Privacy Policy
Last updated: July 30, 2026
1. Who We Are
Milata LLC, doing business as ExoticRx (exoticrx.com), is the data controller responsible for the personal data described in this policy. In this policy, “ExoticRx,” “we,” and “us” mean Milata LLC. For any privacy matter, email [email protected] or use our contact form.
2. Data We Collect
- Account data: Email address, display name, professional role
- Subscription data: Subscription tier, billing status (managed by Stripe)
- Saved patient records (Pro): If you use the patient manager, the animal names, species, weights, and free-text notes you enter are stored to your account so you can reuse and reprint them. These are user-entered animal records, not human health information, and are not treated as HIPAA-covered data.
- Calculation history: Your recent dose calculations are stored to your account so you can revisit them.
- Usage data: Calculation counts and product-usage analytics events (see §5)
Email use. We use your email address to send account, security, and billing messages. New accounts also receive a short getting-started series (how-to tips and a feedback ask) — you can opt out of it at any time via the unsubscribe link in each message. Promotional email — feature promotions and offers — is sent only if you ticked the optional consent box when creating your account, and our newsletter only after you confirm your subscription by clicking the link in a confirmation email. You can withdraw consent and unsubscribe from marketing email at any time via the unsubscribe link included in every such email; transactional account and billing emails are sent regardless.
3. Data We Do Not Collect
- Payment card details (handled entirely by Stripe)
- We do not sell your personal information or use it for cross-context behavioral advertising
- We do not collect human patient/health data, and the Service is not intended for human medical use
4. How We Use Your Data (Purposes & Legal Bases)
For users in the EU/EEA/UK, GDPR requires us to state the legal basis for each way we use your data:
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing your account, dose calculations, saved patient records, calculation history, and subscription billing | Account data, patient records, calculation history, subscription data | Performance of a contract (our Terms of Service) |
| Account, security, and billing email (transactional) | Email address | Performance of a contract |
| Getting-started emails and a feedback ask for new accounts | Email address | Legitimate interest — helping new users get value from the Service; opt out any time by unsubscribing |
| Promotional email: feature promotions and offers | Email address | Consent — the optional checkbox at sign-up; withdraw any time by unsubscribing |
| Newsletter | Email address | Consent — confirmed (double) opt-in; withdraw any time by unsubscribing |
| Product-usage analytics (PostHog) | Usage events, account identifier | Consent — the analytics consent banner; withdraw via cookie settings |
| Bot protection, rate limiting, and spam defence on sign-up, contact, and newsletter forms | IP address, user-agent (auto-cleared after 90 days, see §8) | Legitimate interest — keeping the Service secure and abuse-free |
5. Service Providers & Third Parties
We share the minimum data necessary with the following providers so the Service can function. We do not sell your data.
- Keycloak: Authentication, self-hosted on our own infrastructure
- Stripe (Stripe, Inc., United States): Payment processing (Stripe Privacy Policy)
- PostHog (PostHog, Inc., United States): Product-usage analytics. Loaded only with your consent and routed through a same-origin proxy; when you are signed in, analytics events are associated with your account identifier (PostHog Privacy Policy)
- Cloudflare (Cloudflare, Inc., United States): Bot protection (Turnstile) on our sign-up and contact forms, optional privacy-first Web Analytics, and CDN/security (Cloudflare Privacy Policy)
- Resend (Resend, Inc., United States): Email delivery for our account, billing, and (opt-in) marketing and newsletter messages
6. International Data Transfers
ExoticRx is operated from the United States. All Service data — account data, saved patient records, calculation history, and newsletter and support records — is stored on our own infrastructure in the United States, and the service providers listed in §5 also process data in the United States. If you use the Service from the EU/EEA, the UK, or anywhere else outside the US, your personal data is transferred to and processed in the United States, where data-protection law differs from the law of your country. We are not certified under the EU-U.S. Data Privacy Framework and do not rely on Standard Contractual Clauses; we collect your data directly from you on the legal bases described in §4 and protect it as described in this policy. Your rights in §7 apply regardless of where you live.
7. Your Privacy Rights
California residents. You may request access to, correction of, or deletion of your personal information, and we will not discriminate against you for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising.
For EU/EEA/UK users, you additionally have the right to:
- Right to access: Request a copy of your data
- Right to erasure: Request deletion of your account and data
- Right to data portability: Request your data in a portable format
- Right to rectification: Update your account information
- Right to object: Object to direct marketing at any time
- Right to restriction: Ask us to restrict processing of your data while a dispute or request is resolved
- Right to withdraw consent: Where we rely on your consent (marketing email, newsletter, analytics — see §4), withdraw it at any time via the unsubscribe link or your cookie settings, without affecting processing that happened before you withdrew
- Right to complain: Lodge a complaint with your data-protection supervisory authority — the authority of your EU/EEA member state, or the Information Commissioner's Office (ICO) in the UK
To exercise any of these rights, email [email protected] or use our contact form.
8. Data Retention
We retain your account and its data for as long as your account is open. You can request deletion of your account at any time via the contact form. When we act on a deletion request, we erase your account data from our systems — your profile, saved patient records, calculation history, and email/marketing preferences — within 30 days, and we revoke your login and cancel any active subscription at once.
We keep a small set of records the law lets us retain, and only for that purpose (never for product, analytics, or marketing use):
- Billing and tax records — held mainly by our payment processor (Stripe) under its own tax and accounting obligations — for the period required by law.
- Your terms-acceptance record — the version you accepted and when — with your email removed, kept as our proof that our Terms (including their liability terms) applied to you, for the applicable limitation period.
- Marketing/newsletter consent proof, where a consent remains in force, for as long as it does (and for up to the applicable limitation period afterwards).
Technical metadata such as IP address and user-agent attached to support records is automatically cleared after 90 days. Your data also leaves our encrypted backups as they rotate, within approximately 35 days of deletion.
9. Cookies
See our Cookie Policy for details on cookies used by the Service.
10. Contact
Privacy questions? Email [email protected] or use our contact form.