Skip to content
Audience: DPO / Compliance

Data retention policy

What Heltio actually deletes once the retention period runs out, what it merely counts, and why the retention field governs less than its name suggests.

Last reviewed:

There is exactly one job in Heltio today that permanently deletes anything — and it concerns the audit log, not medical records. A second job, intended for patient data, is written but switched off, and in its first version only counts.

What really gets deleted

The audit log. A daily job walks practice by practice, reads the configured retention period and deletes older entries in batches of a thousand, so as not to lock the table. Three groups of entries are excluded from deletion regardless of the setting:

  • billing — invoices, KSeF, JPK, claims and settlements with insurers (Polish accounting and tax law),
  • financial — payments, refunds, payouts, wallet, licences, packages and subscriptions,
  • patient-rights related — data subject requests, deletion requests, consent records, acceptances of processing agreements, the practice's GDPR settings and the records of processing activities.

The period is set in Settings → GDPR & Privacy → Audit-log retention, in the Audit-log retention (years) field. The default is 20 years, and the permitted range is 6 to 99.

What is only counted

The job intended for patient data runs only when a system administrator explicitly enables it with an environment variable. Without that, it writes one line to the log at start-up and does nothing more. Even when enabled, in its current version it deletes and anonymises nothing — it counts candidates in four categories and records the numbers alone:

CategoryProposed periodBasis
Medical records20 years from the last entryArt. 29(1) of the Polish Patients' Rights Act
Inactive patients3 years with no visit, note or consent activityproposal
Marketing consents5 years after withdrawalArt. 7(1) GDPR read against the storage-limitation principle
Waiting list12 monthsproposal

Every candidate query skips patients under a retention lock and those with a restriction of processing under Article 18 — and reports those exclusions separately, so that the locks can be seen working before anything starts deleting.

The periods are not approved. Automatically deleting twenty years of medical records is irreversible, so the decision on the values belongs to the owner and to counsel, not to a setting in the panel.

Retention lock

The patient record has fields for the reason and the expiry date of a lock — for ongoing proceedings, an inspection or a claim. There is no screen today that lets you set them; they are read only by the reporting job described above. The previous version of this page pointed at a non-existent "Retention Locks" screen.

What this means in practice

The practice is the controller and it is the practice that carries the obligation under Article 5(1)(e) GDPR. Until automatic deletion is switched on, limiting the retention of records is an organisational procedure of the practice, not a feature of the app. Deleting a particular patient's data is done through an erasure request, which does work and removes the record together with its attachments.

Was this article helpful?