Good horse record permissions give each person the least access their job needs. Owners see their own horses, staff edit daily care, vets see clinical history, and only a few people can export or delete. Set those roles once, give everyone their own login, and review access whenever a horse, staff member or vet changes.
This guide sets out which records need controls, how to assign access by role, how to handle sales and staff changes, and what Australian yards should know about privacy.
TL;DR
- Give every person their own login and the minimum access their job needs. Never share one yard login.
- Separate four actions for each record type: view, edit, export and delete. Keep export and delete for a small group.
- Treat ownership changes, staff departures and vet changes as permission events, and review access on the day they happen.
- Name an authorised person for emergencies, and make sure they can reach the essentials even when the owner cannot be contacted.
- Privacy rules differ by country. In Australia, check whether the Privacy Act applies to your business.
Table of Contents
- Which horse records need access controls
- A role-by-role permission model
- Sharing records securely
- Keeping records accurate and auditable
- When ownership, staff or vets change
- Emergency access
- Privacy and legal basics for Australian yards
- Our perspective
- Set up permissions in EquiBETS
- FAQ
- Sources
Which horse records need access controls
Not every record carries the same risk. A feed chart and a surgical history are different things, and so are an owner's invoice and a vaccination date. Start by sorting records into groups:
- Clinical records: treatments, vaccinations, procedures, diagnostics, scanned vet reports, supplements and medication.
- Financial records: invoices, owner statements, syndicate shares, expense splits and payment history.
- Ownership and identity records: owner contact details, microchip and registration numbers, transfer paperwork.
- Training and performance records: ride logs, GPS data, movement analysis, competition plans.
- Daily care records: feed plans, turnout, farrier and dental schedules, stable notes.
- Emergency information: contacts, authorised representatives, insurance details, consent to treat.
Racing shows how seriously regulators take this. Under the US Horseracing Integrity and Safety Authority's Racetrack Safety Program, trainers are usually the Responsible Person and must keep medication, vaccination, procedure and treatment records. Access to that data is restricted to the owner, regulatory vets, attending vets, relevant racing commission personnel and the trainer. Most Australian yards are not under that program, but the logic carries over: clinical data goes to the people involved in the horse's care, and not to everyone who walks through the yard.
A role-by-role permission model
The least-privilege principle is simple: each person gets only the access needed for their job. A practice-management vendor's guidance on role-based permissions makes the same point, giving practice managers and veterinarians different example permissions rather than treating all staff alike. Apply that to a yard.
| Role | View | Edit | Export | Delete |
|---|---|---|---|---|
| Yard owner or principal | All records | All records | Yes | Yes |
| Stable manager | Care, clinical, ownership summary | Care, clinical, schedules | Limited | No |
| Groom or rider | Care plans, schedules, ride notes | Daily care, ride logs | No | No |
| Trainer | Training, clinical summary, ride data | Training and ride data | Training reports | No |
| Vet (attending) | Clinical history, emergency plan | Clinical entries for their patients | Clinical records | No |
| Owner | Their horse's updates, invoices, documents | Nothing, or comments only | Own statements | No |
| Syndicate member | Syndicate finances and horse updates | No | Own statements | No |
| Bookkeeper | Financial records | Financial records | Financial reports | No |
Treat this as a starting point and adjust it to how your yard works. The four columns matter because they stop a person who needs to read a record from also being able to change or remove it.
Owners and syndicates
Owners want to see their horse's progress, vet visits and bills. They rarely need to see another owner's horse, or your payroll. Give them a portal view limited to their own horses.
Syndicates add a wrinkle: several people share one horse. The HISA model has a useful idea here. If a horse is owned by more than one person or by an entity such as a company or partnership, one owner serves as the Designated Owner, who can share information with other registered owners. You can borrow that structure: nominate one syndicate administrator as the main contact, and let that person's access flow to members at the level you agree. Members then see the horse and their own share of costs, not each other's personal details.
Our guide to owner document access for pro yards walks through setting that up step by step.
Yard staff
Staff turn over, and casual and seasonal workers are common. Define roles by task rather than by person, so a new groom gets the groom role on day one and loses it on their last day. Give riders access to the horses they ride and the notes they need. Keep invoices, ownership details and export rights out of reach unless the role needs them.
Trainers and vets
Trainers need performance data and a clinical summary so they can plan work around a horse's health. Vets need the clinical history, medication and supplement list, and the emergency plan. They do not need yard finances.
Vets often work across many yards, so access should be quick to grant and quick to withdraw. We cover this in three fast routes for vets to access horse data. For handing over supplement history, see supplement tracking for vet handoffs.
Sharing records securely
Sharing is where most privacy slips happen: a PDF forwarded to the wrong person, a spreadsheet in a group chat, a photo of a vet report on someone's personal phone. A few habits reduce the risk.
- Share a view, not a file. Give the person access to the record inside your system instead of emailing an attachment. You can withdraw a view; you cannot pull back an email.
- Time-limit outside access. A visiting vet, farrier or transport agent needs access for the job, not forever. Set an end date when you grant it.
- Restrict export. Export is the point where a record leaves your control. Limit it to the roles that need it, such as the principal, the stable manager and an attending vet.
- Restrict delete. Deleting should be rare, and in most cases the correct action is to correct an entry with a note and keep the original visible.
- Scan paper into the system. Paper reports in a tack room drawer have no permissions at all. Our guide on scanning vet reports so they stay usable covers how to bring them in.
For a wider look at keeping equine data private between yards and vets, read how to fix equine data privacy quickly.
Keeping records accurate and auditable
Permissions only help if you can tell who did what. One help-centre guide for a pet-care platform recommends that each person has their own profile, logins are never shared, and leavers are archived immediately, so that every action is attributable to an individual. That advice fits any yard.
Put it into practice:
- One login per person, including casual staff and visiting professionals.
- A recorded name and time on every entry and edit.
- Corrections made as new entries, not overwrites.
- A monthly look at who has access and whether they still need it.
A clear history also helps when a vet asks what a horse was given six months ago, or when an owner queries a treatment. We explain how to build that history in our piece on the horse record audit trail for pro yards. For the wider picture, see our guide to equine medical records management.
When ownership, staff or vets change
Most permission problems show up at a handover, not in daily use. Plan for three events.
A horse is sold, transferred or moves yards
In US racing, the rules are explicit. When a horse is transferred, sold or claimed, treatment records follow the horse and new associated persons can see them, with access limited to the current Designated Owner, Responsible Person and assigned Attending Veterinarian. When a horse is claimed, the previous trainer must transfer trainer records to the new trainer within three days. Those records cover medical, therapeutic and surgical treatment, not training techniques or protocols.
The practical lesson for any yard is to separate what travels with the horse from what stays with you. Health history travels. Your internal training notes and billing history usually do not. On the day of transfer:
- Remove the previous owner's portal access to that horse.
- Add the new owner at the agreed level.
- Export or share the clinical history the new owner or yard is entitled to.
- Keep your own financial records for the period you looked after the horse.
A staff member leaves
Archive the account the same day. Do not delete it, because their past entries still need to show who made them. Change any shared codes that person knew, such as gate or feed room codes, and check they have not kept records on a personal device.
A vet or trainer changes
Grant the new professional access before the first visit, and remove the old one once care has formally moved. Tell the new vet who the horse's authorised people are. If you operate a syndicate, tell members about the change so they are not surprised by a new name on their statements.
Emergency access
A locked-down record is no help at 2 am with a colicking horse and an owner who is not answering. Emergency access needs a plan made in advance.
The British Horse Society's Equine Care and Emergency Plan says an owner should name a Yard Manager or Authorised Representative who may present the horse to a vet if the owner cannot be reached, and give that person a signed copy of the plan. It also recommends telling the veterinary practice who the nominated representative is, so the practice can take that person's instructions when needed.
In permission terms, that means:
- Every horse has a named authorised person on file, with the owner's signed consent.
- The emergency view shows the essentials only: contacts, allergies, current medication, insurance details and consent to treat.
- That view is available on a phone, including where mobile reception is poor.
- The attending vet knows who the representative is before an emergency happens.
Our guide to what every horse emergency contacts sheet needs lists the fields to include.
Privacy and legal basics for Australian yards
There is no single worldwide horse-record privacy regime. The records are about animals, but they also hold personal details about owners, staff and syndicate members, and that is where privacy law bites. Because laws differ by country, check the rules where your yard, vet and owners are based.
In Australia, the Privacy Act 1988 sets out the Australian Privacy Principles, including a requirement to protect personal information from inappropriate disclosure. Businesses with a turnover of $3 million or less are generally exempt, with some exceptions, so a smaller yard may fall outside it while a larger operation, or one tied to a health service provider, may not. Check your own position with a lawyer or the Office of the Australian Information Commissioner. Even where you are exempt, applying the same habits is good practice and builds owner trust.
Horse movement is a separate matter. Keeping movement records and holding a valid Property Identification Code are part of horse biosecurity in New South Wales. Each state and territory has its own rules, so check your state's primary industries agency for the current requirements.
If you serve owners overseas, other regimes may apply. The EU's GDPR, for example, requires personal data to be processed lawfully, limited to specified purposes, kept accurate, retained no longer than needed and protected against unauthorised access, and it can reach organisations outside the EU that offer services to people there. In the United States, veterinary confidentiality is set by each state. California and Indiana both restrict who may receive an animal's veterinary record without the client's authorisation, with their own exceptions.
Our perspective
We built EquiBETS around a simple belief: a professional yard should not have to choose between sharing information and protecting it.
In our experience, yards run into trouble when records live in many places: a notebook in the tack room, a spreadsheet, a group chat and a vet's own files. Nobody can say who saw what, and nobody wants to be the person who removes access. One connected workspace changes that. Owners get a portal for real-time updates. Vets see the clinical history they need. Staff see the tasks in front of them. Each group sees only its own slice.
Our approach is evidence-led and task-focused. Permissions should be clear enough that a stable manager can set them in minutes, and sensible enough that a new groom is never given more than their job needs. Our emergency plans give vets and responders critical information access when the owner cannot be reached, and our offline-first mobile app means that information is there even when reception is not.
We design with data privacy as a priority, because horse records hold real people's details as well as animal health history. Everyone on the team gets an individual account, so entries are attributable, and the record stays trustworthy for owners, vets and the yard.
isaac
Set up permissions in EquiBETS
EquiBETS Complete is a single plan that includes every module, for unlimited horses and team members, at 9.99 AUD per month. It covers horse records, owner portals, syndicate management, finance tracking, emergency plans, team coordination and stable chat, so you can set each person's access in one place instead of across several tools. A free trial is available before you subscribe.
See the plan and start your trial on the EquiBETS pricing page. If you are moving a paper or spreadsheet system across, our article on offline horse management software shows what changes day to day. Our guide to FEI horse records for pro yards is useful if you compete.
FAQ
Who should be able to delete a horse record?
Only a small group, typically the yard principal and perhaps the stable manager. In most cases the better action is a correction that keeps the original entry visible. That preserves the history for vets, owners and any later dispute.
Should owners be able to edit their horse's records?
Usually not. Owners are best served by a view of their horse's updates, documents and invoices, with the option to comment or ask questions. Keeping edit rights with staff and vets keeps the clinical and financial record consistent.
How do I share records with a vet who visits only occasionally?
Give the vet a view limited to the horses they treat, and set an end date if the arrangement is temporary. Check that they can see the clinical history, medication and emergency plan. Withdraw access when the arrangement ends.
Who can act for an owner in an emergency?
Someone the owner has named in advance, such as a yard manager or authorised representative, ideally with a signed plan on file. The British Horse Society recommends also telling the vet practice who that person is. Record the name and consent where the whole team can find it.
Sources
- Horseracing Integrity and Safety Authority: owners
- HISA Trainer Handbook (TRA)
- HISA Trainer Handbook (Minnesota Racing Commission)
- Why use role-based permissions in ezyVet
- User profiles, roles and permissions, Lupa Help Center
- British Horse Society: Equine Care and Emergency Plan
- Privacy laws: the small business exemption
- NSW DPI: horse owners and biosecurity
- EU General Data Protection Regulation 2016/679
- California Business and Professions Code § 4857
- Indiana Code § 25-38.1-4-5.5