Try for free

Trust CenterData retention

How long do we keep data?

There is no single lawful retention period for all FlowDule customers. This page sets out who sets the period for each data type, what the system supports, and what applies to the data where legislation determines the length.

Concrete time limits, not loose intentions

Some retention periods follow your own documented profile, which you choose based on country, profession, authorisation, treatment, data category and purpose. Others are determined by legislation and by how long the customer relationship lasts. This page clearly distinguishes between the two, so you know what rests on your assessment and what follows from a duty.

Journal data follows its own rules, because a statutory journal retention period can limit the right to erasure. We describe those in detail on a separate page.

See journal data retention

The retention profile

Each data type has its own period

Some periods are fixed. Others follow the purpose or your own documented profile.

  • Recognised text from an image that is not linked to a noteFixed period

    7 days

  • Personal data in AI processing dataFixed period

    90 days

  • Technical error logsFixed period

    90 days

  • AlertsFixed period

    180 days

  • Significant incident casesFixed period

    Normally 5 years after closure

  • Accounting recordsFixed period

    5 years from the end of the financial year

  • Unconfirmed image uploadsBy purpose

    Short automatic expiry

  • Journal look-up logBy purpose

    According to the control and security purpose

  • Other usage metering dataBy purpose

    When the purpose and any limitation period for claims have expired

  • Journal dataYour profile

    For authorised professionals at least 5 or 10 years from the latest entry

  • Bookings, message history and audit trailsYour profile

    Your documented retention profile

The time axis is logarithmic, so short and long periods can sit side by side. A dotted line means the period is not a fixed number of days. A legal hold can temporarily block deletion.

Retention schedule

Time limits and who sets them

Data types that are deleted or anonymised when the period expires. A legal hold can temporarily block deletion, and information may remain in rolling backups until the copies are overwritten according to the documented rotation.

  • Your documented profile

    Journal data

    There is no single lawful retention period for all FlowDule customers. You choose a documented profile based on country, profession, authorisation, treatment, data category and purpose. For authorised healthcare professionals in the 10-year group, the starting point is at least 10 years from the latest entry, and for other authorised professionals at least 5 years. A self-employed psychotherapist without relevant authorisation has no automatic 5- or 10-year period and sets a necessary and proportionate period themselves. FlowDule does not determine your professional or legal retention duty.

  • After 90 days

    AI processing data

    Prompt and result from formatting, summary, dictation and text from images are stored encrypted so the practitioner can review the result, and the personal data in them is removed automatically after 90 days. Recognised text from an image that is not linked to a note is deleted after 7 days. What the practitioner saves in the journal follows the chain's retention rules, and your client and journal data are not used to train AI models.

  • According to the control purpose

    Journal look-up log

    The log of who has viewed a journal has a documented retention period and is deleted automatically according to the control and security purpose. A specific case can be placed under legal hold. The log is the basis for being able to tell a data subject who has had access.

  • According to the billing purpose

    Usage data

    Metering data for usage of SMS and AI is used for billing and to show current usage in the subscription. If data forms part of accounting records, it is kept for 5 years from the end of the financial year; other metering data is deleted when the purpose and any limitation period for claims have expired.

  • 90 and 180 days

    Technical error logs

    Error logs are kept for 90 days and alerts for 180 days. They are used to find and fix errors in the platform and to protect people, customers and the service. Significant incident cases are normally kept for 5 years after closure.

  • Short automatic expiry

    Unconfirmed image uploads

    An image that is uploaded but never used is a temporary processing file with a short automatic expiry and secure deletion. So no stray files are left waiting without a purpose.

Erasure requests

Each data category is assessed. A journal required by law is restricted.

You are the data controller and decide on the request; FlowDule provides export, restriction and deletion functions and acts on your documented instructions. Information with no continuing lawful basis is deleted according to its lifecycle.

A journal required by law is restricted instead: ordinary broad access, secondary purposes and unnecessary sharing stop, while documented persons may still use the material for necessary lawful purposes. Every look-up is logged, and the content is removed when the period and any legal hold expire. After that, the information may be technically inaccessible in rolling backups until the copies are overwritten according to the documented rotation.

See journal data retention

Other operational data

Bookings, invoices, message history and audit trails

Bookings, message history and audit trails are your data and follow your documented retention profile and the data processing agreement. FlowDule's own contract and billing data is kept for as long as the customer relationship lasts, and after that according to applicable law: accounting records for 5 years from the end of the financial year.

FlowDule's bookkeeping obligation is not a basis for keeping your client or journal data. We do not promise a fixed automatic deletion here, because the right period depends on what the individual data documents.

Documentation and agreements

Missing a time limit that is not listed here?

Write to us if you need documentation for a particular data type or clarification for your own record of processing activities.

Contact us