An owner portal is safe to use when it collects only what the yard needs, shows each person only their own horses and records, protects logins with more than a password, and gives you a clear way to correct or delete information. If a portal can't show you those four things, don't put owner details, invoices or vet records into it.
This guide is for yard managers, syndicate administrators and vets who share horse information with owners online. It covers what a portal typically holds, how to set permissions, what Australian privacy guidance expects, and the questions to ask before you commit.
TL;DR
- Collect only what you need. Contact details, horse records and invoices are enough for most portals. Everything else is extra risk.
- Give access by role. An owner sees their horse, a groom sees the daily care list, and finance sits with a small group.
- Turn on multi-factor authentication. Australian and US regulators both recommend it for logins that guard personal information.
- Know where your data lives and who processes it. If a provider handles data for you, your yard is still responsible for how it is looked after.
- Have a plan for corrections, exposure and deletion before something goes wrong.
Table of Contents
- What an owner portal actually holds
- Collect less: the first privacy control
- Who should see what: permissions that match real yard roles
- Sharing with vets, staff and other third parties
- Security basics a portal should meet
- Questions to ask before you choose a portal
- Retention, correction and deletion
- If information is wrong, misused or exposed
- Try a portal that keeps it in one workspace
- A 30-minute privacy check for your yard
- FAQ
- Sources
What an owner portal actually holds
A portal looks simple from the owner's side: a feed of updates, some photos, an invoice. Behind it sits a lot of personal information, and that is where the privacy question starts.
For a professional yard, the data usually falls into five groups:
- People: owner names, phone numbers, email addresses, postal addresses, and sometimes emergency contacts.
- Horses: passport and microchip details, vaccination history, farrier and dental records, vet notes, insurance information.
- Money: invoices, payment history, board and training charges, and for syndicates, each member's share and contributions.
- Performance: ride logs, training notes, movement analysis, GPS ride data and results.
- Team activity: who logged in, who edited a record, and which staff member wrote which note.
Not all of this is equally sensitive. A horse's feed plan is low risk. An owner's home address, bank-related details and syndicate holdings are not. Horse records can also point back to a person: a vet note tied to a named owner is information about that owner's finances and decisions as well as about the horse.
The Office of the Australian Information Commissioner (OAIC) sets out how Australian organisations must handle personal information in the Australian Privacy Principles. They cover how information is collected, used, disclosed, kept accurate and secured, and how people can get access to it and correct it. Whether your yard is formally bound by them depends on its size and activities, so check with the OAIC or your adviser. Either way, they are a sound benchmark for any yard that holds owner details.
Collect less: the first privacy control
The cheapest way to protect information is not to hold it. NIST's guidance on data confidentiality recommends that organisations map their data flows and limit collection to what is necessary, alongside privacy-enhancing technologies. That's a US publication, but the logic applies to any yard.
In practice, ask of every field in your onboarding form: do we use this? If you never phone an owner's employer, don't collect it. If you only need a date of birth to verify an identity once, don't store it forever.
A short data map helps. List each type of information, where it enters (the owner, a vet, a staff member), where it's stored, who can see it and when you'll delete it. One page is enough. It also makes every later question, from a correction request to a breach response, much easier to answer.
Who should see what: permissions that match real yard roles
Most portal privacy failures are not hacks. They are over-broad access: a casual groom who can see every owner's invoices, or a syndicate member who can see another member's contribution.
The safest approach is to assign people to roles and give each role only the records it needs. Enterprise platforms work this way too: Microsoft's documentation explains that authenticated users are given web roles, with table permissions protecting records and page permissions protecting pages. The same principle, set up simply, works for a yard.
A workable starting set:
| Role | Should see | Should not see |
|---|---|---|
| Sole owner | Their own horse's records, updates, photos, their own invoices | Other owners' horses, contacts or invoices |
| Syndicate member | Their syndicate's horse and the syndicate-level finances they are entitled to | Other members' personal contact details, unless they agreed |
| Syndicate administrator | Member list and contributions for that syndicate | Other syndicates and yard-wide finances |
| Rider or groom | Care lists, feed plans, ride notes for horses they work with | Invoices, owner contact details beyond what the job needs |
| Stable manager | Operational records across the yard | Anything outside the yard's scope |
| Vet | Medical history and emergency details for horses they treat | Financial and unrelated owner data |
| Bookkeeper or admin | Finance and invoicing | Clinical notes, unless needed |
Two habits keep this working. First, review the list when someone's job changes or leaves. A departed groom with a live login is a classic gap. Second, decide what owners can see by default. Updates and photos are what owners want. Internal staff chat and cost breakdowns usually aren't.
For a deeper look at how documents reach owners, see our guide on owner document access for pro yards, and the portal features that cut owner calls.
Sharing with vets, staff and other third parties
A portal exists to share information, so the privacy question is about sharing sensibly, not about not sharing.
With vets, the aim is to make the right data available at the right moment. An emergency plan that holds the horse's identification, the owner's contact, the insurer and the treatment authority limits are worth far more in a crisis than a phone call to find them. Our piece on yards and vets and equine data privacy goes into how to set that up without exposing everything else.
With staff, give access by task. With owners, tell them at sign-up what you'll share with whom. If you plan to share information with a third party such as a feed supplier, insurer or transport company, tell the owner first and share only what that party needs. The Australian Privacy Principles deal with when personal information can be used or disclosed and what people must be told when it's collected, so an honest, short notice at onboarding is the right habit.
Watch for the quiet third parties as well: the cloud host, the email sender, the payment processor, the analytics tool. Each one handles your data on your behalf, and you should know who they are.
Security basics a portal should meet
Privacy and security are different things, but a portal can't offer one without the other. The OAIC's guide to securing personal information covers technical and organisational measures, physical security, and contractual measures where a provider handles information for you. Its updated version reflects changes that applied after 11 December 2024.
Translated for a yard, check these:
- Multi-factor authentication. Both the OAIC guide and NIST's guidance recommend it, because stolen or guessed passwords and social engineering are common routes in. Ask whether staff and owners can both use it.
- Encryption in transit and at rest. Ask the provider to say plainly whether data is encrypted when stored and when sent.
- Role-based access and an audit trail. You should be able to see who opened or changed a record.
- Backups and recovery. Ask how often data is backed up and how fast it can be restored.
- Offline use. If staff use a phone app in paddocks or at shows with poor reception, ask how data is protected on the device and what happens if a phone is lost. A screen lock and the ability to remove a user's access remotely matter here.
- Outsourced processing. When a provider uses sub-processors or outside developers, contractual measures matter. For a wider view of how to manage that risk, this overview of cybersecurity when outsourcing IT is useful background for anyone vetting a software supplier.
On the owner side, the simplest advice is the best: use a unique password, turn on MFA, and don't forward portal login emails. Put that in your welcome message.
Questions to ask before you choose a portal
Use this list in a demo or trial. A good provider will answer without fuss.
- What personal information does the portal collect, and can we switch off fields we don't need?
- Can we set different permissions for owners, syndicate members, staff and vets?
- Is multi-factor authentication available, and for whom?
- Where is the data stored, and who else processes it?
- Can we export all our data, and can we have it deleted when we leave?
- How are privacy requests and data breaches handled, and how quickly are we told?
- Is there a clear privacy policy written in plain English?
Treat vague answers as an answer. Under the OAIC guidance, you remain accountable for what a provider does with information on your behalf, which is why the contract and the answers above matter.
Retention, correction and deletion
Portals tend to keep everything forever, which sounds harmless until an owner leaves the yard and their details are still in the system years later.
Set a simple retention rule. Keep financial records for as long as your tax and accounting obligations require, and confirm the period with your accountant. Keep horse health records for as long as they serve the horse's care. Remove or anonymise owner contact details when there is no ongoing reason to hold them.
The Australian Privacy Principles also require organisations to take reasonable steps to keep personal information accurate, up to date and complete, and they give people access to and correction of their information. A good portal makes both easy: owners can see their own details, flag a mistake, and have it fixed. Give owners a named contact for that, and answer within a stated timeframe.
If information is wrong, misused or exposed
Have this ready before you need it:
- Wrong information: correct it, tell the owner, and check where else the same error has been copied, such as invoices or the emergency plan.
- Misuse by a staff member: remove access first, then investigate using the audit trail, then address it under your employment processes.
- Exposure: if you think personal information has been accessed or shared without permission, contain it (reset passwords, remove access, isolate the device), work out what was involved, and then seek advice on whether you have notification obligations. The OAIC website sets out the requirements for notifiable data breaches. Contact them or a privacy adviser if you aren't sure whether your yard is covered.
- Complaints: tell owners how to raise a privacy complaint with you. If it isn't resolved, they can go to the OAIC.
Write this as a half-page procedure, pin it where managers can find it, and test it once a year.
How we think about owner portal privacy
We built EquiBETS around one idea: a yard should not need to choose between keeping owners informed and keeping their information safe. Owners want real-time updates, and yards want fewer phone calls. Both are possible when the portal is designed around who needs to see what.
That's why we put owner portals, finance tracking, syndicate management and emergency plans in one connected workspace with role-based access, rather than spread across spreadsheets, group chats and email threads. Every extra copy of a vaccination certificate or an invoice is another place for information to leak. One workspace means one set of permissions to manage.
We also care about evidence-led design and data privacy, with clear, task-focused screens, so a busy yard manager at 6 am can see what a groom should see without guessing. Our advice is the same whatever you use: map your data, assign roles, switch on MFA, and ask your provider the hard questions. We're happy to be asked ours.
isaac
Try a portal that keeps it in one workspace
EquiBETS gives professional yards owner portals, finance tracking, syndicate management, emergency plans and team chat in one place, with a single plan that includes every module. EquiBETS Complete is A$9.99 per month and starts with a free trial, so you can test the permissions and owner view with your own team first. See the details on the EquiBETS pricing page, or start from the EquiBETS homepage.
If you're moving from spreadsheets, start small: set up one syndicate or a handful of owners, review what each role can see, and then roll it out yard-wide.
A 30-minute privacy check for your yard
You can do this today, before changing any software:
- List every place owner details are stored: spreadsheets, email, phones, paper files, apps.
- Mark which of them each staff member can reach.
- Remove access that's no longer needed, including former staff and old contractors.
- Turn on MFA for every system that supports it.
- Write one paragraph telling owners what you collect, why, and who sees it.
- Name the person owners contact for corrections and privacy questions.
- Save your breach steps where managers can find them.
None of this needs a lawyer or an IT department. It needs an hour and a decision about who is responsible.
FAQ
Is an owner portal safe for sharing financial details?
It can be, provided the portal uses role-based permissions, protects logins with multi-factor authentication and shows each owner only their own invoices. Ask the provider how data is stored and who else can access it. Syndicate administrators should also check that members can't see each other's personal contributions unless they have agreed to it.
What information should a yard collect from owners?
Collect what you need to care for the horse and bill for it: contact details, an emergency contact, the horse's identification and health records, and invoicing details. Leave out anything you wouldn't use. Holding less information means less to protect and less to correct later.
Do owners have a right to see and correct their information?
Under the Australian Privacy Principles, people can generally request access to personal information an organisation holds about them and ask for it to be corrected. Whether your yard is covered depends on its circumstances, so check with the OAIC or your adviser. Giving owners an easy way to review and fix their details is good practice regardless.
Can vets see everything in the portal?
They shouldn't. A vet needs the horse's medical history, identification and emergency contacts, not owner invoices or syndicate finances. Give vets a role limited to the horses they treat, and review it when the relationship ends.
What should I do if a staff member's phone with the app is lost?
Remove that user's access straight away, reset their password, and check the audit trail for activity you don't recognise. If personal information may have been accessed, follow your breach steps and seek advice on whether notification applies. A screen lock and MFA on every staff phone make this far less stressful.
Sources
- Australian Privacy Principles quick reference, OAIC
- Guide to securing personal information, OAIC
- Data Confidentiality, NIST SP 1800-29
- Power Pages security, Microsoft Learn
- Cybersecurity in IT outsourcing