Retention and Deletion Policy
Effective date: September 27, 2026
The Practice controls retention of its clinical record. CareCircle supplies storage and assists with export and deletion on lawful instructions. Closing a client account or ending a beta does not automatically permit destruction of a clinical record. A Practice must identify its province, profession, college, patient age, and any litigation hold before setting a final destruction date.
| Record type | Retention rule during beta | Who decides or acts |
|---|---|---|
| Clinical records, intake, notes, attachments, clinically relevant messages, and call records if any | Keep for the longest applicable professional college, provincial health-record, or legal-hold period. The period varies by profession and province, and may be longer for minors. No single national number is promised. | Practice determines the period and authorizes export or deletion; CareCircle carries out the instruction. |
| Appointment and care-coordination history that forms part of the clinical record | Same period as the clinical record. | Practice. |
| Invoices, receipts, and tax-supporting transaction records | Generally six years from the end of the last tax year to which they relate, or longer if another law, audit, dispute, or hold applies. | Practice for its invoices; CareCircle for its own accounting records. |
| Client account, sign-in, and app content (journals, habits, health logs, AI conversations, personal notes, notifications, messages with other clients) | While the account is active. A client can delete their account in Settings; it is deleted 30 days after the request unless cancelled. If a Practice holds a record for the client, the account row is reduced to the name the record shows. | CareCircle. |
| Professional and Practice account data | While the account is active, then only as needed for export, security, disputes, or legal obligations; request manual review at closure. | CareCircle for platform account data; Practice for any copy forming its record. |
| Client data exports | Deleted 7 days after they are prepared. | CareCircle (daily purge). |
| Security logs and support correspondence | Expired sign-in sessions, verification links, rate-limit and one-time-code records, and integration credentials are purged daily. Audit logs and security events are kept only as needed for security, investigation, and legal obligations; a fixed purge schedule for them is not yet set. | CareCircle. |
| Backups and processor copies | Follow documented backup and processor expiry schedules after a verified deletion. Exact schedules have not yet been confirmed for every provider. | CareCircle coordinates and confirms with processors. |
Clients export their data and delete their account themselves in Settings → Your data (see Data Safety); a client deletion never removes the Practice's clinical record. Professionals and Practices still ask manually through Data Safety. CareCircle will verify identity and Practice authority, identify legal holds and required records, prepare a usable export or secure transfer, confirm receipt where applicable, and then delete eligible copies and document any exception. We will explain the expected completion date and later confirm what was deleted, what remains, and why. Deleting a clinical record at a Practice's instruction remains a manual, documented step. CareCircle will not promise immediate deletion of backups or a Practice's independent records.
The six-year financial-record baseline reflects Canada Revenue Agency guidance. A Practice should apply the current rule of its own college before selecting a clinical-record destruction date.