Data retention

Appointment and contact requests receive a deletion date when submitted. The final retention duration is not yet approved and must be configured from clinic and legal instructions before production use.

Expired requests must be removed through an audited operational process. Administrative audit records must not contain patient names, phone numbers, or clinical information.