Privacy policy

Last updated: October 2, 2026.

1. Introduction and scope

This Privacy Policy ("Policy") describes how Strand Health Inc., doing business as Everfur ("Everfur," "Company," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information in connection with tryeverfur.com and the services offered on it (the "Site"), where you can ask us for a free health report about your dog or cat (the "Report").

This Policy covers the Site only, and it applies to the Site in place of any other Everfur privacy policy. Everfur's website at everfur.com and the Everfur app have their own privacy policy, which applies when you use them.

By accessing or using the Site, you acknowledge that you have read, understood, and agree to be bound by this Policy in its entirety. If you do not agree with any part of this Policy, you must immediately discontinue all use of the Site.

Strand Health Inc. has its principal place of business at 1002 Dean Street, Suite 101, Brooklyn, NY 11238. For questions regarding this Policy, contact us at hello@everfur.com.

2. Information we collect

2.1 Information you provide directly

• Email address. You can give us only your email address, or go on to request your pet's records.
• Records request details. If you ask us to get your pet's records from your veterinary clinic: the clinic's name and city, your full name, your pet's name, and your authorization for the clinic to share the records with us, with the date and time you gave it.
• Communications. Information in emails and other messages you send us.

2.2 Information from veterinary clinics

We collect the records your clinic sends in response to your request. Veterinary records can include your pet's vaccination history, diagnosed conditions, lab results, exam notes, and other clinical information. They often also include information the clinic keeps about you, such as your contact details and your history with the clinic.

2.3 Information collected automatically

• Ad attribution tags. If you arrive through a link that carries campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content, or gclid), we store those tags with your submission.
• Log and device data. Our hosting providers record standard technical data when you use the Site, including IP address, access timestamps, the URL requested, referring URL, browser type and version, device type, operating system, and error logs.
• Cookies. Google Ads conversion measurement, loaded through Google Tag Manager, as described in Section 7.

2.4 Sensitive information

We do not intentionally collect sensitive personal information as defined under applicable U.S. state privacy laws pertaining to humans, including but not limited to Social Security numbers, driver's license numbers, financial account credentials, genetic data, biometric data used for uniquely identifying a human individual, or health information pertaining to humans. The health information we collect pertains exclusively to non human animals and does not constitute protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) or analogous state laws governing human health data. However, we recognize that pet owner identity information combined with pet health information may be considered sensitive by users, and we treat all user data with appropriate care regardless of its legal classification.

3. How we use your information

We process information only where we have a lawful basis to do so, and we limit processing to what is reasonably necessary for the stated purpose. We use it:

• To request your pet's records from the clinic you name.
• To read the records your clinic sends, and to prepare your Report.
• To email you your Report and service emails about your request.
• To send you marketing emails about Everfur, which you can unsubscribe from at any time.
• To measure our advertising and learn which ads and campaigns bring people to the Site.
• To respond to your questions and requests.
• To operate and secure the Site; to detect, investigate, and prevent fraud, unauthorized access, abuse, and other harmful or illegal activities; to enforce our Terms of Service; and to comply with applicable laws and legal processes.
• To generate aggregate and de identified statistical analyses of population level veterinary health insights.

3.1 Automated processing and AI

Your Report may be prepared using automated processing, including artificial intelligence. We do not use your individually identifiable clinical data, photographs, or other content you submit through the Site to train, fine tune, or otherwise improve our AI models. It is processed to generate your Report and is not incorporated into model training datasets. Inference processing occurs on our own managed cloud infrastructure and is not outsourced to third party model providers without appropriate data processing agreements. Our AI features do not make autonomous decisions that produce legal effects or similarly significant effects concerning any individual. AI generated outputs are probabilistic, may contain errors, omissions, or inaccuracies, and are not a substitute for professional veterinary examination, diagnosis, or treatment.

4. How we share your information

We do not sell your personal information. We share personal information with Google LLC for advertising measurement, as described in Section 7, and you can opt out as described there. Otherwise, we share your information only in the circumstances described below.

• The clinic you name. To request your pet's records, we give that clinic your full name, your pet's name, and your authorization with the date and time you gave it. If the clinic asks to confirm the request with you, we may also give it your email address.
• Service providers. We share information with carefully vetted third party service providers who perform services on our behalf under written agreements that require them to protect your information and use it only as directed by us. For the Site, these include Klaviyo, Inc., our email service provider, which stores your email address, your email preferences, and the information needed to send you our emails; Amazon Web Services, which hosts the systems where we store records requests, records, and Reports; and the hosting, error monitoring, and security providers that support the Site.
• If you book the free vet visit. Booking happens on everfur.com, and what you share there is covered by the privacy policy of everfur.com. We give the veterinarian your Report and your pet's records so they can go over them with you.
• If you use the Everfur app. If you sign in to the Everfur app with the email you used on the Site, we can add your pet's records and Report to your account there, so you don't have to share them again. The app's privacy policy applies to them from then on.
• Legal requirements and protection of rights. We may disclose your information if we believe in good faith that such disclosure is reasonably necessary to: (a) comply with applicable law, regulation, legal process, subpoena, court order, or enforceable governmental request; (b) enforce our Terms of Service or this Policy, including investigation of potential violations; (c) detect, prevent, or otherwise address fraud, security, abuse, or technical issues; (d) protect the rights, property, or safety of the Company, our users, our employees, or the public as required or permitted by law; or (e) establish, exercise, or defend legal claims.
• Business transfers. In connection with, or during negotiations of, any merger, acquisition, sale of assets, reorganization, financing, IPO, joint venture, dissolution, or transfer of all or a portion of our business to another company, your information may be among the assets transferred or disclosed during due diligence. In such an event, we will notify you via email and/or a prominent notice on the Site of any change in ownership, any new uses of your personal information that differ materially from this Policy, and any choices you may have regarding your personal information. The acquiring entity will be bound by the terms of this Policy with respect to information collected prior to the transfer.
• De identified and aggregate data. We may share de identified, aggregated, or otherwise non personally identifiable data with third parties for any purpose, including veterinary research, industry benchmarking, public health analysis, academic publication, and commercial analytics. De identification is performed using techniques that meet or exceed the standards set forth in applicable privacy laws and that are designed to prevent re identification. We contractually prohibit recipients from attempting to re identify de identified data. We do not consider data to be "de identified" if we retain the capability to re associate it with a specific individual. Once data is de identified, it is no longer subject to the access, correction, and deletion rights described in Section 9, as we can no longer identify the data subject.
• With your consent. We may share your information with third parties when you have given us your explicit, informed consent to do so.

5. Records requests and your Report

5.1 Your authorization

When you send a records request, you authorize the clinic you name to share your pet's records with Everfur. Your authorization lets us contact that clinic on your behalf, identify you and your pet, ask for your pet's veterinary records, and receive and use them as described in this Policy. It covers that one request and any follow up needed to complete it.

Some clinics require their own records release form, or want to confirm the request with you directly, before they send records. If yours does, the clinic or we may contact you, and the clinic's own form and policies apply to what the clinic releases.

You can revoke your authorization before the clinic responds by emailing hello@everfur.com from the address you used on the Site. We will stop the request and, if we have already contacted the clinic, tell the clinic you have withdrawn it. If records arrive after you revoke, we will not use them and will delete them. Revoking does not affect records the clinic has already sent, but you can ask us to delete them (Section 9.2).

5.2 Your pet's records

Records clinics send are stored in our systems on Amazon Web Services. We use them to prepare your Report and as otherwise described in this Policy. Records may be reviewed by authorized Everfur personnel to process your request, for quality assurance, and to prevent abuse, subject to strict access controls and confidentiality obligations. We do not publish them.

5.3 Your Report

We email your Report as a PDF to the address you give us. It is an educational summary of what is in your pet's records, such as what is due, what has changed, and questions to bring to your veterinarian. It is not a diagnosis or veterinary advice, and it does not create a veterinarian client patient relationship. Email is not a fully secure channel, so keep access to your inbox secure.

6. Data retention

We retain your personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, to enforce our agreements, and as permitted by applicable law. Our specific retention periods are as follows:

• Records requests, records, and Reports: Retained while we prepare your Report and for as long as reasonably necessary afterward to answer your questions about it, unless you ask us to delete them sooner. After a deletion request, permanently deleted within thirty (30) days, unless retention is required by law, a valid legal hold, or a pending or reasonably anticipated legal proceeding.
• Records request authorizations: Retained with the request they relate to and, after that request is completed, revoked, or deleted, for as long as needed to show that it was authorized.
• Email address and email preferences: Retained until you ask us to delete them. After a deletion request, we keep only a record that the address opted out, so that we do not email it again.
• Ad attribution tags: Retained with your submission and deleted with it.
• Log and diagnostic data: Retained in de identified or pseudonymized form for up to twenty four (24) months for product improvement purposes.
• Communications and support records: Retained for three (3) years following resolution.
• Security logs and audit trails: Retained for a minimum of twelve (12) months and up to thirty six (36) months as required for security incident investigation and SOC 2 compliance.

When retention periods expire, data is permanently deleted from active databases and production systems. Backup systems may retain encrypted copies for up to an additional ninety (90) days, after which backup data is purged through standard backup rotation processes.

7. Cookies, Google Ads, Do Not Track, and Global Privacy Control

We use Google Tag Manager, provided by Google LLC, to run Google Ads conversion measurement on the Site. It sets Google cookies and sends Google the address of each page you view, your browser and device information and IP address, the gclid from the ad you clicked, and an event recording that you submitted the form. We do not send Google your email address, your name, your pet's name, your clinic, or anything from your pet's records. Google uses this information to measure our advertising and for its own purposes under Google's privacy policy. Other than the Google Ads tags described in this Section, we do not allow third party advertisers to place cookies on the Site.

We treat both Global Privacy Control (GPC) and "Do Not Track" (DNT) browser signals as a request to opt out of sale and sharing, including under the CCPA. When a page is requested with either signal, we do not load Google Tag Manager or any Google Ads tags on it. Signals are read per browser and device, so enable the signal on each browser you use.

You may also manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. You can also control how Google uses information for ads in your Google account settings.

8. Data security

We implement administrative, technical, organizational, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, destruction, loss, and misuse. These include encryption of data in transit to and from the Site using TLS 1.2 or higher, encryption of stored records and files at rest using AES 256 or equivalent encryption standards, role based access controls limiting employee and contractor access to personal information to those with a documented, legitimate business need, and multi factor authentication for all employee and contractor access to production systems. Clinics choose how they send records to us, and some methods, such as standard email or fax, may not be encrypted in transit.

In the event of a data breach that affects your personal information, we will notify you and applicable regulatory authorities as required by applicable law within the timeframes specified by such laws. No method of transmission over the Internet or method of electronic storage is completely secure. While we use commercially reasonable and industry standard measures to protect your personal information, we cannot guarantee absolute security. Please notify us immediately at security@everfur.com if you suspect any unauthorized access to your information.

9. Your privacy rights

9.1 Rights available to all users

Regardless of your geographic location, we provide all users with the following rights:

• Right to Access: You may request a copy of the personal information we hold about you, including the categories and specific data elements collected, the sources of that information, the purposes for which it is used, and the categories of third parties with whom it has been shared.
• Right to Correction: You may request that we correct or update inaccurate, incomplete, or outdated personal information.
• Right to Deletion: You may request that we delete your personal information, subject to certain exceptions required by law (such as fraud prevention, legal compliance, or exercising or defending legal claims).
• Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, machine readable format (such as JSON or CSV).
• Right to Opt Out of Marketing: You may opt out of receiving promotional communications at any time by following the unsubscribe instructions in those communications or by contacting us at hello@everfur.com.
• Right to Withdraw Consent: Where we rely on your consent to process your information, including your records request authorization, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, contact us at hello@everfur.com. We will acknowledge your request within ten (10) business days and respond substantively within thirty (30) days. We may require verification of your identity before processing your request, and we will not fulfill requests that we cannot verify. We will not charge a fee for processing reasonable requests.

9.2 Deleting your pet's records and your email

To delete your pet's records, your Report, your records request, or your email address, email hello@everfur.com from the address you used on the Site and tell us what to delete, or ask us to delete everything. We will confirm the request with that address, delete the information from our systems and from Klaviyo within thirty (30) days, and tell you when it is done. Section 6 describes what we keep after a deletion request. Deleting your information here does not delete records held by your clinic, or anything in an Everfur app account.

9.3 California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the CCPA): Right to Know the categories and specific pieces of personal information collected, sources, purposes, and third party recipients. Right to Delete personal information we have collected, subject to statutory exceptions. Right to Correct inaccurate personal information. Right to Non Discrimination: We will not discriminate against you for exercising any CCPA rights, including by denying goods or services, charging different prices, providing a different level of quality, or suggesting you will receive any of the foregoing. Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information as defined under the CCPA, you have the right to limit our use and disclosure of such information to purposes necessary to provide the Site.

Through the Site we collect these categories of personal information: identifiers (such as your name, email address, IP address, cookie identifiers, and the gclid); customer records (such as the information about you in your pet's records); commercial information (such as your history with your clinic, where your pet's records include it); and internet or other electronic network activity (such as pages viewed and ad attribution tags). We collect them from you, from the clinic you name, and automatically from your browser, for the purposes in Section 3, and disclose them to the recipients in Section 4.

We do not sell personal information. We share personal information (the addresses of Site pages you view, cookie and device identifiers, the gclid, IP address, and form submission events, as described in Section 7) with Google LLC for advertising measurement, which we treat as sharing for cross context behavioral advertising. You can opt out of this sharing by enabling Global Privacy Control in your browser: when we receive a Global Privacy Control or Do Not Track signal, we do not load Google Tag Manager or any Google Ads tags. We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA. To submit a CCPA request, contact us at hello@everfur.com. You may designate an authorized agent to make a request on your behalf, subject to our identity verification procedures. We will verify your identity using at least two data points matching the information you gave us on the Site before fulfilling your request.

9.4 Residents of other U.S. states with comprehensive privacy laws

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Kentucky, Rhode Island, Tennessee, Nebraska, New Hampshire, New Jersey, Maryland, Minnesota, or any other U.S. state that has enacted or enacts comprehensive consumer privacy legislation, you may have rights similar to those described above, including rights to access, correct, delete, and port your personal information, as well as the right to opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects. We honor all such rights to the extent required by applicable law. To exercise these rights, contact us at hello@everfur.com. If we decline your request, you may appeal our decision by contacting us at hello@everfur.com with the subject line "Privacy Rights Appeal" and we will respond within the time period required by your state's law.

9.5 International users (GDPR and similar laws)

While the Site is primarily directed at users in the United States, if you access the Site from a jurisdiction subject to the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, or similar comprehensive data protection legislation, you may have additional rights including the right to lodge a complaint with a supervisory authority, the right to object to processing based on legitimate interests, and the right to restrict processing. Our lawful bases for processing include performance of a contract, legitimate interests (such as improving the Site, ensuring security, and preventing fraud), consent (where applicable), and legal compliance. The Site is operated in the United States, and your information will be transferred to, stored, and processed in the United States. For data transferred outside your jurisdiction, we rely on Standard Contractual Clauses or other approved transfer mechanisms. Contact us at hello@everfur.com for more information or to exercise your rights.

10. Children's privacy

The Site is not directed to individuals under the age of thirteen (13), or under the age of sixteen (16) in jurisdictions where applicable law sets a higher age threshold. We do not knowingly collect personal information from children below these applicable age thresholds. If we become aware that we have collected personal information from a child without verification of parental consent (where required), we will take prompt steps to delete that information. If you believe we may have collected information from a child below the applicable age threshold, please contact us immediately at hello@everfur.com.

11. Third party sites

The Site links to the Everfur app's pages on the Apple App Store and Google Play, which are operated by Apple and Google. This Policy does not apply to those third party services, and we are not responsible for their privacy practices, data collection, or security measures. We encourage you to review the privacy policies of any third party services before providing your information. If you download and use the Everfur app, the app's own privacy policy applies to that use.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our data practices, the Site, legal requirements, or industry standards. If we make material changes, we will notify you by email to the address you gave us on the Site, by a prominent notice on the Site, or both, at least thirty (30) days prior to the effective date of the changes. We will indicate the date of the most recent update at the top of this Policy. Material changes will not be applied retroactively to information collected before the effective date of the change without your consent where required by applicable law.

13. Governing law and dispute resolution

This Policy is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. Any dispute, claim, or controversy arising out of or relating to this Policy or the processing of your personal information shall be resolved in accordance with the dispute resolution provisions set forth in the Terms of Service for the Site, which may include mandatory binding arbitration and a class action waiver. To the maximum extent permitted by applicable law, the Company's liability for any claims arising under or related to this Policy shall be limited as set forth in those Terms. Nothing in this section limits your right to file a complaint with a data protection authority in your jurisdiction where applicable law provides for such a right.

14. Contact us

If you have questions, concerns, complaints, or requests regarding this Privacy Policy, our data practices, or your privacy rights, please contact us at:

Strand Health Inc. dba Everfur, 1002 Dean Street, Suite 101, Brooklyn, NY 11238.

Email: hello@everfur.com. Phone: (914) 924-4815. Security issues: security@everfur.com.