# Patient Data Retention, Export and Deletion Rules

The application deliberately archives operational patient records rather than destructively deleting records that have appointment, queue, billing or audit history. Exact retention periods and legal deletion obligations must be configured by the clinic for every jurisdiction where production patient data is handled.

## Application behavior

- Patient records are archived with `archived_at`; appointment and transaction history is preserved.
- Patient demographic edits, token changes, appointment workflow changes, payments/refunds, assignments and settings changes are audited.
- Passwords, bearer tokens, provider credentials and other secrets are redacted or excluded from audit payloads.
- Patient visit counts and last-visit timestamps are derived from completed appointments.
- Sensitive attachments, if introduced, must use private object storage rather than public URLs.

## Before production launch

The clinic/data controller must define and approve:

1. retention periods for patient demographics, appointments, financial records, notification logs and audit logs;
2. the lawful process for data-subject export/access requests;
3. when data may be erased versus when legal/accounting records must be retained;
4. how retained records are anonymized when erasure is legally required but relational history must remain;
5. backup retention and deletion propagation timing;
6. staff roles allowed to access operational notes, clinical-warning fields and exports;
7. incident response and breach-notification procedures.

Do not implement blanket hard-delete endpoints for production patient history without a jurisdiction-specific legal policy and a reviewed anonymization/deletion workflow.