DrAxis — Data Retention Policy
Status: DRAFT v1 — for internal team review. Not legal advice.
Must be reviewed by qualified legal counsel before publication.
Last updated: 2026-08-23
Document control
| Field | Value |
|---|
| Document owner | DrAxis DPO / engineering |
| Version | 0.1 (DRAFT) |
| Effective date | [to be set at publication] |
| Review cycle | Annual, or upon material change in processing |
| Languages (target) | English, French, Arabic |
| Public URL | https://draxis.app/legal/data-retention-policy |
| Internal implementation | draxis-be retention jobs (to be implemented) |
1. Purpose
This Data Retention Policy ("Policy") defines how long DrAxis retains personal data, and the procedures for secure deletion. It implements the data minimization and storage limitation principles of:
- GDPR Art. 5(1)(c) and (e) (EU).
- Tunisian DPA (Law 2004-63) — proportionality and purpose limitation.
- KSA PDPL Art. 9 (data minimization) and Art. 13 (destruction).
- UAE PDPL Art. 8 (data minimization) and Art. 17 (deletion).
2. Retention schedule
2.1 Account data
| Data | Retention | Trigger for deletion | Basis |
|---|
| Phone number (auth) | While account active + 30 days | Account deletion request | Contract; user rights |
| Full name | While account active + 30 days | Account deletion request | Contract |
| Email (if provided) | While account active + 30 days | Account deletion request | Contract |
| Profile photo | While account active + 30 days | Account deletion request | Consent |
| Specialty / seniority / hospital / country | While account active + 30 days | Account deletion request | Verification |
| License number | While account active + 30 days | Account deletion request | Verification |
2.2 Verification data
| Data | Retention | Trigger for deletion | Basis |
|---|
| Verification documents (license scans, ID, affiliation letters) | 12 months after verification decision | Scheduled purge | Audit; risk management |
| Verification decision (approved/rejected + reason) | 10 years | Scheduled purge | Audit; Tunisian medical ethics (Art. 64) |
| Admin reviewer identity + timestamp | 10 years | Scheduled purge | Audit |
2.3 Clinical & messaging data
| Data | Retention | Trigger for deletion | Basis |
|---|
| Calculator inputs (transient) | Not persisted | Immediate (in-memory only) | Data minimization |
| Saved Calculator results (output only) | While account active + 30 days | Account deletion request | Contract |
| Messages (text) | While account active; deleted with account | Account deletion request | Contract |
| Attachments (files) | While account active + 30 days | Account deletion request | Contract |
| ATB suggestion inputs | Not persisted | Immediate (in-memory only) | Data minimization |
2.4 Security & operational data
| Data | Retention | Trigger for deletion | Basis |
|---|
| Audit logs (user ID, action, timestamp, IP) | 10 years | Scheduled purge | Tunisian medical ethics (Art. 64); GDPR Art. 32 security |
| Server access logs (SSH, admin) | 12 months | Scheduled purge | Security |
| API request logs (IP, route, status) | 90 days | Scheduled purge | Security; abuse prevention |
| Rate-limit counters | 24 hours | Rolling purge | Security |
| Crash reports (if/when integrated) | 90 days | Scheduled purge | Stability |
| Firebase auth tokens | Per Firebase defaults (max 1 hour for ID tokens) | Automatic | Authentication |
2.5 Backend technical data
| Data | Retention | Trigger for deletion | Basis |
|---|
| Database backups (full) | 30 days rolling | Scheduled purge | Disaster recovery |
| Database backups (weekly) | 12 weeks rolling | Scheduled purge | Disaster recovery |
| Object storage (attachments) | Tied to account + 30 days | Account deletion request | Contract |
| PM2 logs (application) | 30 days rolling | Scheduled purge | Operations |
3. Deletion procedures
3.1 User-initiated deletion
When a User requests account deletion (in-app or via dpo@draxis.app):
- T+0: Mark account as
pending_deletion; revoke Firebase tokens; block new logins. - T+24h: Soft-delete account data in the database (set
deleted_at timestamp). - T+30 days: Hard-delete:
- User row in
users table.
- Profile data.
- Saved Calculator results.
- Messages authored by the user (recipient copies remain until recipient deletes their account).
- Attachments in object storage.
- Retained: Audit log entries referencing the user (anonymized to user ID only) for 10 years.
3.2 Scheduled purge jobs
The backend (draxis-be) will implement cron jobs:
| Job | Frequency | Action |
|---|
purge-verification-docs | Daily | Delete verification documents older than 12 months post-decision |
purge-api-logs | Daily | Delete API request logs older than 90 days |
purge-server-access-logs | Daily | Delete SSH/admin access logs older than 12 months |
purge-pm2-logs | Daily | Rotate PM2 logs older than 30 days |
purge-backups | Daily | Delete database backups beyond retention window |
purge-deleted-accounts | Daily | Hard-delete accounts past 30-day soft-delete window |
purge-audit-logs | Monthly | Delete audit log entries older than 10 years |
3.3 Secure deletion
- Database:
DELETE (hard delete), not UPDATE to a null value. For sensitive fields, the row is deleted entirely. - Object storage: Permanently delete the object (no versioning retention for user-uploaded attachments).
- Backups: Backups containing deleted data are not specially purged; they expire per the backup retention schedule. Restoring a backup does not restore deleted user data without explicit DPO approval.
- Firebase: User account in Firebase Auth is deleted via the Admin SDK at T+24h.
4. Legal hold
If DrAxis receives a legal hold notice or litigation hold request:
- Deletion of the specified data is suspended for the duration of the hold.
- The DPO maintains a register of active holds.
- Once the hold is lifted, normal retention rules resume.
5. Data subject rights and retention
- Right to erasure (GDPR Art. 17): Honored per §3.1, except where retention is required by law (audit logs).
- Right to object (GDPR Art. 21): May result in restriction of processing rather than deletion.
- KSA PDPL Art. 13 (destruction): Honored per §3.1.
- UAE PDPL Art. 17 (deletion): Honored per §3.1.
Where a deletion request cannot be fully honored due to legal retention obligations, we will inform the User of the reasons and the expected deletion date.
6. Backups and recovery
- Backups are retained for disaster recovery only, not for routine data access.
- A User who has deleted their account will not be restored from backup unless required by law and approved by the DPO.
- Backup restoration is logged in the audit log.
7. Implementation status
| Component | Status |
|---|
users.deleted_at column | To be added (migration) |
DELETE /api/me route | To be implemented |
GET /api/me/export route | To be implemented |
| Cron jobs (§3.2) | To be implemented |
| Firebase Auth deletion on account deletion | To be implemented |
| Object storage deletion on account deletion | To be implemented |
⚠️ Until the above are implemented, account deletion is a manual operation performed by an admin. The 30-day window starts once the manual deletion is initiated.
8. Contact
- DPO:
dpo@draxis.app - Engineering:
engineering@draxis.app