Data Retention and Deletion Policy
How long HealthNaro keeps each kind of personal data, what happens at the end of the period, how deletion requests are handled, and the legal holds that can pause deletion.
Responsable de la page : HealthNaro
Owner: HealthNaro Contact: info@healthnaro.com
Principle
We keep personal data only as long as it is needed for the purpose it was collected for, then we delete or anonymise it. This is required by section 39 of the Kenya Data Protection Act, 2019 and Article 5(1)(e) of the GDPR. Retention periods are set in our system and applied automatically every night; every run is recorded in the audit log.
Retention schedule
| Data | Kept for | Then |
|---|---|---|
| Lead and inquiry records (name, contact details, message, preferred contact time, internal notes, technical details) | Until the request is closed, then 1 year | Anonymised: identifying fields are replaced, the message is removed; the referral and consent history is kept without identifiers |
| Consent records attached to a lead or inquiry (the exact wording agreed, time, version) | With the lead or inquiry | Anonymised with it |
| Record of what was shared with which provider, and when | With the lead or inquiry | Kept without identifiers as evidence of lawful sharing |
| Contact form messages | 1 year from receipt | Deleted |
| Provider account (name, email, hashed password, role) | While the account is active | Deleted or anonymised on closure, subject to legal retention duties |
| Claim records and verification evidence notes | While the listing is active | Kept with the listing as the basis of its verification label; personal data of the claimant anonymised on account closure |
| Uploaded import spreadsheets | 90 days after import | Deleted |
| Login sessions | Until expiry, purged within 30 days | Deleted |
| Password reset and email verification tokens | Until used or expired | Deleted |
| Rate-limit counters (hashed IP) | Until the window expires | Deleted |
| Administrative audit logs | 5 years | Deleted |
| Marketing email list | Until you unsubscribe or 2 years after your last interaction | Deleted |
Legal holds
Deletion or anonymisation is paused for a specific record where the law requires us to keep it, where it is needed for a complaint, claim or regulatory investigation, or where you have asked us in writing to keep it. The hold is recorded with its reason and reviewed every six months.
Your deletion requests
You may ask us to delete your personal data at any time through the privacy request form or by email to info@healthnaro.com. We confirm your identity with the details you gave us, delete or anonymise the data within one month, and tell you when it is done. Where we must keep something (for example the record that a share with a provider was consented to, kept without your identifiers, or an audit record), we tell you what and why. Deletion by us does not delete copies a provider already received; you can ask the provider directly and we will tell you who received your details.
Provider listings
A listing describes a business serving the public and is not deleted on account closure; it reverts to a Public listing with business details only. Individual practitioners may request removal of their profile as described in the Listing and Provider Policy.
How deletion is done
Deleted records are removed from the live database; anonymised records have identifying fields overwritten. Uploaded files are removed from private storage. Data remains in backups until the rotation period ends. Service providers that hold data on our behalf are instructed to delete it under their contracts.
Review
This schedule is reviewed every twelve months and whenever a new kind of data is collected. Changes are published here.