# Data retention and deletion policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.
This draft is not legal advice; each clinic decides retention for its own records.

## Retention

| Data | Kept | Decided by |
|---|---|---|
| Visit audio | `retention_days_audio` per clinic (default 30 days) | The clinic |
| Transcripts | `retention_days_transcript` per clinic (default 365 days) | The clinic |
| Signed notes and clinical records | As long as the clinic must keep its records | The clinic |
| Exports | 7 days, then deleted | Veteros |
| Audit history | For the life of the organization | Veteros |
| Billing records | As required by law | Veteros |

## Deletion

- The retention job deletes every stored object whose `delete_after` has passed and records
  `stored_object.deleted` without the content (`apps/v2/src/server/jobs/retention.ts`).
- Deletion requests for a client or a staff member, and organization offboarding after a 30-day
  grace period, are handled by the privacy tools (Phase 8 Part A). They remove or irreversibly
  redact personal data and keep only what the law requires, with the reason recorded.
- History tables stay append-only; personal data in them is removed only through the sanctioned,
  audited redaction path.

## Evidence

Retention settings per clinic, retention job audit events, completed deletion requests.