Privacy Policy

The controller — the one legally responsible for what happens to your information — is to be completed: the operator's registered legal name, of to be completed: the registered address, Portugal.

For anything at all about your data, write to to be completed: the privacy email address. A person reads it.

We have not appointed a Data Protection Officer. We are saying so rather than leaving a gap: Giulia is the Best Pawrent Ever - Her Babies Tracker is a small operation and does not meet the conditions in Article 37 that make one compulsory. The address above is the one to use.

This policy covers the Giulia is the Best Pawrent Ever - Her Babies Tracker web application, its machine interface, the share pages that links open, and the emails we send. It applies to everyone with an account and to anyone whose records are held on one.

It does not cover what happens on someone else’s service — your email provider, your bank, or an assistant you chose to connect. Those have their own policies.

Your account

Your email address, an optional display name, your password stored only as a one-way hash that cannot be turned back into a password, the dates the account was created and last used, and whether it is active.

Profiles

For each pet or person you track: a name, whether it is a person or an animal, and whichever of species, breed, sex, date of birth, microchip number and notes you choose to fill in.

Health records — the substance of the service

Documents you add (laboratory reports, imaging reports, discharge letters, prescriptions and so on) and their original files exactly as supplied; the values read out of those documents together with units, reference ranges and dates; measurements you record yourself, such as weight or blood pressure; treatments, doses and dates; food entries; and any notes you write. This is health information, and for a human profile it is special-category data under Article 9 of the GDPR.

Billing

On our side: which plan you are on, whether a subscription is active, when the current period ends, and identifiers that point at the corresponding records held by our payment processor. If a refund is made, its amount and currency. If a card is failing, its brand, its last four digits and its expiry month, so that we can have a useful conversation about which card it is.

We never see or store a full card number, and never a security code. Card details go straight from your browser to Stripe, on Stripe’s own pages. Your name and billing address are held by Stripe, not by us.

Security and accountability records

• Sign-in attempts, successful and failed, with the IP address the attempt came from. This is how an attack on your account is detected.
• An audit log of what was read and what was changed on your account: the time, the kind of action, the route pattern, an opaque identifier for the thing touched, and the outcome. It records that a document was read, not what the document said. Records of changes and of administrative actions are chained together cryptographically, so that an altered or removed entry is detectable.
• Administrative access: every time an administrator opens an account, with the reason typed in, the start, the end and the administrator’s IP address.
• Share link openings: when a link was opened, which kind of view was opened, and whether it was you. The visitor’s IP address is not stored — it is turned into a keyed one-way digest that cannot be reversed into an address, alongside a coarse device family such as “Safari/iOS”, so that you can tell one visitor from another without us holding anyone’s address.

Your IP address is not recorded for ordinary use of the app. Reading your own records, adding a measurement, opening a chart — none of that writes an address anywhere. Only a sign-in attempt and an administrator’s own actions do.

What we deliberately do not do

No analytics of any kind. No advertising and no advertising identifiers. No tracking pixels, no session recording, no heatmaps, no fingerprinting. No third-party script runs on any page of the app — not even a web font, which is why Giulia is the Best Pawrent Ever - Her Babies Tracker uses the fonts already on your device. We do not sell, rent or share your information for anyone else’s purposes, and we do not use your records to train any model.

Under the GDPR every use of your information needs a lawful basis under Article 6, and health information needs a further condition under Article 9. Here is ours, use by use.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that keeping a medical-records service secure, and being able to prove who accessed what, is something you would reasonably expect and benefit from. You can object — see Your rights.

How you give it. You give it by choosing to put health information into Giulia is the Best Pawrent Ever - Her Babies Tracker: when you create a profile for a person and add a document, a value or a treatment to it. The registration page tells you what the service is for before you get there, and this policy is linked from it. Consent is a separate, deliberate act — it is not bundled into the price and it is not a condition of having an account with no health data on it.

How you take it back. At any time, in any of these ways, and you never have to give a reason:

• delete an individual document, value or treatment — it goes;
• once you have cleared everything off a profile this way, delete the empty profile itself and its own details (name, species, breed, notes) go with it — the app deliberately refuses to delete a profile that still holds any document, value or treatment, precisely so that one click cannot take a medical history with it. Clearing it first, then deleting the empty shell, is a short extra step rather than one action, and it exists on purpose;
• ask us to delete the account — write to to be completed: the privacy email address and we do it, whatever it still holds.

Withdrawing consent stops any further use from that point. It does not make what happened before it unlawful, and it does not reach records we are separately obliged to keep, such as an invoice.

What withdrawing means in practice. Giulia is the Best Pawrent Ever - Her Babies Tracker is a health-records service; without health records there is nothing for it to do. If you withdraw consent entirely we will delete the records and you may keep or close the account as you prefer. We will not keep charging you for a service you have emptied — tell us and we will cancel and refund the unused part.

A profile can be someone other than you. If you create one for a family member, you are telling us that you may lawfully hold their health information: that they have given you their explicit agreement, or that you are their parent or legal guardian, or that you otherwise have a legal right to act for them.

That person keeps their own rights, and can exercise them directly with us, whether or not they have an account: they can ask what is held about them, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Write to to be completed: the privacy email address. We will verify who they are before we answer, and we will tell the account holder unless doing so would be unlawful or would put someone at risk.

Animals are different. Data protection law protects people, not animals, so a cat’s blood results are not that cat’s personal data. They are, however, personal data about you, because they are tied to your account and say something about your household. We protect them exactly as carefully — the software makes no distinction — but the Article 9 rules above apply to human profiles.

Five companies process data on our behalf. That is the whole list. Each acts on our instructions, under a written data processing agreement, and none of them may use anything for their own purposes.

Nobody else. There is no analytics provider, no advertising network, no support-chat widget, no error-reporting service and no data broker. If that ever changes, this table changes first and the date at the top of this page changes with it.

We will disclose information to a public authority where the law genuinely requires it. We check that a request is lawful and properly served, we give it the narrowest reading we can, and we tell you unless we are forbidden to.

And the obvious one: anyone you hand a share link to sees what that link covers. That is not a disclosure by us; it is you sharing your own records, on purpose, and you can revoke the link at any moment.

When you connect one, it reads your records because you told it to, using a credential you granted and can revoke in one click from your account. That company is not one of our processors: it is acting for you, under your agreement with it. We do not see the conversation, we do not receive a copy of what it reads back to you, and we do not receive anything it produces.

We are spelling this out because it is unusual, and because it is genuinely to your advantage: the decision about which company gets to read your family’s health records stays with you, and it is revocable in a single action. The other side of it is that the choice is also your responsibility — check what your assistant’s provider does with what it reads, because we cannot.

There are two features where we do the reading, rather than an assistant you connected yourself, and both exist only on Pro AI. They are different processors, different purposes, and different scopes of your data, so we describe them separately rather than as one blanket promise.

Reading one document

On Pro AI you can ask Giulia is the Best Pawrent Ever - Her Babies Tracker to read a document you added, and we send it to Anthropic — the company named in the table above — so that its values can be extracted for you without typing them in. That makes them one of our processors, and what they receive is health information: the file of that one document, and nothing else on your account.

This only ever happens on your instruction. It runs once, on the one document you chose, when you press the button that asks for it. It never runs automatically and it never runs when a document is added. If you are not on Pro AI, or you never press that button, no document of yours is ever sent there.

Suggesting lines of enquiry for a pet (Diagnoses)

Separately, on Pro AI, you can ask Giulia is the Best Pawrent Ever - Her Babies Tracker’s own AI to suggest possible lines of enquiry for a pet’s profile — see the Diagnoses section of the Terms of Service for what that feature is. Unlike reading one document, this deliberately looks at more than one record at once: we send Google, the company named in the table above, a bounded, recent selection of that ONE pet’s own documents and measurements — described exactly in the table above — so that possible lines of enquiry can be suggested from the pattern across them.

This also only ever happens on your instruction, one profile at a time. It runs when you press the button that asks for a suggestion, for the one pet you chose. It never runs automatically, it never runs when a document is added, and it is never offered for a human profile — see the Terms of Service for why. If you are not on Pro AI, or you never press that button, nothing is ever sent there.

Asking a question about a pet’s records works a little differently. On the Assistant page you can type a question about one pet’s own records. When you press the button that asks it, the assistant works through the question in steps: it looks things up in that pet’s records, reads what came back, and looks up more if it needs to, before answering. Each thing it looks up is sent to Google as part of that working. So what is sent is not one fixed bundle chosen in advance — it is whatever that pet’s own records contain that the question actually needs, and the page shows you each step as it happens. If you ask it to record or change something, it can do that too, and it tells you what it changed. Everything it can reach belongs to that ONE pet — it has no way to reach another profile, including another of your own. It never runs automatically, it never runs when a document is added, and — exactly like a Diagnoses suggestion — it is never offered for a profile that is a person. The answer is not medical advice and is not a diagnosis; it is a starting point for a conversation with a veterinarian.

Each of these three has its own separate monthly allowance, shown on your account page: one for documents read for you, one for Diagnoses suggestions, and one for questions asked. Going past an allowance simply stops that one working until the next period; you are never charged for going over it. See the Terms of Service for what each plan includes.

If we extend either of these to run without you pressing a button, or to a plan that does not already disclose it, we will update this policy first, not afterwards, and email you about the change if you are on an affected plan.

Your records live in the European Union. The application, the database and the object storage that holds your original documents all run in Frankfurt, Germany. Email is delivered from France.

Four of the five companies above — DigitalOcean’s own corporate group, Stripe, Anthropic and Google — are, or belong to, groups outside the EU, and support, administration or, for Anthropic and Google, the reading or the analysis itself can involve access from outside the EEA. Where that happens we rely on the European Commission’s Standard Contractual Clauses or another transfer mechanism permitted by Chapter V of the GDPR, as set out in that company’s data processing agreement, together with the technical measures described below. The exact region and transfer mechanism for Anthropic and for Google are among the facts marked “to be completed” in the processors table above — we will complete them, not guess at them, before anyone is charged for Pro AI for the first time.

You can ask us for the details of the transfer mechanism relied on for any particular processor, and we will tell you.

An administrator can open your account to help you — to work out why something is not showing, or to check an integrity problem. This is the one deliberate exception to the rule that nobody sees another account’s data, and it is built to be constrained rather than merely discouraged:

• It is read-only. The whole visit runs inside a database transaction that cannot write. Nothing can be changed, added or deleted during it, whatever anyone clicks.
• It expires. A visit lasts at most 30 minutes and then ends by itself. Extending that limit would need a change to the database, not a setting.
• It is visible. A red band across the top of every page says it is happening, for as long as it lasts.
• It is recorded, permanently. The start, the end, who did it, and the reason they typed — which you can read, word for word — go into the record that cannot be edited or deleted.
• You are told. Unless you turn the email off in your account settings, we email you when a visit starts. The recorded entry has no switch and is always written.

Administrators cannot see your password — it is not stored in a form anyone can read — and cannot use this route to change anything.

The measures that actually do the work, rather than a list of adjectives:

• The database refuses cross-account reads itself. Every query runs as your account under row-level security, and the rule denies by default: if the account is not set, the answer is zero rows, not everything. A piece of code that forgets to filter therefore returns nothing and fails loudly, rather than returning somebody else’s records.
• Passwords are stored as a salted one-way hash and never in readable form. Nobody at Giulia is the Best Pawrent Ever - Her Babies Tracker can tell you your password, because nobody can read it.
• Documents live in a private bucket, and the software checks that the bucket is not publicly readable before every single upload, refusing to write if the check fails or cannot be completed.
• Everything is encrypted in transit, and the connection to the database requires TLS.
• The accountability log is chained. Each entry recording a change carries a hash of the one before, so removing or altering an entry breaks the chain and is detectable.
• Machine credentials are hashed and individually revocable, and you can revoke every session and every credential at once from your account.
• Share links are unguessable, expire by themselves, and are revoked from the database rather than by a token that has to be waited out — so revoking one takes effect immediately.

No system is perfectly secure. If we ever suffer a breach that is likely to put your rights at risk, we will notify the Portuguese supervisory authority (CNPD) within 72 hours of becoming aware of it, as Article 33 requires, and we will tell you directly, in plain words, about what happened and what to do.

Under the GDPR you have the following rights. They are free to exercise and you never need a reason.

• Access (Article 15) — to be told what we hold about you and to get a copy of it. See the next section.
• Rectification (Article 16) — to have anything inaccurate corrected. Most of it you can correct yourself in the app; write to us for the rest.
• Erasure (Article 17) — to have it deleted. Subject only to the records we are legally obliged to keep, listed in How long we keep things.
• Restriction (Article 18) — to have us stop using it while a dispute about it is sorted out.
• Portability (Article 20) — to receive what you gave us in a structured, commonly-used, machine-readable form, and to have it sent to another controller where that is technically possible. Ours is JSON, plus your original files exactly as they were supplied.
• Objection (Article 21) — to object to any use we base on legitimate interests. We will stop unless we can show compelling grounds that override yours.
• Withdrawing consent (Article 7(3)) — to take back the explicit consent that lets us hold health information, at any time. See Health information and your explicit consent.
• Complaint (Article 77) — to complain to a supervisory authority. See Questions and complaints.

To exercise any of them, write to to be completed: the privacy email address from the address on the account. We reply within one month. If a request is unusually complex we may take up to two months more, and we will tell you why within the first month. We may ask you to confirm who you are — and we will not use that as a way of stalling.

Why you might need this section. While a subscription is active, and throughout the 30-day read-only window after it ends, you can export everything yourself from inside the app: a PDF report and the original file of every document. Once an account is locked, the export buttons stop working. That is a billing rule, deliberately chosen, and it is about payment — it has nothing to do with data protection and it does not touch the right described here.

So instead, ask a person. Write to to be completed: the privacy email address from the email address on the account, and say what you want. We will send you:

• a machine-readable file (JSON) containing every profile, document record, measurement, treatment and food entry on the account, with their dates, units and reference ranges; and
• the original file of every document, exactly as it was supplied.

Free of charge, and within one month. If the request is unusually large we may take up to two further months, and we will tell you so — and why — within the first month. We will confirm who you are before we send anything, because sending a family’s medical history to the wrong person is the worst thing this service could do.

If you would rather have everything deleted than copied, say that instead and we will delete it. If you want both, ask for the copy first — deletion is not reversible.

A request is handled by a person and is recorded in the accountability log, so there is a permanent record that it was made and answered.

Giulia is the Best Pawrent Ever - Her Babies Tracker sets six cookies. All six are strictly necessary to make the service work, none of them tracks you, and no third party sets a cookie on our pages. Each one is named, explained and dated in the Cookie Policy.

Because there is nothing optional to accept or refuse, there is no accept-or-reject banner — only a notice. The Cookie Policy explains why that is the honest answer rather than the lazy one.

Giulia is the Best Pawrent Ever - Her Babies Tracker is not designed for children and an account holder must be at least 18. A profile, of course, can be a child — that is one of the things the service is for — and in that case the account holder is the parent or guardian and is responsible for that child’s information.

If we learn that a child has created an account for themselves, we will close it and delete what is on it.

We make no automated decisions that produce legal effects for you or similarly significantly affect you, and we do not profile you. Nothing in Giulia is the Best Pawrent Ever - Her Babies Tracker scores you, ranks you, judges you or decides anything about you.

Charts, reference-range colouring and totals are arithmetic performed on the values you supplied and displayed back to you. They are not decisions, and as the Terms of Service say at some length, they are not clinical opinions either.

We will update this policy when what we do changes — and we update it before the change takes effect, not afterwards. Every version carries the date it was published at the top of the page.

If a change materially affects you — a new processor, a new purpose, a longer retention period — we will email you at least 30 days beforehand and say what changed. Where a change needs your consent, we will ask for it rather than assume it.

Please write to us first: to be completed: the privacy email address. Most things are a misunderstanding and are fixed the same week.

You also have the right to complain to a data protection supervisory authority — either the one in the EU country where you live or work, or the Portuguese authority (CNPD), the Garante per la protezione dei dati personali, which is ours. Complaining to them does not require you to have come to us first, and it does not affect any other remedy you have.