Retention and deletion - Truephase Notes
Version 0.1 · 7 November 2026. This is the written rule the code follows. The Data Processing Agreement and the Privacy Notice point at it. If the code and this page ever disagree, one of them is wrong and is fixed the same week.
1. What is kept, and for how long
| Information | Kept for | Then |
|---|---|---|
| Saved note: the AI's written answers and the patient reference, both encrypted | 12 months from the day the form was filled (the clinic can shorten this to as little as 30 days) | Deleted automatically by the nightly job |
| Who filled it, which form, when, which AI model, whether it was recorded and when the patient agreed | Same as the saved note | Deleted with it |
| The conversation (typed, pasted or transcribed) | Not kept. Sent to the AI provider to draft the answers, then discarded by Truephase | - |
| Audio | Never kept by Truephase, the extension or the AI provider | - |
| Account log: who did what, when; never patient text | 6 years | Deleted; deleted earlier if the clinic is deleted |
| User accounts: name, email, mobile, HCPC number, clinic, role | Life of the account, then 30 days | Deleted |
| Clinic details and subscription status, Stripe reference numbers | Life of the clinic account | Deleted with the clinic |
| Record of which agreements were accepted (version, text fingerprint, time, IP address) | 6 years after the account ends | Deleted |
| Invoices and payment records | 6 years (tax law), held by Stripe and Truephase | Stripe's retention applies |
| On the physio's own computer: login token, display name, a recording in progress, practice patients' earlier conversations | Until sign-out, until put in the box or cleared, or until deleted from the extension's Settings page | Cleared by the extension |
| Encrypted database backups | 7 days, rolling | Overwritten; a deleted row can persist in a backup for up to 7 days |
2. The clinic can shorten the period
The clinic owner can set a shorter period for the whole clinic (30 days to 12 months) on the Truephase website, and can delete any single saved note at any time from Past notes. Physiotherapists can read saved notes but not delete them; the owner acts for the clinic as controller. Every deletion is written to the account log.
3. The nightly deletion job
Runs every night on Truephase's server. Deletes every saved note whose date has passed and writes one log entry per clinic saying how many were deleted, so the owner can see it happened. Truephase checks monthly that nothing older than the longest retention period remains. Deleted rows remain in encrypted backups for up to 7 days and are then gone.
4. Deleting a clinic
When a clinic ends its agreement, asks, or has stopped paying for 90 days after warnings: within 14 days Truephase offers a copy of the saved notes; within 30 days it deletes every saved note, every log entry, the subscription record, the users' accounts and the Stripe customer record, and confirms in writing on request. Kept: the record of which agreements were accepted (6 years) and invoices (6 years).
When one physiotherapist leaves, their login and personal details are removed; the saved notes they made stay with the clinic, because they are the clinic's clinical records, and are shown as made by "a former user".
5. A patient asks for their information to be deleted
Truephase cannot search its database for a patient's name or number, because the patient reference is encrypted before it reaches the database and Truephase does not read it. Only a signed-in member of the clinic sees the references, decrypted, on the Past notes page. So a patient's request needs the clinic's help:
- The request arrives at the clinic (the usual route) or at privacy@truephase.co.uk.
- If it arrives at Truephase, Truephase tells the patient within 2 working days that it holds information only on behalf of their clinic and has passed the request on, and tells the clinic owner the same day.
- The clinic, as controller, decides. The record in JellyPx has its own rules; Truephase's copy of the draft answers can almost always be deleted on request.
- The clinic owner signs in, opens Past notes, finds the saved notes for the patient and deletes them. Or the owner emails privacy@truephase.co.uk with the dates and patient reference, and Truephase deletes those rows within 5 working days and confirms in writing.
- The clinic confirms to the patient within one month of the original request.
What remains afterwards: a log entry saying a saved note was deleted on that date, by whom, with no patient text; and the same note in an encrypted backup for up to 7 days.
6. Copies and portability
A patient asking for a copy of what Truephase holds follows the same route: the clinic, signed in, can view the saved notes for that patient and give them to the patient in a readable form. Truephase helps within the timescales in the Data Processing Agreement.