Trust CenterJournal data
How we retain and delete journal data
There is no single lawful retention period for everyone. The treatment site chooses and documents its profile based on country, profession, authorisation, data category and purpose. Here you can read how FlowDule retains, restricts and deletes journal data, in language everyone can read.
Kept for as long as the documented profile requires
A journal may not always be deleted just because someone asks. If the treatment site is covered by the record-keeping duty, the journal must be preserved for a number of years. In return, it must not be kept longer than necessary: when the period has expired, the treatment site assesses whether another lawful basis still exists, and if there is none and no legal hold applies, the content is removed.
This page describes the principles for retention, erasure requests, legal holds and final deletion. It is an explanation practitioners can use as a starting point with their clients, but it does not replace the treatment site's own privacy information.
See retention of all data typesPrinciples
Four principles for journal data
Retention period, erasure requests, legal holds and final deletion.
- Retention period
The treatment site chooses and documents the period
There is no single lawful period for everyone. How long a journal must be kept depends on country, profession, authorisation, data category and purpose, and the clinic chooses and documents the profile. FlowDule does not determine the clinic's professional or legal retention duty. For authorised healthcare professionals, the starting point under the Danish record-keeping order (journalføringsbekendtgørelsen) is at least 10 years from the latest entry for some professional groups and at least 5 years for others. A self-employed psychotherapist who is not an authorised healthcare professional has no automatic 5- or 10-year period and must set a necessary and proportionate period themselves.
- Deletion
Erasure requests get a two-part answer
Information with no continuing basis is deleted according to its lifecycle. A journal required by law is restricted: ordinary broad access, analytics, product improvement and unnecessary sharing stop. Documented persons may still use it for necessary treatment and patient safety, rights requests or a specific complaint, supervisory or liability case, and every look-up is logged.
- Legal hold
Legal hold during pending cases
If a journal is part of a complaint, supervisory or liability case, the necessary, documented scope is preserved until the case is closed. The data subject is only informed where this is lawful and does not prejudice the purpose of the case or of an order from an authority. The decision is reassessed each time the legal hold is reviewed.
- Expiry
Deletion when the period expires
When the period has expired and the treatment site has assessed that there is neither another lawful basis nor a legal hold, the content is removed: notes, measurements, treatment plans, reports, attached documents and audio recordings. Deletion also covers files, shares, search indexes, queues and caches, while backups are phased out through documented rotation. What remains is a skeleton of timestamps, author and codes with no personally identifiable content.
The journal's path
From record-keeping to deletion
Choose a situation and see which steps the journal goes through.
-
The journal is preserved
For the period set by the treatment site's documented profile.
-
Access is restricted
Broad access, analytics and unnecessary sharing stop. Every look-up is logged.
-
Legal hold
The necessary scope is preserved until the case is closed.
-
The content is removed
When the period has expired and there is neither another lawful basis nor a legal hold.
-
The skeleton remains
Timestamps, author and codes with no personally identifiable content.
Rights
Corrections are made as addenda, and look-ups are logged
If something in a journal is wrong, it is corrected with a new addendum stating what is right. In patient records under the authorisation rules, the original text remains, because corrections and addenda must be traceable so that the original version can still be identified. If the treatment site is not covered by those rules, the need for version history depends on the site's own documented purpose and responsibility.
Data subjects can ask for access, rectification, restriction and erasure, but these rights are not absolute and may be limited by a statutory journal retention period, a pending case, the rights of others or a necessary legal claim. You can find out who has viewed the journal. Look-ups are recorded in an access log. Complaints can be made to the Danish Data Protection Agency (Datatilsynet).
See GDPR and policiesResponsibility
The treatment site is the data controller. FlowDule is the data processor.
Each clinic or chain is the data controller for its journals and determines purpose, access and retention period. FlowDule provides and operates the journal system as data processor under a data processing agreement and only processes data on documented instructions. Journal data is encrypted and stored separately per chain.
Read about retention and rightsQuestions?
Need documentation or answers?
Contact us if you need a data processing agreement, further documentation or answers to questions about retention and deletion.
Write to privacy@flowdule.comSee it for yourself.
Create a free account and try FlowDule for 30 days. No credit card, no commitment.