Data Retention Policy

Account and clinic configuration data is retained while the account is active and for up to 24 months after closure for billing disputes, fraud prevention, and legal compliance, unless a longer period is required by law.

Patient records are retained under the clinic's control and instructions. Many jurisdictions require healthcare providers to retain medical records for fixed periods (often several years). Clinics must not rely on Careflow alone to determine statutory retention; follow local medical council and legal requirements.

Upon written request after subscription end, we will support export or deletion subject to technical feasibility, backup cycles, and legal holds.

WhatsApp message logs and delivery metadata may be retained for operational troubleshooting, audit, and dispute resolution, typically aligned with the clinic subscription lifecycle unless deleted earlier at clinic request where feasible.

Encrypted or access-controlled backups may retain data for a rolling window after deletion from primary systems. Backups are not used for active processing except recovery.

Security and application logs are retained for a limited operational period (commonly 30–180 days unless investigation requires longer).