Data Retention Policy

Effective date: February 14, 2026

This policy defines default retention timelines and how automated retention jobs are executed.

Default Retention Matrix

Data Category	Retention Period	Notes
Medical file uploads	Up to 10 years (configurable)	Automatically reviewed and removed by retention jobs when period expires.
Deletion requests	Up to 5 years (configurable)	Retained for compliance and operational traceability.
Security audit logs	Long-term compliance retention	Immutable records used for access and incident forensics.
Operational account data	Until account deletion or legal requirement	Minimized/anonymized during approved deletion workflows.

Approved data deletion requests are processed under a target SLA of 30 days unless legal or regulatory obligations require additional retention.

Scheduled retention jobs enforce retention windows, process approved deletion requests, and generate auditable execution records.

Effective date: February 14, 2026

This policy defines default retention timelines and how automated retention jobs are executed.

Data Category	Retention Period	Notes
Medical file uploads	Up to 10 years (configurable)	Automatically reviewed and removed by retention jobs when period expires.
Deletion requests	Up to 5 years (configurable)	Retained for compliance and operational traceability.
Security audit logs	Long-term compliance retention	Immutable records used for access and incident forensics.
Operational account data	Until account deletion or legal requirement	Minimized/anonymized during approved deletion workflows.

Approved data deletion requests are processed under a target SLA of 30 days unless legal or regulatory obligations require additional retention.

Scheduled retention jobs enforce retention windows, process approved deletion requests, and generate auditable execution records.