Personal Data Retention and Protection Policy
Last updated: September 2026.
This document supplements the Privacy Policy and describes the specific retention periods for different categories of data and the technical measures that protect them.
1. Retention periods
| Data | Retention period |
|---|---|
| User (specialist) account | For as long as the account is active. If deleted at the user’s request — erased within [N] days, unless applicable law requires otherwise (for example, for accounting/tax purposes for services rendered). |
| Patients’ medical data (images, markup, reports) | Stored in encrypted form until the user deletes it or a confirmed erasure request is received from the patient / their representative through the responsible specialist. |
| Backups | Backups are rotated no later than every [30] days, after which the older copy is overwritten by a newer one. |
| Sessions (sign-in cookies/tokens) | Valid for up to 8 hours from sign-in or until explicit sign-out / account deactivation. |
| Server security logs (sign-in attempts, errors) | Up to [90] days, then deleted automatically. |
| Support chat correspondence | Stored together with the user’s account and deleted together with it. |
| Invitation codes (used) | The history of used codes is kept to audit the issuing of access until the administrator explicitly deletes it. |
2. How erasure requests are handled
A data subject (the user or, through their treating specialist, the patient) may request the erasure of their data. We fulfil such requests:
- for users in the Russian Federation — within the period set by Art. 20–21 of 152-FZ (as a rule, up to 30 days, extendable by a further 30 days with a reasoned notice);
- for users in the EU — “without undue delay”, as a rule within one month (Art. 12(3) GDPR), extendable by a further two months for complex requests;
- for California residents — within the period set by the CCPA/CPRA (as a rule, 45 days, with a possible extension).
Requests are accepted through the support chat in the personal account or by email [operator contact email].
3. Technical and organisational protection measures
- Encryption at rest. Each user’s images, markup and medical metadata are encrypted with their own key (DEK), which in turn is wrapped by the server’s root key. Without the root key (stored separately from the database) decryption is impossible.
- Encryption in transit. In production the connection to the server must use HTTPS.
- Access separation. Regular user and administrator sessions are physically separated (different cookies and session stores); each user sees and can change only their own data — access to other users’ data is available only to the administrator through a separate protected panel.
- Hashing of secrets. Passwords and recovery backup codes are stored only as irreversible bcrypt hashes.
- Brute-force protection. Progressive delay and a limit on sign-in / password reset attempts per IP address and per username.
- Logging of sensitive administrator actions (export of a user’s data, viewing of correspondence) — so that access can be audited.
- Immediate access blocking — when an administrator deactivates an account, all of the user’s active sessions are ended at once, not only when they would normally expire.
4. Storage location and cross-border transfer
Actual location of the servers: [state the country/region of the data centre]. For users from the Russian Federation, the requirement to localise the database of personal data of Russian citizens within the Russian Federation applies (242-FZ) — [the operator confirms compliance or states the basis for an exemption]. If data is transferred outside the country where it was collected (for example, from the EU to a third country without a European Commission adequacy decision), the transfer is made on the basis of [standard contractual clauses (SCC) / another mechanism provided for by the GDPR].
This is a standard template. The specific periods (marked as [placeholders]) and the grounds for cross-border transfer must be fixed by the Service operator taking into account its jurisdiction, its contracts with users and the requirements of applicable law, with the help of a lawyer where necessary.