How retention works here
Curenium is the processor. The customer organisation, as controller, sets the retention period for clinical records — in the UK that is normally the NHS Records Management Code of Practice, which is far longer than a technology vendor would choose. The periods below are our defaults where an organisation has not specified its own. They can be shortened or extended per organisation, and we will not delete clinical data on our own initiative.
Retention is a clinical governance decision, not a storage decision. We will hold data for as long as your statutory obligations require, and we will not quietly expire it to save space.
Clinical records
Default retention aligned to the NHS Records Management Code of Practice:
- Adult health records — 8 years after the last entry.
- Children and young people — until the patient's 25th birthday, or 26th if the last entry was made at 17.
- Maternity records — 25 years after the birth of the last child.
- Mental health records — 20 years after the last entry, or 8 years after death.
- Records of a deceased patient — 8 years after death.
- Prescribing and medication administration records — retained with the clinical record they belong to.
- Laboratory orders and results — retained with the clinical record they belong to.
Where a record is subject to litigation, a complaint, or a statutory inquiry, retention is suspended and the record is preserved until the matter concludes — regardless of the period above.
Operational and account data
- Staff account records — for the duration of employment plus 6 years, matching the limitation period for employment claims.
- Authentication events (sign-in, sign-out, failed attempts, token refusals) — 12 months.
- Record access logs (who opened which patient record) — 12 months minimum, longer where an organisation's policy requires.
- Audit trail of record modifications — retained for the life of the clinical record it describes. An audit entry that outlives its record is useless; one that dies first defeats the purpose.
- Shift, rota and clock-in records — 6 years.
- Billing and payment records — 7 years, per HMRC requirements.
- Support correspondence — 3 years.
How deletion actually works
Deleting a patient record in Curenium is a soft delete: the record is withdrawn from clinical views and searches but is not destroyed. This is deliberate. A clinical record deleted in error cannot be reconstructed, and destroying one that is still within its statutory period would itself be a breach. Deletion is restricted to administrators. Other staff may raise a deletion request with a stated reason, which an administrator reviews and decides. Every step — request, approval, rejection, withdrawal and the deletion itself — is recorded in the audit trail with the reason given.
Permanent destruction at the end of a retention period is carried out on the controller's instruction, not automatically. We would rather ask than irreversibly destroy a health record on a timer.
Backups
Encrypted backups are retained on a rolling 35-day cycle. Data removed from live systems may persist in backups until it rotates out. Backups are not accessible to staff or customers, are not used to answer data subject requests, and are never selectively edited — editing a backup would destroy its integrity as a recovery point. Where a record is erased from live systems, it is not restored from backup.
Questions
To agree a retention period specific to your organisation, or to request destruction at the end of a period, contact support@plannorium.com or info@plannorium.com. Written correspondence: Plannorium Ltd, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom.