Patient-record retention
As a healthcare professional, you are typically required by law to retain patient records for a defined period after your last contact with each patient. The exact duration depends on your jurisdiction, profession, and the patient’s age. Maestra cannot determine your retention obligations for you: they are your professional and legal responsibility.
Why this matters when deleting your account
Section titled “Why this matters when deleting your account”Account deletion removes Maestra-held records and the wrapped key material required for password and recovery unlock. This makes the server-side ciphertext unavailable to Maestra. It does not erase a plaintext export, a user-created backup, or a copy retained on another device.
Before deleting your account, open Settings and tap Export Patient Records to produce a ZIP archive containing aggregate manifest.json and user.json files plus one JSON and one PDF per patient.
Save the archive somewhere durable (encrypted backup, secure cloud storage, your own archival workflow) before continuing with deletion.
Common retention frames (examples, verify your own)
Section titled “Common retention frames (examples, verify your own)”| Region | Common reference | Typical duration |
|---|---|---|
| Brazil | CFM Resolução 1.821/2007 | At least 20 years from the last entry |
| United States | HIPAA + state-specific medical-record laws | Typically 6–10 years; some states require longer |
| European Union | Member-state medical-record laws | Frequently 10+ years; varies by member state |
| United Kingdom | NHS Records Management Code of Practice | 8+ years for adults; longer for minors and certain specialties |
Pediatric records, mental-health records, and records related to ongoing litigation often have longer retention requirements than the baseline above. Verify the rules that apply to your practice.
Your responsibilities
Section titled “Your responsibilities”- You are the data custodian for the patient records you created in Maestra. Maestra is a processor: it stores the encrypted bytes; you hold the keys.
- After deleting your account, the responsibility to retain records does not disappear. It transfers entirely to the archive you exported.
- Store the exported archive securely. The JSON and PDF files contain unencrypted patient data; treat them with the same care as paper records.
If you have questions
Section titled “If you have questions”For account-deletion mechanics, see Delete your account. For encryption details, see Trust & Privacy. For legal questions about retention, consult professional counsel. Maestra cannot answer jurisdiction-specific legal questions.