Data policy & custody
Who owns what, what is retained, and for how long.
Two records live side by side on Petus, with different owners.
The pet's record belongs to the owner
Your access to a pet's record is consented, scoped by section, and can be revoked. Every access is logged. Allergies are always visible in any vet share; the owner's chat, journal, and private notes never are.
Your signed work belongs to you
Signing writes an immutable copy with a SHA-256 fingerprint, held for the professional, independent of what the owner later revokes or deletes.
| Rule | Detail |
|---|---|
| Retention | Seven years from signing |
| Legal hold | A held record is never deleted, whatever its age |
| Immutability | Signed documents are never edited; corrections are addenda |
| Survival | Copies outlive owner revocation and account closure |
The same discipline runs through the workspace: invoices are never edited after issue, estimate ceilings are never raised without fresh consent, stock movements are never rewritten. Practice messages carry their own retention dates and honor legal hold.
Custody never pauses with the product: copies stay retrievable even while a feature is paused.