Research Privacy Notice

UK Independent Vet Practice PIMS Survey 2026

Last updated: May 2026 Version: 1.0

This notice covers the personal data we hold and process for one specific research project: the UK Independent Vet Practice PIMS Survey 2026. It sits alongside our main VetStack Consulting Limited Privacy Policy, which continues to apply to all other interactions with us. Where this research notice and the main policy say different things, this research notice prevails for data handled in the course of this research.

Who we are

VetStack Consulting Limited is the data controller for personal data processed under this research. We are an independent, vendor-agnostic consultancy serving the UK veterinary profession. Company name: VetStack Consulting Limited Company number: 16930301 (England and Wales) Research contact: research@vetstack.uk General contact: hello@vetstackconsulting.co.uk Website: https://www.vetstack.co.uk ICO registration: [ICO_REG_NUMBER] If you would prefer to write to us, contact details for postal correspondence are available on request via either email above.

Why this research exists

The CMA market investigation into veterinary services for household pets (final report, March 2026) identified information asymmetry in the veterinary profession as a structural concern. Independent practices, in particular, have fewer resources than the large corporate groups to evaluate and compare practice information management software. This research builds an independent, sector-level picture of: which Practice Information Management Systems (PIMS) are used by UK independent practices, how confident the profession is that current PIMS providers will support the new CMA obligations, where the profession sees its current systems falling short. Findings will be published as a free sector report and shared with respondents, the British Veterinary Association, the Federation of Independent Veterinary Practitioners, and the wider profession. The research has no commercial purpose. Responses are not used to drive sales or marketing for VetStack Consulting Limited or any other party.

What data we process and why

We handle three categories of personal data for this research, each under a different lawful basis under UK GDPR.

Category A: Practice business contact details (sample frame)

What: practice trading name, premises address and postcode, generic practice phone number, generic practice email (e.g. info@, reception@, enquiries@), website URL, practice type (small animal, mixed, equine, farm), site count, vet headcount range, Companies House registration number where available, legal entity type, parent company where applicable. Source: all from public sources. Specifically: the RCVS Find a Vet practice register, the Companies House public register, whoownsyourvet.co.uk, vethelpdirect.com, and the public-facing pages of practice websites.

Why: to send research invitations to a representative sample of UK independent practices. Lawful basis: Article 6(1)(f) UK GDPR (legitimate interests). Our legitimate interest is the conduct of independent, non-commercial market research that benefits the UK veterinary profession. We have completed a Legitimate Interest Assessment that records the purpose, necessity, and balancing tests. No special category data and no clinical data are processed.

Category B: Survey responses

What: answers given in the PMS survey itself. The survey is anonymous by default. Responses are not linked to identifying information unless you choose to provide an email in one of the optional questions (see Category C).

Source: directly from you, the respondent.

Why: to analyse and publish aggregated findings about PMS use in the UK independent profession. Lawful basis: Article 6(1)(a) UK GDPR (consent). Submitting the survey constitutes consent to your responses being used for the purposes set out in this notice. You can withdraw consent at any time before responses are aggregated by emailing research@vetstack.uk.

Category C: Email addresses you provide in the survey

What: an email address you optionally provide for one or both of the following reasons: To receive a copy of the published sector report. To enter the £250 Amazon voucher prize draw.

Source: directly from you.

Why: so that we can fulfil the action you have asked us to take. Sector report email is used only to send you the report once. Prize draw email is used only to contact you if you win and is held entirely separately from your survey responses.

Lawful basis: Article 6(1)(a) UK GDPR (consent), specific and informed.

How responses and emails are kept separate

The survey response data and any optional email addresses you provide are stored in separate databases. We cannot link your survey responses back to the email address you provide for the report or the prize draw. The prize draw email database is held in a separate workspace from the research analysis data. Aggregate analysis is performed on the anonymous response data only.

Who we share data with

We do not sell or rent personal data, and we do not share it with any party for marketing or commercial purposes. We use the following third-party processors to operate this research. Each is contractually bound to act only on our instructions and to apply appropriate technical and organisational measures.

Processor Role Location

Typeform Survey hosting and response collection EEA (Spain), with sub-processors per Typeform's published list and Distribution of the survey invitation UK / EEA Cloud spreadsheet provider (e.g. Microsoft 365 / Google Workspace) Internal storage of the sample frame and aggregated analysis UK / EEA

If we add or change a processor, this notice will be updated.

We do not transfer personal data outside the United Kingdom or the European Economic Area. Where any of our processors operate from outside the UK / EEA, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU SCCs.

How long we keep data

Data Retention

Sample frame (practice business contact details) For the active research project plus 12 months for any longitudinal follow-up, then deleted or anonymised. Survey responses 24 months from survey close, then deleted. Aggregate findings retained indefinitely in published reports. Sector report email list Until the report is sent to you, then deleted within 30 days. Prize draw email list Until the prize is awarded, then deleted within 30 days. Suppression list (do-not-contact records) Indefinite (this is the only way we can guarantee not to recontact a practice that has asked to be removed).

Your rights

Under UK GDPR you have the right to: Access the personal data we hold about you and your practice. Rectification of inaccurate data. Erasure of your data ("right to be forgotten"). Restriction of processing. Objection to our processing under legitimate interests. Portability of data you have provided to us. Withdraw consent at any time, where we rely on consent (this does not affect the lawfulness of processing before withdrawal). To exercise any of these rights, email research@vetstack.uk. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office if you believe your data has been handled improperly. Their details are at https://ico.org.uk.

How to remove your practice from the research list

If you would like your practice removed from our research sample frame, email research@vetstack.uk with the practice name and postcode. We will: Remove your practice from the active sample within five working days. Add the practice to a permanent suppression list so that it is not re-imported in any future data refresh. The suppression list contains only the minimum information needed to prevent recontact (practice name, postcode, email) and is retained indefinitely under our legitimate interest in honouring removal requests.

Security

Personal data is held on systems with industry-standard security controls. Access is restricted to named research staff at VetStack Consulting Limited under role-based permissions. Data is encrypted at rest and in transit. We will notify the ICO and affected data subjects within 72 hours if a personal data breach is identified that meets the notification threshold under UK GDPR Article 33.

Automated decision-making

e do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects.

Children

This research is not directed at children. Veterinary practices are business entities and the practice contacts we hold are professional rather than personal. We do not knowingly collect data from anyone under 18.

Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top reflects the latest version. Any change that materially affects how we process your data will be notified to research participants directly where contact details are held.

Contact

For any question about this notice or how we handle research data: Email: research@vetstack.uk Postal: available on request via the email above For complaints about data handling that we have not resolved to your satisfaction: Information Commissioner's Office Web: https://ico.org.uk Phone: 0303 123 1113

This notice applies only to data processed under the UK Independent Vet Practice PIMS Survey 2026 research project. For all other VetStack Consulting Limited services and interactions, see the main Privacy Policy.