error logs. Authentication data: session tokens and login events. |
| Via the AI Chatbot | The text of queries you submit. You are instructed not to include patient or owner identifiers in chatbot queries. If you do include such information, it will be processed as described in this notice. |
| Via the AI Scribe | Voice/audio recordings made within the app, and the structured clinical notes generated from those recordings. This data relates to your clinical work; Raidical Ltd. processes it as a processor on behalf of your practice. |
| Via the Pre-Consult Summary | Previous consultation notes you enter or paste directly, or notes retrieved from your practice's PMS via a PMS integration. PMS-retrieved notes are processed only for the duration of that session and are deleted at session end. They are not retained after the session. |
| Via AI Pet Travel | Patient details used to generate a travel checklist, such as species, breed, microchip number, and vaccination or treatment dates; pet-owner details pulled from your practice's PMS where your practice has instructed the feature to use them, such as owner name and contact details, and destination and travel-timing details; and the travel queries submitted to the feature. PMS-sourced details are processed by Raidical Ltd. as a processor on your practice's documented instructions, in the same way as other PMS-sourced data described in this notice. The travel requirement information itself is compiled by Raidical Ltd. from official government and regulatory sources. |
| Style Profile data | Examples of your previous clinical notes or writing, used to build your Style Profile, and the Style Profile itself (mathematical embeddings of your writing style). The Style Profile is personal data and is attributed to you individually. |
| Brains uploads | Reference documents you upload (journals, research papers, clinical guidelines) and embeddings derived from those documents for knowledge-recall search. Uploaded documents may contain incidental personal data (for example, author names on published papers). This is published, low-risk data processed under legitimate interests. |
| Via PMS integration | Where your practice enables a PMS integration, Raidical Ltd. may access owner contact details, patient records, and invoice data held in that system. Raidical Ltd. is a processor for this data; your practice is the controller. |
| About pet owners | Pet-owner names and contact details are personal data and are treated as such throughout this notice, even though the animal health information itself is not special category data. |
| Special category data | Ask Arlo does not intentionally collect special category personal data about users. If special category data about a pet owner or third party appears incidentally in clinical notes or audio recordings, it is processed by Raidical Ltd. as a processor on behalf of your practice. |
5. How and Why We Use Your Data
| AI Scribe | When you use AI Scribe to record a consultation, we delete the audio recording as soon as you review and approve the clinical note it generates. We do not keep the audio after that. |
|---|---|
| Pre-Consult Summary | This feature shows you your previous consultation notes exactly as they were written. It does not use AI to summarise or interpret them. If the notes come from your practice management system, we use them only during that session and delete them when the session ends. |
| Style Profile | Your Style Profile reflects your writing style and is used only to personalise your own notes. We do not share it with other users or practices, and we do not use it to train AI models. You can delete it at any time without closing your account. |
| Brains | Documents you upload to Brains are visible only to you. We do not share them with other users or practices, and we do not use them to train AI models. If you delete a document, we also delete the data we derived from it. |
| AI Pet Travel | We build the travel requirements from official government sources. Those authorities do not receive any of your data. Requirements are set by the destination country and can change, so the feature gives you general information to review and verify, and does not guarantee that a checklist is complete or up to date. |
6. Legal Bases Summary
The table below maps each processing purpose to its lawful basis. For legitimate interests, we also describe the interest pursued.
| Account creation and management | Processing: Creating and managing user accounts, authentication credentials, and profile data necessary to provide the service.Our role: ControllerLawful basis: Art. 6(1)(b), contract |
|---|---|
| Service delivery (chatbot, scribe, pre-consult) | Processing: Operating the AI chatbot for knowledge-recall queries, the AI Scribe for clinical-note transcription, and the pre-consult summary feature.Our role: Controller for account-linked query logs; processor for clinical contentLawful basis: Art. 6(1)(b), contract |
| Clinical content processed on the practice's behalf | Processing: Processing consultation audio, transcripts, clinical notes, patient records, and owner contact data as a processor. The lawful basis for this processing rests with the veterinary practice as data controller.Our role: Processor; the practice is controllerLawful basis: Art. 6(1)(b) contract or Art. 6(1)(f) legitimate interests, determined by the practice as controller. Ask Arlo processes under Art. 28 as processor on documented practice instructions.Legitimate interest: Where the practice relies on Art. 6(1)(f). |
| Usage and log data | Processing: Collecting application logs, error reports, and usage metrics to monitor service reliability, diagnose issues, and improve product performance.Our role: ControllerLawful basis: Art. 6(1)(f), legitimate interestsLegitimate interest: Ensuring the security and reliability of the service and enabling ongoing service improvement. |
| Style Profile creation and personalisation | Processing: Processing examples of a vet's previous notes to generate mathematical style embeddings that personalise clinical-note output for that individual vet.Our role: ControllerLawful basis: Art. 6(1)(f), legitimate interestsLegitimate interest: Providing a personalised clinical-note drafting experience for the individual vet. |
| Brains uploads and embeddings | Processing: Processing vet-uploaded reference documents (journals, guidelines, research papers) and generating vector embeddings to enable knowledge-recall queries within the vet's own Brain.Our role: ControllerLawful basis: Art. 6(1)(f), legitimate interestsLegitimate interest: Enabling accurate, personalised knowledge-recall for the vet from their own reference material. |
| AI Pet Travel checklists | Processing: Processing patient, owner, and destination details pulled from the practice's PMS to generate destination-specific travel and export requirement checklists, and operating and improving the travel-requirement engine using non-identifying query and usage data.Our role: Processor for PMS-sourced data (the practice is controller); controller for operating and improving the feature using non-identifying dataLawful basis: Art. 6(1)(b) contract or Art. 6(1)(f) legitimate interests for practice-instructed processing (basis determined by the practice as controller); Art. 6(1)(f) legitimate interests for operating and improving the feature.Legitimate interest: Providing and improving an accurate, current travel-requirement tool for veterinary professionals. |
| Incidental personal data in Brains documents | Processing: Processing author names and other incidental personal data appearing in uploaded reference documents, for example published academic papers.Our role: ControllerLawful basis: Art. 6(1)(f), legitimate interestsLegitimate interest: Published, low-risk data necessarily processed as part of handling the uploaded reference document; no separate use is made of it. |
| Marketing emails | Processing: Sending promotional communications and product update emails to users who have given their consent.Our role: ControllerLawful basis: Art. 6(1)(a), consent |
| Business continuity and security | Processing: Maintaining service availability, performing backups, monitoring for threats, and implementing access controls to protect the service and its users.Our role: ControllerLawful basis: Art. 6(1)(f), legitimate interestsLegitimate interest: Protecting the integrity and continuity of the service and safeguarding users' data. |
| Sharing with prospective business buyers | Processing: Disclosing relevant data to prospective acquirers or investors during M&A due diligence, subject to confidentiality obligations.Our role: ControllerLawful basis: Art. 6(1)(f), legitimate interestsLegitimate interest: Legitimate M&A due diligence; disclosures are subject to appropriate confidentiality obligations. |
7. Who We Share Your Data With
We share personal data only where necessary and always with appropriate safeguards in place. Recipients include:
- AI and infrastructure sub-processors, to deliver the features described in Section 5. See the full sub-processor table in Section 8.
- Your practice (where applicable), as clinical content and usage data relevant to your practice may be shared with the practice as the data controller, under a DPA.
- Regulatory bodies and law enforcement, where we are legally required to disclose data, for example to the ICO or a court.
- Prospective buyers or investors, in the event of a merger, acquisition, or sale of Ask Arlo, where data may be disclosed during due diligence subject to strict confidentiality obligations. We will notify affected users if a transaction results in a change to this notice.
- Professional advisers, being lawyers, accountants, and insurers where strictly necessary, bound by confidentiality.
We do not sell your personal data to third parties.
8. Sub-Processors and International Transfers
Ask Arlo uses third-party AI and infrastructure sub-processors, several of which are located outside the United Kingdom. Data is transmitted to these third parties as part of delivering the service.
All sub-processors are required to process data only on our documented instructions. Sub-processors are not permitted to use your data to train their own AI models.
| Anthropic (Claude) | Data processed: Prompts and clinical text, for chat answers, note drafting and checking.Location: USA |
|---|---|
| OpenAI | Data processed: Document and query text, to generate search embeddings.Location: USA |
| Voyage AI | Data processed: Query and candidate passage text, to re-order search results by relevance.Location: USA |
| Deepgram | Data processed: Consultation audio, for speech-to-text.Location: EU |
| Qdrant Cloud | Data processed: Embeddings, text and metadata, as the search index.Location: UK, London |
| Supabase | Data processed: Application data and images: the primary database and file storage.Location: EU, Stockholm (AWS eu-north-1) |
| Vercel | Data processed: Request metadata and logs, as the application host.Location: EU, Stockholm |
| Render | Data processed: Documents and audio relay, for background processing.Location: EU, Frankfurt |
| Scrapfly | Data processed: Public government guidance URLs read for AI Pet Travel. No practice, patient or owner data is sent.Location: USA |
| Firecrawl | Data processed: Public government guidance URLs read for AI Pet Travel. No practice, patient or owner data is sent.Location: USA |
| Resend | Data processed: Recipient email address and message body for service emails such as access codes. No clinical content.Location: USA |
| Cloudflare Turnstile | Data processed: A challenge token and the requesting IP address, to protect public forms from bots. No clinical content.Location: Global edge |
| Calendly | Data processed: The booking details you enter on our demo scheduler (name, email, chosen time). Loads as you scroll to the booking section, whatever your cookie choice - see section 6.1 of the Cookie Policy.Location: USA |
| Google Analytics | Data processed: Website usage measurement. Loads only if you allow Analytical cookies.Location: USA |
| Amplitude | Data processed: Product analytics and Session Replay, anonymised with all text masked. Loads only if you allow Analytical cookies.Location: EU data region |
| Meta (Facebook) | Data processed: Advertising measurement: that an anonymous browser reached a public page or opened our demo booking section, so we can tell which Facebook and Instagram ads work. Sent both by a pixel in your browser and, because browsers increasingly block it, from our own server via Meta's Conversions API - the server copy also carries your IP address and browser type so the two count as one visit. No name, email or phone number is sent, and automatic matching is disabled. Both run only if you allow Advertising cookies, and only on our public pages - never inside the clinical app, so no patient or case page is reported. See section 6.4 of the Cookie Policy.Location: USA |
| PMS provider (optional) | Data processed: Owner, patient and invoice data, only where your practice chooses to connect its own system (ezyVet, Provet Cloud).Location: Per the provider's terms |
| OpenAlex, Europe PMC, Crossref | Data processed: Search terms and DOIs only. No patient or owner data.Location: EU and US public APIs |
The AI Pet Travel feature compiles requirement information from official government and regulatory websites. These are public sources accessed by Raidical Ltd.; they are not sub-processors and do not receive any personal data.
Safeguards for international transfers. Transfers of personal data outside the UK to the countries listed above are safeguarded by the UK International Data Transfer Agreement (IDTA) or, where applicable, the UK Addendum to the EU Standard Contractual Clauses (SCCs), together with supplementary technical and organisational measures.
9. Retention Schedule
The table below summarises how long we keep different types of personal data.
| Account data | Duration of account, then 2 years after the account becomes inactive; billing data 6 years from the end of the relevant tax year. |
|---|---|
| Authentication / session data | Session end; security logs 12 months from creation. |
| AI Chatbot query text | 12 months from the date of the query. |
| AI Scribe audio recordings | Not stored. Consult audio is streamed to the transcription provider and never written to our storage. |
| AI Scribe consult transcripts | Retained with the note they belong to, per the practice's instructions (Raidical Ltd. is processor). Deleting a note hides it from the practice's list; contact us to have the underlying transcript erased. |
| AI Scribe generated clinical notes | Per the practice's instructions (Raidical Ltd. is processor). |
| Pre-Consult Summary, manually entered notes | Per the practice's instructions. |
| Pre-Consult Summary, PMS-sourced notes | Deleted at session end; not retained after the session. |
| Style Profile (embeddings) | Until the vet requests deletion or account closure, whichever is earlier. |
| Brains uploads (user documents and embeddings) | Until the vet deletes the content or closes the account, whichever is earlier. Deletion removes the document and the derived embeddings. |
| PMS-accessed data (owner, patient, invoice) | Per the practice's instructions (Raidical Ltd. is processor); Pre-Consult use is session-only. |
| Usage and log data | 12 months from creation. |
| Marketing data | Removed from active marketing lists within 30 days of withdrawal; a suppression record (the email on a do-not-contact list) is kept for 12 months to prevent accidental re-contact. |
| AI Pet Travel, PMS-sourced pet-owner and patient details | Deleted at session end; not retained after the session, consistent with other PMS-sourced data. |
| AI Pet Travel, travel queries and usage data | 12 months from the date the checklist is generated, then deleted or anonymised. |
10. Security
We apply technical and organisational security measures proportionate to the risk, including:
- encryption of data in transit (TLS) and at rest;
- access controls limiting staff access to personal data on a need-to-know basis;
- Data Processing Agreements (DPAs) with all sub-processors;
- regular review of sub-processor security practices; and
- audit logging of access to sensitive data.
No internet-based transmission or storage system is entirely secure. If you have concerns about the security of your data, contact us at privacy@askarlo.co.uk. Data is transmitted to and processed by the third-party sub-processors listed in Section 8.
11. Your Rights
Under UK GDPR, you have the following rights in relation to personal data for which Raidical Ltd. is the controller. For data processed on behalf of your practice, where we are a processor, please contact your practice directly; they are the controller and are responsible for handling your rights request in relation to that data.
- Right of access: you can ask us for a copy of the personal data we hold about you.
- Right to rectification: you can ask us to correct inaccurate personal data or complete incomplete data.
- Right to erasure ("right to be forgotten"): you can ask us to delete your personal data where there is no longer a lawful reason to hold it. We will comply unless an exception applies, for example a legal obligation to retain.
- Right to restriction: you can ask us to restrict processing of your data in certain circumstances, for example while accuracy is contested.
- Independent right to delete your Style Profile: you can request deletion of your Style Profile (writing-style embeddings) at any time, independently of your account. Deleting your Style Profile does not close your account or affect access to other features. To exercise this right, contact us at privacy@askarlo.co.uk with the subject line "Style Profile deletion request". We complete verified Style Profile deletion requests within 30 days.
- Right to data portability: where we process your data by automated means on the basis of contract or consent, you can ask us to provide it in a structured, commonly used, machine-readable format.
- Right to object: you can object at any time to processing based on legitimate interests (Art. 6(1)(f)), including profiling. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims.
- Right to withdraw consent: where processing is based on your consent, for example marketing emails, you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at privacy@askarlo.co.uk. We will respond within one calendar month, extendable by two further months for complex requests, with notice.
12. Data Breach Notification
In the event of a personal data breach, Raidical Ltd. will notify the ICO within 72 hours of becoming aware of the breach, where it is likely to result in a risk to individuals' rights and freedoms, as required by UK GDPR Article 33.
Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals without undue delay, as required by UK GDPR Article 34.
Where Raidical Ltd. is acting as a processor, we will notify the relevant controller (your practice) without undue delay upon becoming aware of a breach, to allow the controller to meet its own notification obligations.
13. Children's Privacy
Ask Arlo is not directed at anyone under the age of 18. Our intended user base is qualified veterinary surgeons, registered veterinary nurses, and veterinary students. We do not knowingly collect personal data from anyone under 18.
If you believe we have inadvertently collected data from a person under 18, please contact us at privacy@askarlo.co.uk and we will delete it promptly.
14. Right to Complain to the ICO
If you are unhappy with how we have handled your personal data, please contact us first at privacy@askarlo.co.uk so we can try to resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
| Website | www.ico.org.uk |
|---|---|
| Helpline | 0303 123 1113 |
| Post | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
15. Changes to This Notice
We may update this privacy notice from time to time to reflect changes to our practices, features, sub-processors, or legal requirements.
Where changes are material, we will notify you by email (to the address registered on your account) or by a prominent in-app notice, at least 30 days before the changes take effect.
The effective date at the top of this document shows when it was last updated.
Continued use of Ask Arlo after the effective date of a revised notice constitutes acceptance of the updated terms, to the extent permitted by law.
16. Cookies
Our website and app use cookies and similar browser storage. Some are strictly necessary to sign you in and keep the service secure; everything else waits for your consent. What each one does, how long it lasts, and how to change or withdraw your choice are set out in our Cookie Policy.