Version 2.0 — Effective July 13, 2026
Jurisdiction: New Brunswick, Canada
Serenity Vet Inc. (“Serenity Vet,” “we,” “us,” or “our”) is committed to safeguarding the privacy of our users and to handling personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), applicable provincial privacy legislation, and the privacy laws of any other jurisdiction in which we operate.
This Privacy and Cookies Policy (“Policy”) explains what personal information we collect, how we use, disclose, and protect it, and how you can exercise your rights. By accessing or using the Serenity Vet Platform, you consent to the collection, use, and disclosure of your personal information as described in this Policy.
This Policy is incorporated into and forms part of the Serenity Vet Terms and Conditions. Capitalized terms not defined here have the meanings given in the Terms and Conditions.
1. Who We Are — Data Controller and Privacy Officer
Data Controller
Serenity Vet Inc.
40 Charlotte Street
Saint John, New Brunswick, Canada
Privacy Officer
Attn: Privacy Officer
Serenity Vet Inc.
40 Charlotte Street, Saint John, New Brunswick, Canada
Email: privacy@serenity.vet
General enquiries: info@serenity.vet
The Privacy Officer is responsible for our compliance with PIPEDA and applicable privacy law and is your first point of contact for any privacy question, access request, correction request, or complaint.
2. Scope of This Policy
This Policy applies to personal information we collect about:
- Veterinarians and other veterinary professionals who register on, or apply to register on, the Serenity Vet Platform (“Professionals”);
- Veterinary hospitals, clinics, and their authorized representatives who register on, or apply to register on, the Platform (“Practices”);
- Visitors to our website at serenity.vet and any related domains, mobile applications, and technology (collectively, the “Platform”); and
- Any other individual whose personal information we handle in the course of operating our business.
This Policy does not apply to third-party websites, applications, or services that may be linked to or from the Platform. Those third parties have their own privacy policies, and we encourage you to review them.
3. What Personal Information We Collect
We collect only the personal information reasonably necessary to provide and improve the Platform and Services. The categories below describe what we may collect.
3.1 Information You Provide to Us
- Identity information — full legal name, date of birth, government-issued identifier where required to verify identity or professional standing, photograph.
- Contact information — email address, mailing address, telephone number, mobile number.
- Account credentials — username, password (stored in hashed form only), security questions and answers.
- Professional information (Professionals) — professional licences and registration numbers, veterinary medical association memberships, credentials, certifications, work history, references, curriculum vitae, availability, service preferences, professional liability insurance information.
- Practice information (Practices) — legal entity name, business number, practice address(es), authorized-representative details, clinic type and specializations, staffing needs.
- Tax information — HST/GST registration number, Social Insurance Number where legally required to be collected (Canada), Form W-9 or Form W-8BEN information (United States), or equivalent tax identifiers in other jurisdictions.
- Payment information — banking information for direct deposit or e-transfer (Professionals), credit card, debit card, or other payment mechanism details (Practices). Full card numbers are collected and stored by our payment processor, Stripe, Inc., not by Serenity Vet.
- Shift and transaction data — Shift postings, applications, confirmations, cancellations, Shift Compensation amounts, ratings, reviews, feedback, dispute records.
- Communications — messages you send us and messages you exchange with other Users through the Platform, support tickets, survey responses.
- Background-check information — where authorized by you, results of criminal, credit, or professional-history checks.
- Marketing preferences — your consents and withdrawals of consent under Canada’s Anti-Spam Legislation (“CASL”) and analogous law.
3.2 Information We Collect Automatically
- Device and usage information — IP address, browser type and version, operating system, device identifiers, referring URL, pages visited, features used, buttons clicked, session duration, timestamps, crash logs, and diagnostic data.
- Location information — approximate location inferred from IP address; precise location only if you expressly permit it through your device settings.
- Cookies and similar technologies — see Section 8.
3.3 Information We Collect from Third Parties
- Identity and credential verification providers — to verify professional licences, certifications, and identity documents you submit.
- Payment processor — Stripe, Inc. sends us limited information about transactions (e.g., last four digits of card, transaction status, dispute status) but not full card numbers.
- Background-check providers — where you have authorized a check.
- Other Users — Practices provide ratings, reviews, and dispute information about Professionals, and vice versa.
- Publicly available sources — such as public regulatory registries confirming licensure status.
3.4 Sensitive Information
We do not intentionally collect sensitive personal information (such as information about health, race, ethnicity, religion, sexual orientation, or political opinions) unless it is strictly necessary to provide the Services (for example, health information required for an accommodation). Where we must collect such information, we obtain your express consent and apply enhanced safeguards.
4. Purposes for Which We Use Personal Information
We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only for the following purposes:
4.1 To Provide the Platform and Services
- Create and manage your account;
- Verify your identity, professional credentials, and eligibility;
- Match Professionals with Practices for Shifts;
- Display Professional profiles to Practices and Practice postings to Professionals;
- Facilitate communication between Users;
- Process payments, remittances, and refunds through Stripe;
- Provide customer and technical support;
- Enforce our Terms and Conditions and applicable Platform rules.
4.2 To Operate and Improve Our Business
- Analyze usage patterns and improve Platform features, performance, security, and user experience;
- Develop new features and Services;
- Conduct research and analytics using aggregated or de-identified data;
- Detect, investigate, and prevent fraud, abuse, and security incidents;
- Enforce our rights and defend against legal claims.
4.3 To Communicate with You
- Send operational and transactional messages (e.g., Shift confirmations, payment notifications, account alerts) — these are not marketing communications and cannot be opted out of while your account is active;
- Send commercial electronic messages (marketing) — only with your express consent under CASL and only until you withdraw that consent;
- Notify you of material changes to this Policy, the Terms and Conditions, or the Platform.
4.4 To Comply with Legal Obligations
- Comply with tax reporting obligations (T4A reporting in Canada; Form 1099 or W-2 reporting in the United States as applicable);
- Comply with regulatory requests, court orders, subpoenas, and lawful demands;
- Respond to safety incidents, licensing board inquiries, and law-enforcement requests as permitted or required by law;
- Retain and disclose records as required by applicable law.
5. Legal Basis and Consent (PIPEDA Principles)
Under PIPEDA, we require your knowledge and consent to collect, use, and disclose your personal information, except where PIPEDA or other law permits or requires collection, use, or disclosure without consent.
Express consent is obtained for sensitive information, for CASL-regulated marketing communications, for background checks, and for other high-impact processing.
Implied consent applies where the purpose of the collection would be obvious to a reasonable person and you voluntarily provide the information (for example, when you enter your email address to receive a transactional Shift confirmation).
Withdrawal of consent. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may prevent us from providing certain Services. To withdraw consent, contact the Privacy Officer at privacy@serenity.vet.
Consent from an organization. Where you register on behalf of a Practice, you represent that you are authorized to consent to this Policy on behalf of the Practice and the individuals whose information you provide.
6. Disclosure of Personal Information
We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.
We may disclose personal information in the following circumstances:
6.1 To Other Users of the Platform
- Professional profile information (name, credentials, qualifications, licences, ratings, reviews, and photograph) is disclosed to Practices that view or engage the Professional.
- Practice information (business name, address, and Shift details) is disclosed to Professionals who view or apply for the Practice’s Shifts.
You control the information in your profile and may edit or remove most fields at any time. Some information, once disclosed to another User through a completed Shift, cannot be withdrawn (for example, a rating you left may remain visible).
6.2 To Service Providers
We disclose personal information to third-party service providers who process it on our behalf and under contractual privacy protections, including:
- Stripe, Inc. — payment processing (see Stripe’s Privacy Policy).
- Cloud hosting and infrastructure providers — for storage, computing, backup, and delivery of the Platform.
- Communication providers — for email, SMS, and push notification delivery.
- Analytics providers — for aggregated usage analytics; we configure these providers to minimize collection of identifiable data.
- Identity and credential verification providers — where required to onboard a User.
- Background-check providers — with your express authorization.
- Customer support tools — for ticket management and communications.
We require each service provider to use personal information only for the purposes we specify and to apply safeguards at least as protective as those in this Policy.
6.3 In Business Transactions
If Serenity Vet is involved in a merger, acquisition, financing, reorganization, insolvency, or sale of all or a portion of its assets, personal information may be disclosed to the counterparties and their advisors under confidentiality obligations, and may be transferred as part of the transaction.
6.4 For Legal Reasons
We may disclose personal information without your consent where permitted or required by law, including to:
- Respond to a subpoena, warrant, court order, or lawful demand from a governmental authority;
- Comply with tax or regulatory reporting obligations;
- Cooperate with law-enforcement, licensing board, or regulatory investigations;
- Protect the rights, property, or safety of Serenity Vet, our Users, or the public;
- Enforce our Terms and Conditions or defend legal claims.
7. Cross-Border Transfers of Personal Information
Serenity Vet is headquartered in Canada. Some of our service providers (including cloud hosting, payment processing through Stripe, and communication providers) may store or process personal information in the United States or other countries.
When personal information is transferred outside Canada, it may be accessible to foreign courts, law-enforcement agencies, and national-security authorities under the laws of the receiving jurisdiction, and those laws may differ from Canadian privacy laws.
We use contractual and organizational measures to require that all service providers apply a level of protection comparable to that required under PIPEDA, but we cannot fully insulate personal information from the laws of the receiving jurisdiction. By using the Platform, you consent to such cross-border transfers where necessary to provide the Services.
If you wish to obtain more information about our cross-border transfer practices, or the countries in which specific data is processed, contact the Privacy Officer.
8. Cookies and Tracking Technologies
Cookies are small files stored on your device that help us operate and analyze the Platform. Similar technologies include local storage, session storage, pixels, and software development kits.
Categories of cookies we use:
- Strictly necessary cookies — required to enable core functionality such as authentication, session management, security, and load balancing. These cannot be disabled through our cookie banner because the Platform will not function without them.
- Performance and analytics cookies — help us understand how Users interact with the Platform (pages visited, features used, error rates) so we can improve it. Data is typically aggregated or de-identified.
- Functional cookies — remember your preferences (language, region, display settings).
- Marketing cookies — used to measure the effectiveness of marketing campaigns and, where you have consented, deliver relevant advertisements. We do not use marketing cookies to build cross-site behavioural profiles for third parties.
Managing cookies. You can control cookies through the cookie banner presented on first visit and through your browser settings. Disabling strictly necessary cookies will prevent the Platform from working. Disabling other categories may reduce Platform functionality.
9. Data Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These safeguards include:
- Encryption in transit (TLS) and at rest for personal information stored on our systems;
- Password hashing using industry-standard algorithms;
- Role-based access controls limiting personnel access to personal information on a need-to-know basis;
- Multi-factor authentication for administrative and privileged access;
- Regular security patching and vulnerability management;
- Logging, monitoring, and alerting for suspicious activity;
- Contractual security obligations with service providers;
- Periodic staff training on privacy and information security.
No security safeguard is perfect. While we take reasonable steps to protect personal information, no method of transmission or storage is completely secure. We cannot guarantee absolute security.
Breach notification. In the event of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by PIPEDA and applicable provincial breach-notification laws, and will keep records of all breaches as required by PIPEDA regardless of severity.
10. Retention of Personal Information
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal, regulatory, tax, accounting, and reporting obligations.
Typical retention periods:
- Active account data — retained while your account is active and for a reasonable period after closure to complete pending transactions, resolve disputes, and enforce our agreements.
- Transactional and tax records — retained for a minimum of seven (7) years after the applicable fiscal year to comply with Canadian tax and accounting requirements, and for longer where required by law in another jurisdiction.
- Support and communication records — retained for up to three (3) years unless subject to a longer legal-hold requirement.
- Analytics and usage logs — retained in aggregated or de-identified form for so long as needed for analytics purposes; identifiable logs are typically retained for no more than 24 months.
- Marketing consent records — retained for the period required by CASL and analogous laws.
- Records subject to legal hold — retained for the duration of the hold.
At the end of the applicable retention period, we securely destroy, erase, or de-identify the personal information.
11. Your Privacy Rights
Subject to certain exceptions, you have the following rights with respect to your personal information:
- Right of access. You may request access to the personal information we hold about you, along with information about how it has been used and to whom it has been disclosed.
- Right of correction. You may request that we correct or update inaccurate or incomplete personal information.
- Right of withdrawal of consent. You may withdraw consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice.
- Right of deletion. You may request that we delete your personal information, subject to exceptions where we are required or entitled to retain it (for example, tax records, legal-hold records, records necessary to resolve disputes).
- Right to file a complaint. You may file a complaint with our Privacy Officer or with the Office of the Privacy Commissioner of Canada or the equivalent provincial or foreign regulator.
How to exercise your rights. Contact the Privacy Officer at privacy@serenity.vet. To protect your information, we may need to verify your identity before responding. We will respond to access and correction requests within thirty (30) days, or within the timeframe otherwise required by applicable law. If we cannot meet that timeframe, we will notify you of the extension and the reason.
No fee for reasonable requests. We do not charge a fee for reasonable access or correction requests. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee that reflects the administrative cost or refuse to act on the request, in each case as permitted by law and with reasons provided.
Exceptions. In limited circumstances we may refuse to disclose personal information — for example, where disclosure would reveal personal information about another individual, would compromise a legal investigation, is protected by solicitor-client privilege, or would reveal confidential commercial information. Where we refuse, we will provide the reasons and inform you of your right to complain to the Office of the Privacy Commissioner of Canada.
12. Automated Decision-Making
The Platform uses algorithms to match Professionals with Shifts and to rank search results. These matching and ranking algorithms use factors such as geographic proximity, availability, credentials, ratings, and past engagement. These algorithms are decision-support tools; they do not make final engagement decisions. Every engagement decision is made by a human — the Professional decides which Shifts to apply for, and the Practice decides which Professional to select. We do not use personal information for automated decisions that produce legal or similarly significant effects without human involvement.
Where we use automated tools to detect fraud or abuse, a human reviews any material adverse action (such as account suspension) before it is finalized, except in cases requiring immediate action to protect Users or the Platform.
13. Children’s Privacy
The Platform is intended for licensed veterinary professionals and veterinary businesses. It is not directed to, and we do not knowingly collect personal information from, individuals under the age of majority in their jurisdiction of residence. If we learn we have collected personal information from a minor, we will delete it promptly.
14. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors. When we make a material change, we will:
- update the “Effective Date” at the top of this Policy;
- post the revised Policy at https://serenity.vet/privacy-policy/; and
- where a material change requires it, notify you by email or through the Platform and, where required by law, obtain your consent to the change.
Your continued use of the Platform after the effective date of an update constitutes acceptance of the updated Policy.
15. How to Contact Us and How to Complain
Privacy Officer
Serenity Vet Inc.
40 Charlotte Street
Saint John, New Brunswick, Canada
Email: privacy@serenity.vet
For general enquiries: info@serenity.vet
If you are not satisfied with our response to a privacy complaint, you may contact:
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca
If you reside in a Canadian province with its own privacy commissioner (British Columbia, Alberta, or Quebec), you may also contact that provincial regulator.
If you reside outside Canada, you may contact your local data-protection authority.
Version 2.0 — Effective July 13, 2026
Serenity Vet Inc. | 40 Charlotte Street, Saint John, New Brunswick, Canada | privacy@serenity.vet