18-data_retention_policy.md

18. Data Retention Policy

Despite not being a requirement within HIPAA, NutriAdmin understands and appreciates the importance of health data retention. Acting as a subcontractor, and at times a business associate, NutriAdmin is not directly responsible for health and medical records retention as set forth by each state. Despite this, NutriAdmin has created and implemented the following policy to make it easier for NutriAdmin Customers to support data retention laws.

18.1 State Medical Record Laws

• Listing of state requirements for medical record retention

18.2 Data Retention Policy

• Current NutriAdmin Customers have data stored by NutriAdmin as a part of the NutriAdmin Service.
• Once a Customer ceases to be a Customer, as defined below, the following steps are
  1. Customer is sent a notice via email of change of standing, and given the option to download their client data stored in NutriAdmin.
  2. NutriAdmin will continue to store all Customer data indefinitely unless the client sends a written request for the data to be permanently erased.
  3. For security and performance reasons, NutriAdmin reserves the right to delete stale customer data after a year of cancellation of a SaaS customer. The customer would be notified before deletion and given the chance to export the data or to reactivate the subscription before any irreversible action is taken.