Data Retention & Records Management Policy
How long records are kept, and how they are disposed of.
1. Purpose and scope
This Data Retention & Records Management Policy ("Policy") explains how long DocGini keeps different kinds of information, why, and how it is disposed of. It applies to all personal and health information held on DocGini, and supports our Privacy Policy and Terms of Service.
2. Principles
- We keep information only as long as it is needed for the service, for patient care, or to meet the law.
- Medical records are kept long enough to support safe, continuous care, because a patient's history can matter years later.
- Where Pakistani law, a regulator or a court requires a longer period, that requirement applies.
- When information is no longer needed, it is deleted or anonymised securely.
3. How long we keep information
| Information | How long |
|---|---|
| Medical records: consultation notes, prescriptions, lab orders, vitals, diagnoses | At least 7 years after the patient's last visit. For a patient who was under 18 at that visit, until they turn 25 or for 7 years, whichever is longer. |
| Bookings, queue tokens and visit history | Kept with the medical record, for the same period. |
| Account details: name, contact details, CNIC, MRN | While the account is open, then as long as the related medical records are kept. |
| Payment and invoice records | At least 6 years, as required for tax and accounting. |
| Complaints and their outcomes | 3 years after the complaint is closed. |
| Reviews and ratings | While published, and 1 year after removal. |
| Provider credentials and verification documents | While the Provider is listed, then 3 years. |
| Security and access logs | Up to 1 year, longer if needed for an investigation. |
| Message logs (time, purpose and status, no message content) | 1 year. |
| One-time codes and password reset links | Minutes to hours; they expire automatically once used or out of date. |
| Backups | Rolling copies overwritten on a fixed cycle, normally within 35 days. |
| Promotional consent and opt-outs | While valid, plus 2 years as proof of consent. |
4. Closing an account and deletion requests
- You can close your account, or ask us to delete your personal data, by contacting support@docgini.com.
- Information that is not part of a medical, financial or legal record is deleted or anonymised within 30 days.
- Medical and financial records are kept for the periods in section 3 even after an account closes, because the law and patient safety require it. They are restricted so that they are used only for those purposes.
- Records that a Provider holds in their own capacity may also be subject to that Provider's legal duties.
5. Keeping records accurate
Patients can ask for their personal details to be corrected at any time. Clinical entries are corrected by the Provider who made them: the correction is added and the original is kept, so the record shows what was known at the time. Clinical records are never altered to hide an error.
6. Legal holds
If information is needed for an investigation, a complaint, a dispute or legal proceedings, its deletion is paused until the matter is closed, even if its normal retention period has ended.
7. Secure disposal
At the end of its retention period, information is permanently deleted from live systems and drops out of backups on their normal cycle, or is anonymised so that no person can be identified. Anonymised data may be kept for statistics and to improve the service. Printed records produced from DocGini are the responsibility of whoever printed them, and must be shredded or disposed of securely.
8. Responsibilities
MEDCONS is responsible for applying this Policy to data held on DocGini. Providers and facilities remain responsible for records they keep outside DocGini, and must meet their own professional and legal record-keeping duties.
9. Changes to this Policy
We review this Policy at least once a year. Material changes will be notified in the same way as changes to the Terms of Service. A change will never shorten the period for records that the law requires us to keep.
Contact Us
MEDCONS, The Mentor Development Consultants (Private) Limited
Email: support@docgini.com, contact@medcons.pk
Website: contact page