Data Retention & Deletion Policy

1. Retention Philosophy

DocVerb is designed with data minimisation principles. We collect only what is necessary to provide the Service, retain it only as long as needed for the stated purpose or legal obligation, and delete it securely when that period ends. We do not retain data "just in case" or for speculative future use.

As a Data Processor, we act on your instructions as the Data Controller. Our retention schedules reflect your clinical documentation workflows, applicable tax and regulatory requirements, and the principle that the treating healthcare provider remains responsible for clinical decisions. DocVerb assists with documentation and workflow—data ownership and clinical accountability remain with you.

Clinical documentation is protected using encryption at rest (AES-256) and in transit (TLS 1.3) throughout its lifecycle.

2. UID Architecture — De-Identified Data Model

DocVerb's retention policy applies exclusively to de-identified, UID-linked clinical records (SOAP notes and prescriptions). No patient-identifying information is ever stored on our servers.

The UID (Unique Identifier) architecture ensures that clinical documentation remains cryptographically unlinkable to real-world identities:

• Zero PII Storage: Only SOAP notes and prescriptions are persisted. No names, phone numbers, Aadhaar, ABHA IDs, or demographic identifiers are ever uploaded or stored.
• Ephemeral Screen Display: During the consultation, patient name and details appear on the doctor's screen once for clinical context—but this data is never transmitted, logged, or persisted to any backend system.
• UID Anonymity: The UID is a random, opaque token generated per encounter. It has no mathematical or structural link to any human identity. On the server, the UID is anonymous—it cannot be reverse-resolved to a person.
• External Correlation Only: A UID can only be associated with a real patient if the doctor (or practice) voluntarily shares the UID-to-patient mapping from their own records (e.g., their EMR, paper logs, or memory). DocVerb has no access to this mapping.
• Dual-Key Access Control: Clinical records are encrypted such that decryption requires both the Doctor ID and the Patient ID (as known by the doctor's practice). Without both keys matching, the encrypted payload is mathematically inaccessible—even to DocVerb infrastructure.
• Four-Factor Identification: The only way to identify a specific clinical record is the conjunction of: Doctor ID + Patient ID + UID + Timestamp. All four must be present simultaneously. Any subset (e.g., UID alone, or Doctor ID + UID) is insufficient.

This architecture means retention schedules in this policy govern only the encrypted, de-identified SOAP/prescription blobs—not patient identities, because those identities never enter our systems in the first place.

3. Retention Schedule

The table below summarizes retention periods by data category. Periods begin from the event triggering retention (e.g., processing completion, subscription termination, fiscal year-end).

Data Category	Retention Period	Trigger Event	Legal/Operational Basis
Audio Recordings Doctor-patient consultation audio	≤ 24 hours post-processing	Processing completion	Data minimisation; transient processing only. No long-term storage.
Clinical Documentation SOAP notes, prescriptions, summaries, follow-ups, structured outputs	During active subscription + 30 days export window	Subscription end or user deletion request	Service provision; 30-day window for export before deletion per your instructions.
Account Information Name, email, practice name, credentials, authentication data	Active subscription + 2 years post-termination	Account closure	Contract performance, fraud prevention, dispute resolution, DPDP/GDPR erasure request handling.
Billing & Payment Records Invoices, receipts, transaction logs, tax documents	8 years	Fiscal year-end	Indian Income Tax Act (Section 44AA), GST law, Companies Act audit requirements.
Access & Error Logs Authentication logs, API access, error traces, security events	12 months	Log generation	Security monitoring, incident investigation, abuse detection, DPDP breach notification obligations.
Anonymized Analytics Aggregated usage metrics, feature adoption, performance trends (no personal identifiers)	Indefinite	Anonymization completion	Non-personal data; product improvement, capacity planning. Not linked to individuals.
Backup Snapshots Encrypted database/file backups for disaster recovery	30-day rolling	Backup creation	Disaster recovery RPO/RTO. Encrypted; inaccessible to production systems.

3. Deletion Methods

We employ deletion methods appropriate to the storage medium and data sensitivity:

• Automated Secure Deletion (Primary): Application-level deletion jobs execute on schedule. For database records: hard delete (row removal) followed by vacuum/compaction. For object storage: versioned object deletion with expiration policies. All deletions are logged with timestamp, data category, and execution status.
• Cryptographic Erasure (Encrypted Volumes): For data stored on encrypted volumes (AES-256), deletion is achieved by destroying the Data Encryption Key (DEK). The encrypted ciphertext becomes mathematically unrecoverable. This method is used for backup snapshots and archival stores where immediate physical overwrite is impractical.
• Physical Media Sanitization: For any decommissioned hardware, we follow NIST SP 800-88 Rev. 1 (Clear/Purge) via cloud provider processes. We do not manage physical media directly; cloud providers execute sanitization per their certifications.

Deletion is irreversible. Once executed, data cannot be recovered by DocVerb, subprocessors, or cloud providers.

4. User-Initiated Deletion

4.1 Account Deletion

You may request full account deletion at any time by emailing docverb.no.reply@gmail.com with the subject "Account Deletion Request". We will:

1. Verify the request originates from the account owner (email confirmation + 2FA if enabled).
2. Initiate deletion per the retention schedule above: Clinical Documentation enters the 30-day export window; Account Information and logs follow their respective schedules; Audio is already deleted within 24 hours.
3. Send confirmation upon completion of each category.

Exception: Billing records (8 years) and any data subject to a legal hold (see Section 5) are retained per legal obligation regardless of deletion request.

4.2 Export Before Deletion

Before Clinical Documentation is deleted, you have a 30-day export window to download all your data in machine-readable formats (JSON, PDF). Export is available via:

• In-app "Export Data" button (Settings → Data → Export)
• API endpoint for programmatic bulk export
• Manual request to support for assisted export

We strongly recommend exporting before initiating account deletion. Once the 30-day window expires, Clinical Documentation is permanently deleted and cannot be recovered.

5. Legal Holds

When DocVerb receives valid legal process (court order, regulatory directive, government notice) or reasonably anticipates litigation, we impose a Legal Hold on the specified data categories:

• Scope: Only data identified in the legal process or reasonably related. We do not blanket-hold all data.
• Duration: Until the hold is formally lifted in writing by the issuing authority or our legal counsel confirms it is no longer required.
• Effect: Scheduled deletion is suspended for held data. Access is restricted to authorized personnel. Audit logs record all access during hold.
• Notification: We notify the affected Data Controller (you) unless legally prohibited (e.g., gag order). If prohibited, we document the restriction and notify once lifted.
• Post-Hold: Upon lift, held data resumes its normal retention schedule from the hold imposition date (i.e., the clock does not reset).

6. Backup Retention

Backups are a separate retention tier for disaster recovery only:

• Frequency: Daily incremental, weekly full snapshots.
• Retention: 30-day rolling window. Backups older than 30 days are automatically expired and cryptographically erased (DEK destruction).
• Encryption: All backups encrypted at rest with dedicated keys (AES-256). Keys managed via cloud KMS with automatic rotation.
• Access: Backups are logically air-gapped—cannot be mounted or queried by production systems. Restoration requires manual approval from two authorized engineers.
• Exclusion from User Deletion: When you request account deletion, production data is deleted per schedule. Backup snapshots containing your data age out naturally within 30 days. We do not perform selective backup mutation (which would compromise integrity).

7. Cross-Border Considerations

Primary processing occurs in India (Mumbai/Bangalore cloud regions).

• Data Residency: Clinical Documentation, Account Information, and Audio remain in-region throughout processing and retention.
• Subprocessor Transfers: If any subprocessor operates outside India (e.g., global monitoring, specialized GPU), we ensure adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms per DPDP Act Section 16 and GDPR Chapter V.
• Backup Geography: Backups stored in the same region as primary data. No cross-region replication for backup tier.
• Legal Requests: Foreign legal requests are evaluated per the Mutual Legal Assistance Treaty (MLAT) process. We do not voluntarily disclose to foreign authorities without valid Indian legal process.

8. Verification & Deletion Certificates

We provide verification of deletion upon request:

• Deletion Certificates: On written request to docverb.no.reply@gmail.com, we issue a certificate confirming: data categories deleted, date/time of deletion, method used (secure delete / cryptographic erasure), and responsible engineer. Certificates are issued within 15 business days.
• Audit Logs: Deletion executions are recorded in immutable audit logs (write-once storage) with cryptographic hashing. Available for regulatory audit.
• No Third-Party Attestation: We do not engage external auditors solely for deletion certification. Certificates are self-attested by DocVerb engineering leadership. If you require independent attestation, we can coordinate with your auditor under NDA.

9. What We're Improving

We acknowledge gaps and are actively working on:

• Granular Retention Controls: Per-practice retention policies (currently uniform). Target: Q1 2026.
• Automated Deletion Reporting: Monthly deletion summary dashboards for admins. Target: Q4 2025.
• Selective Backup Exclusion: Technical investigation into backup architectures that support per-tenant exclusion without compromising recovery integrity. Target: Research phase.
• Deletion API: Programmatic deletion triggers for enterprise integrations. Target: Q2 2026.
• Third-Party Attestation: Engaging a Big Four firm for annual deletion process review. Target: 2026 fiscal year.

10. Related Policies

• Privacy Policy — Data collection, processing, and rights
• DPDP Compliance — Digital Personal Data Protection Act mapping
• Security — Technical and organizational measures
• Terms of Service — Contractual framework, DPA terms
• HIPAA Compliance — U.S. healthcare applicability (if relevant)
• Cookie Policy — Tracking technologies

11. Contact

Questions about this policy, deletion requests, or deletion certificates:

docverb.no.reply@gmail.com

Subject line: "Data Retention - [Your Practice Name]"