Retention and deletion for the clinic | Privacy and security

There is no single lawful retention period that fits all clinics. You choose a profile yourself according to country, professional group, authorisation, treatment, data category and purpose, and you must be able to explain the choice. FlowDule does not set your professional or legal retention obligation.

This article is for you if you administer a clinic or a chain in FlowDule. The text your clients read is set out in Retention and rights.

Who is responsible for what

You are the data controller for your own clients, bookings, records, documents and professional purposes. You therefore decide:

why the information is processed;
which basis for processing is used;
which information is necessary;
how long it is to be retained;
how access, rectification, erasure and other rights are determined;
whether a legal obligation, a complaint, a dispute or another written ground requires continued retention.

FlowDule is the processor for that information. We make settings available, as well as export, restriction and deletion features, and we act on your written instructions, which are the chain’s own settings in the platform together with the Data Processing Agreement.

FlowDule is itself the data controller for its own contractual, invoicing, support and security purposes. The periods and rights for that processing are set out in the Privacy Policy.

Choose your professional profile

Profile	Who is covered	Starting point for retention
Self-employed psychotherapist, not an authorised healthcare professional	A psychotherapist who does not at the same time work under a relevant healthcare authorisation or other special rule	No automatic 5-year or 10-year health law period. The clinic determines a necessary and reasonable period based on the GDPR, the agreement, specific professional needs and any written requirements.
Authorised healthcare professional, 10-year group	Treatment sites with doctors, dentists, chiropractors, midwives, clinical dieticians, clinical dental technicians or dental hygienists	At least 10 years from the most recent entry under the applicable record keeping rules.
Other authorised healthcare professional	Other authorised healthcare professionals, including as a general rule authorised psychologists	At least 5 years from the most recent entry, unless a longer rule or a specific exception applies.
Multidisciplinary patient record	A record covering professions from both the 5-year and the 10-year group	At least 10 years for the multidisciplinary record under the applicable rules.
Separate clinic or country profile	A clinic subject to other sector, contractual, insurance, regulatory or national requirements	The special rule that applies following a legal assessment. The profile is not activated automatically.

The title “psychotherapist” does not in itself give a healthcare authorisation. In the same way, you must look at a psychologist’s actual authorisation status: transitional rules may mean that a person can use the title of psychologist until the end of 2028 without being covered by the new authorisation.

Membership of a professional association, insurance terms, contractual requirements or a professional recommendation may influence your choice, but must not be presented as law unless it is in fact a binding statutory requirement.

Are you a psychotherapist without authorisation

Then you must set a period or a clear deletion criterion yourself for each category you use. Your assessment should as a minimum cover:

why the record or the note is necessary;
for how long the information is relevant to a current or foreseeable client course of treatment;
the need to be able to show the agreement, the professional effort or a legal claim;
the sensitivity of the information and the consequence of long retention;
whether less intrusive documentation or earlier deletion is possible;
any written requirements from an agreement, insurance or professional association;
when the period begins, for example at a completed course of treatment or the most recent relevant note.

We do not recommend an arbitrary standard period instead of the assessment. You must be able to explain the period in your own privacy text and apply it consistently every time.

Are you an authorised healthcare professional

Then you use the minimum period under the applicable record keeping rules. The period normally runs from the most recent entry in the patient record.

A patient record that is relevant to an ongoing complaint, supervisory or compensation case must continue to be retained while the case is running, even if the ordinary minimum period has expired. Public treatment sites may in addition be subject to archiving rules.

The fact that a health law minimum period has expired does not mean that the record must be kept for longer. After that you must assess whether there is still a lawful and necessary basis. If there is not, the information must be deleted.

On cessation, transfer, death or bankruptcy, special rules on transfer and continued retention may apply. You must have your own cessation plan. FlowDule is neither an authority nor a professional successor and does not take over responsibility for the records.

Set periods per data category

Your retention profile, that is your choice of how long each type of information is kept, must as a minimum cover the following, if you use the category:

Data category	Possible starting point	Concluding action
Client master data and relationships	The end of the course of treatment or the most recent necessary activity	Deletion or a written restriction
Bookings, attendance and calendar	The date of the appointment, settlement or the completed course of treatment	Deletion or anonymisation according to the clinic’s purpose and any requirements
Record notes and version history	The most recent entry or the starting point of the professional rule	Deletion according to the profile; authorised records follow the rules on rectification and retention
Plans, measurements and reports	The most recent professional use or the starting point of the record	The same profile as the record material of which they are a necessary part
Attachments, images and audio	Collection, completed transcription or the most recent necessary use	Raw material is deleted earlier if it is no longer necessary
Communication and sharing	Sending, revocation or the completed course of treatment	Sharing is closed immediately once the need ceases; content follows its own category
Payment and order data	The transaction and the relevant accounting period	The clinic follows its own bookkeeping and accounting requirements
Access, audit and security logs	The event or the completed investigation	Automatic deletion once the security purpose is met; a specific case may give rise to a legal hold
Export and temporary processing files	Creation or completed transfer	Short automatic expiry and secure deletion

Rectification and the integrity of the record

Inaccurate master and contact details must be capable of being rectified. A rectification must not make it impossible to show relevant earlier actions, where the history is still necessary and lawful.

For patient records under the authorisation rules, you must not delete original record information or make it illegible as an ordinary rectification. Rectifications and additions must be traceable, so that the original version can still be found in accordance with the applicable requirements.

If you are a psychotherapist without authorisation, the need for version history depends on your own purpose and responsibility. FlowDule does not keep all historical versions permanently without reason.

When information is deleted

A deletion must reach all the places where the information exists:

active database records and version relationships;
files, attachments, images and audio;
bookings, communication, sharing and access links;
search indexes, queues, caches and temporary files;
input and output from AI in accordance with the approved configuration at the supplier;
export files and integration copies under FlowDule’s responsibility;
objects left behind without an owner, and deletion jobs that did not go through;
backups in accordance with the fixed rotation.

FlowDule keeps a small receipt for the deletion without the deleted content. The receipt may contain the customer, the instruction, the categories, the time, the responsible party, the outcome, the expiry of backups and any lawful exceptions.

Backups

Information may be technically inaccessible in rolling backups until the copies are overwritten. The database is backed up daily with 30 days’ rotation. During that period the copies are protected in the same way as production, they must not be used for other purposes, and they are not put back into normal operation.

If a backup is restored, previously completed deletions and applicable legal holds must be applied again before the environment is opened. The rotation period and the restore must have been tested. Internal targets for backup are not a guarantee to your clients unless it is expressly agreed.

Legal hold

A legal hold is a temporary, written block on ordinary deletion for a precisely delimited body of material. It may be relevant in the event of a specific complaint, a dispute, a regulatory case or another lawful obligation.

A legal hold must have:

a unique reference and a responsible party;
a basis that is written down;
a precise delimitation of person, case, object and data category;
a start date, a date for reassessment and a criterion for release;
the least possible access;
a traceable release and a new calculation of the normal period afterwards.

A hold on one record or one event must not automatically block all information about the person or the clinic’s entire data set.

Clients’ rights in practice

Subject to the conditions in the GDPR, a client may have the right to:

information about the processing;
access and a copy;
rectification;
erasure;
restriction of processing;
data portability;
object;
withdraw a consent, where the processing is based on consent;
not to be subject to certain decisions based solely on automated processing.

The rights are not absolute. A request for erasure may, for example, be limited by a statutory record retention period, a pending case, the rights of others or a necessary legal claim. You must be able to explain the specific limitation to the client and write the reasons down.

The client contacts you, not us. Your name and your contact details must appear in the privacy text the client meets on the booking and client pages. We do not answer your clients on your behalf without written instructions from you, but we help you with searching, export, rectification, restriction and deletion where necessary. If the request concerns FlowDule’s own account, support or agreement data, they can write to privacy@flowdule.com.

You answer a request without undue delay and normally no later than one month after you have received it. The period can be extended by up to two months if the request is complicated, or if you have many at once; the client must be told about the extension and the reasons for it before the first month has passed.

Be sure of who is asking, but do not ask for more than necessary. Record and health data must not be disclosed to the wrong person. You may collect copies of identity documents only where a less intrusive approach is not sufficient, and they must be deleted again quickly.

Export and termination

You can export your own data during the agreement and after termination in accordance with the Terms of Service and the Data Processing Agreement. The export must cover the relevant customer data, relationships, files, versions and audit metadata in documented, commonly used and machine-readable formats.

After the agreed export window, FlowDule deletes your data in accordance with your choice, the data processing agreement, the rotation of backups and any lawful exceptions. FlowDule’s own bookkeeping obligation for invoice and accounting data is not a reason to keep your client or record data.

What your own privacy text must state

Before, or at the latest when, you collect the information, the client must have a privacy text from you that at a minimum explains:

your identity and contact details;
the purposes, data categories and basis for processing;
relevant recipients, suppliers and transfers;
the specific retention period or clear criteria for it;
rights, the right to complain and how to make contact;
any use of AI and the human review, see AI in the clinic;
special rules on record rectification, if you are covered by them.

FlowDule’s own documents can support your text, but they do not replace it.

The rules behind this

Need help?

Under Support in the app you can open a ticket to the FlowDule team. You can also write to support@flowdule.com.