MedBrief Records Retention and Archiving Policy

MedBrief has a multi-stage data lifecycle to ensure data is deleted from active use upon the Controller's request, while simultaneously safeguarding the information required for MedBrief's own legal and compliance obligations.

3.1. Stage 1: Deletion from Active Systems

After closure of a Matter, and upon receiving a verified and confirmed instruction from a Data Controller to delete Personal Data (e.g., at the end of a contract or for a specific erasure request), MedBrief will permanently delete the relevant Personal Data from its Active Systems within ten (10) business days of the expiry of a thirty (30) day cooling-off period, during which cooling-off period a Data Controller may cancel a deletion request.

Following this action, the data will no longer be visible or accessible to the Data Controller or its users via the client-facing application.

3.2. Stage 2: Deletion from Disaster Recovery (DR) Systems

MedBrief maintains DR systems to ensure service availability. These systems are, by design, not live. Following deletion from Active Systems, the same Personal Data will be permanently purged from all Disaster Recovery (DR) Systems within twenty (20) business days.

3.3. Stage 3: Retention in Secure Archives

MedBrief has a legitimate interest and, in some cases, a legal obligation (e.g., under the Limitation Act 1980) to retain a static, non-operational record of services performed. This is a limited and necessary processing activity for which MedBrief acts as a Data Controller, separate from its primary role as a Data Processor. Notwithstanding the provisions of this Policy relating to Stage 1 and 2 above, MedBrief reserves its right to retain longer term records of the information processed by it in the performance of its services, which may include Personal Data, financial records, correspondence, reports and other business documents.  Where MedBrief secures any such information in its archives, the provisions of this retention policy shall apply.

Justification: The purpose of this retention is strictly limited to:

• The establishment, exercise, or defence of potential legal claims.
• Compliance with our professional indemnity and insurance policies.
• Responding to audits or binding requests from regulatory bodies.
• Business continuity through preserving records of our past activities, transactions and communications as a necessary part of managing an enterprise and protecting and advancing our legitimate interests.

We apply safeguards, such as those described in UK GDPR Article 6(4)(e), including pseudonymisation where reasonably practicable and technically feasible, to protect data subject rights during this retention period.

Process:

1. Prior to transfer to Secure Archives, MedBrief will, where reasonably practicable, apply data minimisation techniques, including anonymisation or pseudonymisation, to the Personal Data.
2. Where pseudonymisation is applied, any additional information (attribution data) required to re-identify the data is stored separately and securely from the pseudonymised data, in accordance with UK GDPR Articles 4(5) and 32(1)(a).
3. A final, static copy of the data (which may be anonymised or pseudonymised) relating to the completed services is then transferred to our Secure Archives.

Retention Period: Personal Data stored within the Secure Archives (and any associated attribution data) will be permanently and securely deleted within six (6) years of the completion of the performance of the services provided to the Data Controller to which that Personal Data relates, unless a further retention or legal-hold obligation has commenced as a result of any other law. This retention period is based on the 6-year statutory limitation period for negligence or breach of contract claims, plus a one-year administrative period to ensure secure and orderly destruction.