Security and data protection
Your practice is the data controller and Praxis is your processor. This page lists what is true of the product today.
| Who is responsible for the data | Your practice is the data controller. Praxis is the processor and handles the data only on your practice's instructions. A data processing agreement and the list of companies that process data for us are available on request. |
|---|---|
| Where the AI runs | The AI that reads consultations and emails is set up to run in the European Economic Area (EEA), and the production service refuses to start with an AI provider outside it. |
| Changes to your PIMS | Changes Praxis proposes wait for a person's approval, and a clinician's own direct actions run after their own checks. A change only counts as done once it has been read back from your PIMS. Every approval records who, what and when. |
| Access | Your practice sets permissions for each role, and our servers enforce them. |
| Recordings | Kept for 30 days by default, adjustable from 1 to 365. Clinical records stay until your practice deletes them. |
| Email intake is off until an administrator turns it on. Mail from senders you haven't allowed is held back. | |
| Rights requests and leaving | A request from a pet owner or a member of staff to see, correct or delete their data goes to your practice, which is the controller, and we help the practice act on it. An administrator can export the whole workspace, or erase it, at any time. |
Where your data is processed
The AI runs in the European Economic Area (EEA). We'll send you the full list of services that handle your data, and where each runs, before you sign anything.
Ask for the listOther questions your DPO may ask
How this differs from a general AI assistant
If you already use a general AI assistant such as Cowork to connect your tools, Praxis is an alternative built around a practice's data protection duties. A general AI assistant helps one person with their own account. Praxis is set up for the whole practice: the practice stays the controller of its data, each role sees only what it is allowed to see, changes Praxis proposes wait for a person's approval with a record of who approved what, and the whole workspace can be exported or erased.
Pet owners in the consult room
An owner hasn't signed up for anything. A recording only starts after a consent step in the consult. An owner who wants to ask about, or have deleted, a recording of their voice asks your practice, which is the controller, and we help the practice act on it.
Where AI is used
AI reads free text, such as a consult recording or an email, and sees only what that job needs. Checks are your own rules over your own records, and a model never changes your PIMS on its own.
Certifications
We hold no formal security certifications yet. We'll list them here once we do.
Documents
Privacy policy (updated 28 September 2026)
For a data processing agreement, or to report a security issue, write to privacy@praxisvets.com.
If your data protection officer has questions this page doesn't answer, send them to us.