Deleting your data

Two kinds of deletionCopy link to section

• Delete a clinic. Removes that clinic, its locations, its sources, and all evidence and findings derived from them. Other clinics are unaffected.
• Close the workspace. Removes everything.

Both are self-service. Both are irreversible once they begin.

Thirty days is a grace period, not a queueCopy link to section

When you close a workspace, members lose access immediately and the data is removed thirty days later. Until then you can cancel, and the settings page shows the date and the cancel button.

That month exists for one reason: an account closed by mistake — a departing colleague, a wrong button, a compromised session — is recoverable. After it elapses, nothing is.

What happens, in orderCopy link to section

Deletion is a sequence, and it is recorded step by step so we can tell you exactly where it has got to:

1. The request is verified and checked for a legal hold.
2. Recurring monitors stop, so nothing runs against a workspace being removed.
3. Queued work still in flight becomes a no-op.
4. Your final export is produced, if you asked for one. This has to happen first, because afterwards there is nothing to export.
5. Every ClinicRadar record is deleted — clinics, evidence, scores, findings, incidents, actions, reports.
6. Every file we hold for you is deleted from object storage.
7. Memberships, invitations, and billing mirrors are removed.
8. We ask our analytics provider to delete the people involved, identified only by an internal identifier that is not your name or address.
9. The audit trail is reduced to what must be kept.

Steps 1 to 4 are reversible. Step 5 onwards is not, which is why cancelling stops being possible once it starts.

It is not a flag that hides rows. The records are removed.

What survives, and whyCopy link to section

• Invoices and tax records. We are legally required to keep them.
• Consent records. They exist to prove what you chose and when, which is itself a legal obligation.
• The workspace address, marked closed. Freeing it would let somebody else take it, and every reference elsewhere — an invoice, a past email, a support case — would then point at the wrong workspace.
• A minimised audit trail: what happened, to what kind of record, and when. The identities and the details are stripped.

None of these contains your clinics, your evidence, or your findings.

BackupsCopy link to section

Point-in-time recovery snapshots are retained for up to 30 days. Deletion is applied to live data immediately and works through recovery snapshots as they expire. A snapshot is never used to restore data that a deletion request has already removed.

Who can deleteCopy link to section

Deleting a clinic: Admin and above. Closing the workspace: Owner only — running a workspace and ending it are deliberately different permissions.

Before you deleteCopy link to section

Export first — the closing form offers to do it for you, and that box is ticked by default. There is no undo.