There is exactly one job in Heltio today that permanently deletes anything — and it concerns the audit log, not medical records. A second job, intended for patient data, is written but switched off, and in its first version only counts.
What really gets deleted
The audit log. A daily job walks practice by practice, reads the configured retention period and deletes older entries in batches of a thousand, so as not to lock the table. Three groups of entries are excluded from deletion regardless of the setting:
- billing — invoices, KSeF, JPK, claims and settlements with insurers (Polish accounting and tax law),
- financial — payments, refunds, payouts, wallet, licences, packages and subscriptions,
- patient-rights related — data subject requests, deletion requests, consent records, acceptances of processing agreements, the practice's GDPR settings and the records of processing activities.
The period is set in Settings → GDPR & Privacy → Audit-log retention, in the Audit-log retention (years) field. The default is 20 years, and the permitted range is 6 to 99.
What is only counted
The job intended for patient data runs only when a system administrator explicitly enables it with an environment variable. Without that, it writes one line to the log at start-up and does nothing more. Even when enabled, in its current version it deletes and anonymises nothing — it counts candidates in four categories and records the numbers alone:
| Category | Proposed period | Basis |
|---|---|---|
| Medical records | 20 years from the last entry | Art. 29(1) of the Polish Patients' Rights Act |
| Inactive patients | 3 years with no visit, note or consent activity | proposal |
| Marketing consents | 5 years after withdrawal | Art. 7(1) GDPR read against the storage-limitation principle |
| Waiting list | 12 months | proposal |
Every candidate query skips patients under a retention lock and those with a restriction of processing under Article 18 — and reports those exclusions separately, so that the locks can be seen working before anything starts deleting.
The periods are not approved. Automatically deleting twenty years of medical records is irreversible, so the decision on the values belongs to the owner and to counsel, not to a setting in the panel.
Retention lock
The patient record has fields for the reason and the expiry date of a lock — for ongoing proceedings, an inspection or a claim. There is no screen today that lets you set them; they are read only by the reporting job described above. The previous version of this page pointed at a non-existent "Retention Locks" screen.
What this means in practice
The practice is the controller and it is the practice that carries the obligation under Article 5(1)(e) GDPR. Until automatic deletion is switched on, limiting the retention of records is an organisational procedure of the practice, not a feature of the app. Deleting a particular patient's data is done through an erasure request, which does work and removes the record together with its attachments.
Related
- Data subject rights — the only working route to deletion today.
- How the audit log works — what remains once the rest is deleted.
- GDPR at Heltio — the division of responsibility.