Elita Blueprint Privacy Policy
Last updated: 29 May 2026
1. WHO WE ARE
Elita Genetics Operations Pty Ltd (ACN 677 915 338) is the company that runs the Blueprint mobile application available for download on iOS and Android (“App” or “Blueprint”). We are the data controller for personal information collected through the App.
Registered office: Unit 17, 306 Albert Street, Brunswick VIC 3056, Australia
Contact: support@elita.pet
"You" or "owner" means the person using the App. "Your dog" or "pet" means any animal you have added to your account.
2. WHAT WE COLLECT
2.1 About you (the owner)
When you create an account and use the App, we collect:
- Account details: name, email, password, AppleID credentials, or Google sign-in identifier
- Phone number — used for customer support (e.g., Vet Records Concierge confirmation). If you sign up with Google, your phone number is attached automatically. If you sign up using your email, providing a phone number is optional.
- Profile details: country, postcode, profile photo (optional)
- Onboarding inputs: the lifestyle and care questions you answer when setting up your profile on the App
- Communications: messages to our support team
- Device and usage data: device type, operating system, App version, language, time zone, app-level identifiers, crash and performance data
- Advertising identifier (Identifier for Advertisers (“IDFA”) on iOS, Advertising ID on Android): only if you grant permission via the Apple App Tracking Transparency prompt or the Android equivalent. See section 2.4.
- Subscription metadata: which usage tier you subscribe for (free or Premium), trial status, renewal date. We do not store payment card numbers or other accountant information in relation to financial institutions and payment methods, other than to the extent necessary to support your ongoing subscription (as set out in section 7 of this policy).
2.2 About your dog
You give us the following information directly, or you authorise us to retrieve it from your vet clinic via the Vet Records Concierge (section 4):
- Profile: name, breed, sex, date of birth, weight, neuter status, photo
- Clinical history: vaccination status and history, microchip number, prior conditions, medications, allergies, surgeries, lab results, imaging notes
- Owner observations: check-in observations, surveys, symptoms, energy and behaviour ratings, food and water intake
- Biomarker history and any insights, recommendations and risk scores the App produces
- In-App chat content concerning your dog (see section 5)
2.3 Collected automatically
The following information is collected by the App automatically:
- Product analytics events (screens viewed, features used, conversion funnels)
- Crash and error logs
- Push-notification delivery receipts
- App-install attribution events (which marketing channel resulted in you installing the App) — collected via our attribution partner AppsFlyer. See section 2.4 and section 6.
The App itself does not use browser cookies.
2.4 App Tracking Transparency (iOS) and marketing attribution
We use AppsFlyer as our mobile attribution partner so we can measure how effective our marketing is and which campaigns drive new App installations.
- On iOS, we display Apple's App Tracking Transparency (“ATT”) prompt the first time it's required. It asks for your permission to use your device's IDFA for this purpose. You can change your settings at any time by accessing iOS Settings → Privacy & Security → Tracking.
- If you grant permission, your IDFA and related attribution events are shared with AppsFlyer and used to measure marketing performance. Aggregated, non-identifying campaign data may also be shared back to the advertising network that resulted in your installation so they can measure their own campaign.
- If you decline, no IDFA is collected. We fall back to Apple's SKAdNetwork, which provides aggregated campaign measurement without identifying you.
- We do not use the advertising identifier for behavioural advertising. We do not share it with data brokers.
- On Android, equivalent attribution runs via AppsFlyer using the Android Advertising ID where consent permits, with the same purpose limit.
3. WHY WE COLLECT IT (AND THE LEGAL BASIS)
We use your information for these purposes. Under the Australian Privacy Principles (“APP”), we collect and use your personal information because it is reasonably necessary for our functions and activities as described below (see APP 3 and APP 6). For EU/UK users, the corresponding General Data Protection Regulation (“GDPR”) Article 6 legal basis is noted for each purpose. California users have additional rights under CCPA/CPRA (section 12).
- To create your account and authenticate you. (Contract — Art 6(1)(b))
- To provide the Blueprint service, free and Premium. (Contract — Art 6(1)(b))
- To send service notifications you've opted into. (Consent — Art 6(1)(a); withdrawable any time)
- To process Premium subscription billing (via Apple, Google or Stripe). (Contract — Art 6(1)(b))
- To run in-App chat about your dog. (Contract — Art 6(1)(b))
- To run the Vet Records Concierge when you authorise it. (Consent — Art 6(1)(a); withdrawable before send)
- To run product analytics, evaluate models, and improve the app. (Legitimate interests — Art 6(1)(f))
- To measure marketing attribution and campaign performance (advertising identifier, attribution events). (Consent — Art 6(1)(a) via ATT or Android equivalent; withdrawable in OS settings)
- For longevity research and clinical review on anonymised pet records after account deletion. (Once anonymised, this data is no longer personal information under the Privacy Act or personal data under the GDPR; no legal basis is required. During the 30-day grace period before anonymisation: Legitimate interests — Art 6(1)(f) for EU/UK users; see our LIA.)
- To comply with legal, tax and regulatory obligations. (Legal obligation — Art 6(1)(c))
- To detect, prevent and respond to fraud, abuse and security incidents. (Legitimate interests — Art 6(1)(f))
We do not use your data for automated decision-making with legal or similarly significant effects.
4. VET RECORDS CONCIERGE — HOW THE DATA FLOWS
Where you authorise it, we contact your vet clinic to request your dog's records on your behalf.
- Records flow FROM the clinic TO Elita with your consent. We do not send your dog's records to the clinic.
- Consent is captured in-App, right above the “Send” button, before any request goes out.
- You can opt out and upload records yourself.
- You can withdraw your authorisation any time. Withdrawal stops new requests. In-flight requests may still complete and the response, if it arrives, will be added to your account. If a response arrives after you have withdrawn your authorisation, we will notify you and offer you the option to have that data removed from your account.
How records are used (Concierge and your own uploads): Records we receive from your veterinary clinic, and documents you upload yourself (PDFs, photos of records and similar documents), are processed by the App to extract context that feeds your dog's profile, insights and recommendations. We do not re-display raw clinic records or uploaded documents inside the App. There are two primary reasons for this: raw clinic records are best interpreted by your vet, and PDF viewing inside a mobile App is generally a poor experience. If you want a copy of the records your clinic provided, please contact your clinic directly as they remain the source of truth. Your rights of access to the personal data we hold about you are set out in section 12.
5. IN-APP CHAT AND AI
The Apps chat function is powered by Google Cloud Vertex AI (Gemini) on the paid tier, under the Google Cloud Data Processing Addendum.
- Google processes chat content on our behalf as our processor (not as a separate third party).
- Chat content is not used to train Google's models. We subscribe for the paid tier with contractual no-training terms.
- Chat is grounded in your dog's records in the App and in current canine health science maintained by Elita.
- Chat is not a substitute for veterinary advice. Do not use it for urgent or emergency concerns.
- Chat depth varies by tier: limited interactions are available on the free tier, with more fulsome access available to Premium users.
6. SUB-PROCESSORS
We use these third-party processors. Each third-party processor operates under contract on our instruction, applies appropriate security measures, and is contractually prohibited from using your data for their own purposes. We use the following third-party processors for the following purposes:
- Google Cloud / Vertex AI (Gemini) — hosting and in-App chat. https://cloud.google.com/terms/cloud-privacy-notice
- AppsFlyer — mobile attribution, deep linking and campaign measurement. https://www.appsflyer.com/legal/services-privacy-policy/
- RevenueCat — subscription management, receipt validation and entitlement state. https://www.revenuecat.com/privacy
- OneSignal — push notifications. https://onesignal.com/privacy_policy
- PostHog — product analytics and error/exception tracking. https://posthog.com/privacy
- Stripe — subscription billing (where applicable). https://stripe.com/privacy
- Sendgrid — Transactional email provider — account, verification and transactional emails. https://www.twilio.com/en-us/legal/privacy
We may update this list from time to time. Material changes will be reflected in a new published version of this policy. We recommend that you review this policy on a periodic basis to ensure you are familiar with any changes that may be enacted from time to time. We will communicate any material changes to this policy in accordance with section 15.
7. SUBSCRIPTION AND BILLING
The App is free to download. Currently, the free tier is free to use indefinitely. A Premium subscription unlocks deeper insights, drill-downs and a more fulsome in-App chat experience. Full pricing, trial mechanics, renewal and cancellation are contained in the Blueprint Terms of Service.
In-App purchases and subscriptions are billed by Apple (iOS) and Google (Android). For web subscribers, billing runs through Stripe. We do not see or store your full payment card numbers. We do receive enough transaction metadata to provision and manage your subscription.
We use RevenueCat to manage subscription state, validate receipts and track entitlements across platforms. RevenueCat receives subscription metadata (purchase tokens, receipts, customer IDs, subscription status) but does not receive or store payment card details. RevenueCat operates as our processor under contract.
8. PET DATA AND WHERE IT SITS UNDER PRIVACY LAW
Pet health data (your dog's profile, vet records, biomarkers, your check-ins and any chat about your dog) is collected and processed against your account.
A pet is not a "natural person" or a "data subject" under GDPR. While pet data is linked to you, we treat that combined record as your personal data. After we anonymise your account (section 9), the pet data is no longer linked to your account or to anyone identifiable. Once anonymised, this data is no longer personal information under the Privacy Act 1988 (Cth) or personal data under the GDPR, and privacy legislation does not restrict its use. We use it for longevity research, clinical review and to improve the App. Our anonymisation methodology is documented internally and available for review by regulators on request.
9. DELETING YOUR ACCOUNT AND DATA RETENTION
1) How to delete: You can delete your account via the “Profile” screen inside the App. No email-to-support is required and deletion can occur fully in-App.
2) 30-day grace period applies. Deletion is staged. For 30 days after you ask to delete your account, your account is recoverable by signing back in. After 30 days, it is permanently anonymised on a daily schedule. If you want your account deleted immediately without the 30-day recovery window, contact support@elita.pet and we will action your request as soon as reasonably practicable.
3) What stops immediately when you ask to delete your account:
- Push notifications stop
- Verification and password-reset emails stop
- Pending or queued notifications are cancelled
- All sessions are revoked; you will be signed out of every device on which you are logged in to the App at the time of deletion
- Attribution / advertising identifier processing stops
4) What stops at anonymisation (day 30):
- Your email is freed for re-signup
- Your account is permanently anonymised. We remove every piece of information that identifies you (name, email, phone, address, profile photo, sign-in credentials, advertising identifier, onboarding inputs).
- You can no longer sign in or be re-identified.
5) What we keep, and why: Your dog's data — profile, vet records, check-ins, biomarker history, insights and recommendations — stays in our database with every link to you removed. This data becomes part of Elita's longevity research dataset and helps us improve insights and recommendations for every dog using Blueprint. Because the surviving records are no longer linked to a person, they sit outside the GDPR definition of personal data. The ongoing processing relies on legitimate interests under Article 6(1)(f). See our Legitimate Interest Assessment.
6) Re-signup creates a fresh account. If you sign up again with the same email after the 30-day window, you get a brand-new account with no historical data attached.
7) Sign-ups during the grace period are blocked. If your email is in pending-delete state, sign-up returns "Account exists" and routes you to the restore screen.
8) We confirm your identity before deletion. If you have a password, you re-enter it. If you sign in with Google, you complete a fresh Google sign-in.
9) Data export. In-App self-serve export is not available in version 1 of the App. You can request an export from support@elita.pet before you delete your account. Export after anonymisation is not meaningful because the data is no longer linked to you.
9.1 What happens with our processors when you delete:
- AppsFlyer (attribution). Outbound attribution events stop on delete-request. AppsFlyer prunes raw data per its retention; aggregated reports may persist in anonymised form.
- RevenueCat (subscription management). Customer record is retained while a subscription is active or refund window is open, then archived per RevenueCat's retention policy. Customer ID is unlinked from the deleted account at anonymisation.
- OneSignal (push). Device tokens deactivated; local device-token row marked inactive. Server-side records governed by OneSignal's policy.
- PostHog (analytics). Client calls posthog.reset(); a user_account_deleted event fires. Historical events stay in PostHog under its retention policy.
- Stripe (billing). Stripe retains transaction records for legal and tax reasons regardless of deletion. Premium subscription cancels at next billing cycle.
- Vet Concierge. In-flight requests may still complete. No new outbound communication is initiated. Any response that arrives after anonymisation is discarded.
- Sendgrid (email) Logs and transactional email. May transiently hold your email or other PII after anonymisation per the providers' own policies. Crash and email logs are pruned on each provider's standard schedule.
10. WHO WE SHARE YOUR INFORMATION WITH
We do not sell your information. We share it only as follows:
- With our sub-processors (section 6), strictly to provide the App on our instructions.
- With your vet clinic, only when you authorise the Vet Records Concierge to request records (limited to what is needed to identify you and your dog).
- With the advertising network that resulted in your installation, only when you grant ATT permission and only in aggregated form (e.g., "install attributed to campaign X"). We do not share personal data with ad networks for behavioural advertising.
- Where required by law, including in response to lawful requests from authorities and to enforce our rights or protect safety.
- In a corporate transaction (sale, merger, restructure), in which case we will notify you and make sure any successor is bound by terms that comply with all applicable laws then in force.
11. INTERNATIONAL TRANSFERS AND STORAGE
Your data is hosted on Google Cloud. The primary processing region is Sydney, Australia. Where data is transferred outside your jurisdiction, we rely on standard contractual safeguards (EU Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable). Our sub-processors may process your data in the following countries: United States. Before disclosing personal information overseas, we take reasonable steps to ensure that the overseas recipient handles it in accordance with the Australian Privacy Principles (APP 8).
12. YOUR RIGHTS AND HOW TO USE THEM
Subject to your jurisdiction and any verification process we have to undertake, you can:
- Access — request a copy of the personal information we hold about you. This includes records the App holds about your dog under your account.
- Rectify — ask us to correct anything inaccurate.
- Erase — delete your account as described in section 9. Pet records may survive in anonymised form on the basis described.
- Restrict or object — ask us to limit or stop certain processing, including processing based on legitimate interests.
- Port — request an export (section 9, item 9). In-App self-serve export is not available in version 1 of the App.
- Withdraw consent — for push notifications, Vet Concierge, and marketing attribution via ATT. ATT can be withdrawn any time by accessing iOS Settings → Privacy & Security → Tracking.
- Complain to a regulator — the OAIC in Australia; your national data protection authority in the EEA/UK; the California Privacy Protection Agency in California. If you believe we have breached the Australian Privacy Principles, you may lodge a complaint by emailing support@elita.pet. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
To exercise any of these, email support@elita.pet. We respond within the timeframes required by law (30 calendar days under the Privacy Act; one month under the GDPR).
California (CCPA/CPRA). We do not sell personal information and do not share it for cross-context behavioural advertising. Sharing aggregated install-attribution data with the network that drove your install (where you grant ATT) is measurement only, not cross-context behavioural advertising. California residents can request access, deletion, correction and limits on use of sensitive personal information by emailing support@elita.pet.
13. SECURITY
We protect your information with:
- TLS encryption in transit
- Encryption at rest on the primary data store
- Role-based access controls and least-privilege for staff and contractors
- Secret management for credentials, with rotation
- Monitoring, logging and incident response
No system is perfectly secure. We strongly recommend using a robust, unique password and that you keep your devices secure to prevent unauthorised access.
14. RETENTION SUMMARY
Below is a summary of our data retention practices:
- Active account data: kept while your account is active.
- 30-day grace period: fully retained, recoverable by sign-in.
- Anonymised pet record: kept indefinitely (once anonymised, this data is no longer personal information under the Privacy Act or personal data under the GDPR).
- Attribution data: per AppsFlyer retention (raw events short-lived; aggregated reports retained for analytics).
- Subscription management data (RevenueCat): retained while subscription is active or refund window is open; archived per RevenueCat's retention policy thereafter.
- Billing records: at least 5 years (pursuant to Australian tax and consumer law), held by us and the payment processor.
- Support correspondence: up to 24 months after closure of the ticket.
- Aggregated, de-identified analytics: indefinitely.
15. CHANGES TO THIS POLICY
We may update this policy from time to time. The current version, version number and last-updated date are visible at the commencement of the policy. Prior versions are kept for reference. We will communicate substantive changes in-App or by email before they take effect. Continued use after the effective date means you accept the update.
16. CONTACT
support@elita.pet
Elita Genetics Operations Pty Ltd
Unit 17, 306 Albert Street
Brunswick VIC 3056
Australia