Security & Privacy at Pet Health Hub

• Accounts are protected by email + password sign-in, with optional Google sign-in.
• Sessions are managed by our authentication provider with industry-standard token rotation.
• Admin actions (e.g. moderating listings) are restricted to a separate role table - roles are never stored on user profiles to prevent privilege escalation.

• Row-level security is enabled on all user-data tables. Owners can only see and modify their own records.
• Sensitive contact details (e.g. lost pet contact phone numbers) require sign-in to reveal, are rate-limited per network, and are never broadcast over realtime subscriptions.
• Waitlist signups and other prospect data are write-only for the public and readable only by admins.
• Provider directory listings expose only public business fields (name, category, suburb, phone). Private fields like ABN, email, and owner identity require authentication.

• Pet Health Hub is built on the Lovable platform, which provides managed hosting, database, authentication, and storage with encryption in transit (TLS) and at rest.
• Server-side logic runs in an isolated serverless environment. Secrets (API keys, service credentials) are stored in a managed secrets store and never shipped to the browser.
• This is a description of the platform we build on - not a certification of those platforms.

• We collect only what's needed to operate the service: account details, pet records you choose to add, bookings you make, and listings you submit.
• Provider directory data may be sourced from public business listings (e.g. Google Places) and supplemented by claimed-provider edits.
• We do not sell personal data.

• Lovable Cloud - hosting, database, authentication, file storage.
• Google Places - provider discovery and address lookup.
• Stripe - payment processing for tag orders.
• Freshchat - in-app support chat.
• Google Calendar (optional) - provider booking sync, only when a provider connects it.

To request access, correction, or deletion of your personal data, or to report a security concern, email hello@pethealthhub.com.au. We aim to acknowledge requests within 5 business days.

If you believe you've found a security vulnerability, please report it privately to the same address rather than disclosing it publicly so we can investigate and remediate promptly.