Records Retention and Deletion Policy

Last Updated: 6 October 2026. See the Changelog at the bottom. Retention periods here match DPA.md §4, which is the contractual source if the two ever differ.

Purpose

This policy sets out how long records in AssuraFlow are kept and how they are deleted. It covers the care and governance records care providers keep in AssuraFlow, and AssuraFlow's own operational records.

Principles

• Keep records for as long as the law, the care provider's own schedule or a security need requires, and no longer.
• The care provider decides how long its records are kept. AssuraFlow keeps them for the provider during the contract and returns or deletes them when it ends.
• Delete or anonymise records when they are no longer needed and not under a legal, contractual or security hold.
• Never let a deletion reach another provider's data.

Care Providers' Records

Who decides

Each care provider is the controller of the records it keeps in AssuraFlow and sets its own retention schedule. AssuraFlow does not delete care or governance records automatically by age.

Retention review in the service

• The NI or an Organisation Admin sets how many years after discharge a service user's records are listed for review, separately for adult, domiciliary and children's services (Organisation → Settings). Until they do, adult and domiciliary care use 8 years; children's services have no default, because children's case records are kept to the 75th birthday and the service doesn't hold dates of birth.
• Person Profile lists discharged people past that period. For each, a Manager or the NI can keep the records until a date, with a reason (for example an open complaint, a safeguarding enquiry or a legal hold); they aren't listed again before that date. Only the NI can delete them.
• Deleting a service user removes them, every record about them and their uploaded files in one step. It needs a reason and the person's reference typed to confirm, is refused while a hold is in place or the organisation is in inspection mode, and is recorded in the audit trail with the reason.
• Before deleting, records that anyone must keep can be exported in full from the person's profile.

Reference periods

These are the periods a provider's schedule usually needs to take into account. They are for guidance, not legal advice. Rules differ between England, Wales, Scotland and Northern Ireland, and between regulated services, so providers should check the rules that apply to them.

Body maps, documents and other files

Files attached to a record (body maps, care-plan documents, receipts, evidence) follow the retention of the record they are attached to.

At the end of the contract

• Before the contract ends, the provider exports the records it must keep. Records with long statutory periods, such as children's case records, must be kept by the provider after it leaves AssuraFlow; AssuraFlow does not keep them on its behalf.
• Within 60 days of the end of the contract, AssuraFlow deletes the provider's records, files and user accounts from live systems. Copies in backups expire with the normal backup cycle (see docs/ops/BACKUP-AND-RECOVERY-POLICY.md).
• If the law requires AssuraFlow itself to keep something, it is kept only for that purpose and period.
• Audit trail entries are kept. The audit trail is the governance history: evidence of what was done, who opened which records, and what was decided. It is append-only and is never deleted, including when a provider leaves. Each entry holds user and record ids and a short description of the action, not the record's content. A departing provider's entries are visible to no one but the platform operator.
• AssuraFlow confirms deletion to the provider in writing.

AssuraFlow's Own Records

Data Subject Requests

• Requests about records held for a care provider (for example, a service user asking for their records to be deleted) are passed to that provider, which decides. Care records usually cannot be deleted on request while the law requires the provider to keep them.
• Requests about AssuraFlow's own records are handled by AssuraFlow.

Customer-Initiated Deletion

A provider may ask AssuraFlow in writing to delete records earlier than the end of the contract, through an authorised contact. The request is checked against the provider's own retention duties before it is carried out.

Deletion Windows

Deletion covers the primary database and file storage, and backups and replicated copies as they expire within the normal backup cycle.

Legal or Security Holds

If records are subject to an active incident, dispute, investigation, safeguarding enquiry or legal hold, deletion is deferred until the hold is released.

Tenant Isolation During Deletion

Deletion workflows must preserve tenant boundaries and must not affect data belonging to other providers.

Review

This policy should be reviewed alongside the information security policy, incident response plan, DPIA and customer contractual terms whenever retention practice or the law changes, and at least once a year.

---

Changelog