1. Controller and scope
Vetra processes the data needed to manage the service, provide it to professional users, keep it secure and answer enquiries. For any question about this processing, you can write to info@vetralab.org.
This policy applies to the use of Vetra, user accounts, collaboration within organisations and communications with Vetra. Scientific content is processed only to provide the requested features and is also described on the AI & Data Processing page.
Permitted content. Vetra is designed to work with published scientific articles. You must not upload medical records, participant datasets, confidential patient information or other personal data that can identify participants.
2. What data we use
We only use the information needed to provide Vetra and keep the service secure. Depending on how you use it, this may include:
- Account and organisation details, such as your email address, organisation, role and permissions.
- Your work in Vetra, such as projects, favourites, conversations and results.
- Basic usage information, such as features used, activity dates and credit consumption.
- Necessary technical information used to detect errors, protect your account and keep the service running.
- Contact and support details, such as your name, email address, institution and messages you send us.
3. Purposes, legal bases and retention
The table summarises current processing. Periods may be extended where required by law, necessary to prevent fraud or essential for the establishment, exercise or defence of legal claims.
| Category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account and organisation | Authenticate and administer the account, organisation and access. | Performance of a contract. | While active; operational deletion no later than 30 days after deletion or closure. |
| Roles, memberships and invitations | Manage permissions, collaboration and security. | Performance of a contract and legitimate interest in protecting the service. | During the relationship and for the period applicable to incidents or claims. |
| Usage and consumption | Operate the service, enforce limits and allocate consumption. | Performance of a contract and legitimate operational interest. | During the relationship. Aggregated statistics that cannot identify a person may be retained. |
| Technical logs | Security, abuse prevention, diagnostics and performance. | Legitimate interest in operating and protecting the service. | No longer than 30 days. |
| Activity and projects | Provide the contracted features and maintain the state of the work. | Performance of a contract. | Until the project, account or organisation is deleted; operational deletion within 30 days afterwards. |
| Contact and support | Answer requests, provide support and manage pre-contractual steps. | Pre-contractual steps, performance of a contract or legitimate interest. | 12 months after the last communication, unless there is a contractual relationship or legal obligation. |
| Necessary communications | Manage invitations and send account, security or support notices. | Performance of a contract and security obligations. | During the relationship and while needed to evidence delivery or address an incident. |
Backups associated with deleted data will expire within 90 days, except where one of the circumstances described above applies.
4. Individual users and institutions
Individual professional use
When a person uses Vetra on their own behalf, Vetra acts as controller of the data needed to provide, administer and secure the service.
Institutional accounts
When a university or other institution determines which projects and content are processed, that institution acts as controller and Vetra acts as processor under its instructions. Vetra remains a controller for processing it determines for its own purposes, including security, account management, support, compliance and operational records.
Specific terms for processing on behalf of institutions will be documented in the applicable data processing agreement.
5. Recipients and international transfers
Vetra may disclose or allow access to data only where necessary to provide and protect the service:
- infrastructure and authentication providers, with Vetra's main infrastructure hosted in Europe through AWS;
- OpenAI, as the processing provider for certain artificial intelligence features;
- Research Organization Registry (ROR), whose API receives the text entered in the institution field to provide suggestions. The query does not include the user’s name or email address;
- providers used to manage and deliver forms and communications;
- advisers, public authorities or third parties where required by law or necessary to defend rights.
Some providers may process data outside the European Economic Area. Where an international transfer occurs, Vetra will use a valid mechanism under the GDPR, such as an adequacy decision or appropriate safeguards, including Standard Contractual Clauses where applicable. You may request information about the applicable safeguards by writing to info@vetralab.org.
6. Your rights
You may request access, rectification, erasure, objection, restriction of processing and data portability where applicable. To exercise a right, write to info@vetralab.org and tell us which right you wish to exercise.
Vetra may request reasonable additional information to verify your identity and prevent another person from accessing or changing your data. You may also lodge a complaint with the Spanish Data Protection Agency.
Deletion
Projects and their results can be deleted from Vetra. Complete deletion of an account or organisation must currently be requested by email at info@vetralab.org.
7. Artificial intelligence and automated decisions
Vetra uses artificial intelligence to assist research tasks, but it does not make solely automated decisions that produce legal or similarly significant effects for users. Suggestions and results must be reviewed by a person.
Transient processing of articles and retention of results are explained in more detail on the AI & Data Processing page.
9. Changes and contact
This policy may be updated to reflect legal, technical or service changes. Where a change is material, Vetra will provide notice through appropriate channels before it applies whenever reasonably possible.
For any privacy-related enquiry, write to info@vetralab.org.