Privacy notice

Effective 3 September 2026

This notice explains how Lauma Health processes personal data. The service organizes health records about pets, but veterinary documents may also contain personal data about their owners.

1. Controller and contact

The controller is Neomendel Oy, the provider of Lauma Health. Questions about privacy and data-subject requests can be sent to laumahealth@neomendel.com.

2. Data we process

account identifier, email address, and basic sign-in information;
household, membership, invitation, and pet information;
PDF documents and photos selected by the user, with their metadata;
veterinary visits and health events extracted from documents, and user corrections;
event times and internal identifiers needed for service security and operation; and
support requests and related correspondence.

Lauma Health does not need human medical information. Do not include unnecessary personal data or information about other people in documents.

The public website and app do not use advertising or cross-app tracking. A client's IP address is used transiently to rate-limit authentication attempts, but it is not retained in HTTP access logs.

3. Purposes and legal bases

Processing for accounts, documents, timelines, and household sharing is necessary to perform the service contract with the user. Protecting the service, preventing abuse, investigating technical errors, and answering support requests rely on Neomendel Oy's legitimate interest in operating a secure and reliable service. We may also process data to comply with a legal obligation or to establish, exercise, or defend legal claims.

4. Service providers and transfers

Hetzner – EU-based server, database, original-file storage, and encrypted backups;
Clerk – user authentication and session management;
OpenAI – automated extraction of a selected document into a timeline; and
Apple or Google – the sign-in provider selected by the user; and
Google Workspace – receiving and handling support email.

Where data is processed outside the European Economic Area, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses. Neomendel Oy has entered into a data processing agreement with OpenAI.

5. Automated document extraction

A document selected by the user is sent to the OpenAI API only to form the timeline. Lauma Health requests that the response is not stored in the OpenAI Responses service. The remote file is deleted after processing and also has a one-hour automatic expiry as a safeguard against interruptions. OpenAI may retain API abuse-monitoring logs for up to 30 days. Content sent to the API is not used to train models by default.

Automatically extracted information may contain errors. Always verify important details against the original document. Lauma Health does not provide veterinary advice and is not a substitute for a veterinarian.

6. Retention and deletion

Account and active content data is kept until the user deletes it or the account.
Deleting a record removes its active original and derived events.
Deleted data may remain in encrypted, access-restricted backups for up to 12 months before expiring automatically.
Support messages are kept while the matter is handled and normally for no more than 12 months after resolution.
Data required for a legal obligation or claim may be retained longer only to the extent necessary.

7. Shared households

Household members can see the pets, documents, and timeline belonging to that household. If its owner deletes their account while other members remain, ownership and shared data transfer to the successor owner. If the final member deletes their account, the household and its active data are deleted.

8. Your rights

Subject to applicable data-protection law, you may request access, correction, deletion, restriction, and portability of your data. You may also object to processing based on legitimate interests. Send requests to the controller's email address. We may request reasonable additional information to verify your identity.

You may lodge a complaint with the Office of the Data Protection Ombudsman.

9. Automated decision-making

Document extraction is automated, but Lauma Health does not make decisions based on personal data that produce legal or similarly significant effects.

10. Changes to this notice

We update this notice if the service or its data processing changes. The latest version and effective date are always available on this page.