1. Who is responsible for the data
Pontia is a veterinary-clinic communication service owned and provided by KON Global Co., Ltd. (company registration no. 0105568137772), with its registered office at 748, 5th Floor, Soi Sukhumvit 30/1, Sukhumvit Road, Khlong Tan, Khlong Toei, Bangkok, Thailand. AnyVet Co., Ltd. provides technical infrastructure and operations to KON Global as a service provider. Responsibility depends on why the data is handled.
- The clinic decides why and how it communicates with customers and manages customer, pet, appointment, and conversation information. For that information, the clinic is normally the data controller. KON Global handles the data to provide Pontia to the clinic, and AnyVet may handle it as KON Global’s subprocessor under KON Global’s instructions.
- KON Global decides how Pontia accounts, authentication, platform security, support, and service administration data are handled. For those activities, KON Global acts as a data controller.
If you are a clinic customer or pet owner, the clinic you contacted is the first point of contact for requests about your conversation or pet record.
2. Data Pontia may handle
- Clinic and team information, including names, work contact details, roles, and account status.
- Authentication and security information, including phone-based login records, session data, and audit events.
- Channel identifiers and customer contact information supplied by connected services.
- Conversation content, attachments, delivery status, internal notes, assignments, and tags.
- Customer and pet context entered by a clinic, such as pet names, species, allergy notes, and appointment context.
- Technical information needed to operate and secure the service, including error, access, and delivery records.
Clinics choose what they enter into Pontia. They should not add information that is unnecessary for customer communication or clinic operations.
3. Why the data is used
Pontia handles data to:
- authenticate clinic team members and enforce clinic-level access controls;
- receive, organize, assign, display, and send messages through connected channels;
- store attachments and provide clinic staff with relevant customer and pet context;
- provide optional translation, search, and AI-assisted reply features when a clinic enables them;
- prevent abuse, investigate errors, maintain audit records, and protect the service;
- provide support and administer the clinic’s service agreement; and
- comply with applicable law and enforce legal rights.
The applicable legal basis depends on the activity and the clinic’s relationship with the person. It may include performance of a contract, compliance with law, legitimate interests that do not override individual rights, or consent where consent is required. Clinics remain responsible for selecting and documenting the basis for their customer communications.
4. Service providers and connected channels
KON Global uses AnyVet as Pontia’s technical operations provider and may use other service providers for hosting, database, authentication, file storage, delivery, monitoring, and support. Current infrastructure includes Supabase, Vercel, and Railway. Connected communication providers may include LINE, Meta services such as Facebook, Instagram, and WhatsApp, and a clinic’s email provider.
When an optional feature is enabled, relevant content may also be processed by the selected AI, translation, or search provider, which may include Anthropic, Google, or Voyage AI. Pontia sends only the information required to perform the enabled function and does not give an AI system authority to make clinical decisions.
Some providers process data outside Thailand. KON Global and the clinic must use appropriate contractual and operational safeguards for international transfers where required. Connected providers process data under their own terms and privacy notices as well.
5. Retention and deletion
Data is kept only while it is needed to provide Pontia, meet the clinic’s documented instructions, protect the service, resolve disputes, or comply with law. Different records require different retention periods. Clinic conversation retention, account closure handling, backup expiry, and mandatory audit retention are governed by the applicable service agreement, retention schedule, and legal obligations.
A deletion request may be limited where data must be retained for a legal obligation, security investigation, dispute, or other lawful reason. See the data deletion instructions.
6. Security
Pontia uses clinic-level access controls, role-based permissions, encryption for sensitive channel credentials, signed access for stored media, webhook verification, audit records, and operational monitoring. No system is completely secure, and clinics must manage staff access and connected channel credentials responsibly.
7. Individual rights and requests
Subject to applicable law, a person may ask to access, correct, receive, restrict, object to, or delete personal data, or withdraw consent where processing relies on consent. Identity and authority may need to be verified before a request is completed.
Clinic customers should contact the clinic through the same channel used for the conversation. Clinic team members should contact their clinic administrator or the KON Global contact named in the clinic’s service agreement. For requests concerning KON Global’s own controller activities, contact konglobal2025@gmail.com or +66 65 939 5783.
8. Changes to this notice
This notice may be updated when Pontia’s features, providers, or legal obligations change. The current version will show its last-updated date. Material changes should also be communicated to affected clinics through an appropriate service channel.