Data Retention & Erasure
This document describes, in plain language, how long data is kept on the Zoravet platform, what happens when someone asks for their data to be deleted, and how data can be taken out of the platform. It is a transparency document; the binding commitments live in the Data Processing Agreement.
Who decides: the clinic is the controller for its client, pet and staff data; Zoravet is the processor. Erasure is therefore a controller decision, carried out by clinic staff. Zoravet builds and operates the mechanism that executes it. For its own platform and business data, Zoravet is itself controller.
1. Principles
- Storage limitation (GDPR Art. 5(1)(e)): personal data is kept no longer than necessary for the purpose it was collected for. Where a fixed legal term exists, that term is the limit; where none exists, the purpose is.
- Right to erasure (GDPR Art. 17): anyone can ask for their data to be deleted, via their clinic. Erasure is real and immediate for everything the law does not require us to keep.
- The statutory-retention exception (Art. 17(3)(b)), stated plainly: some records legally must be kept even after an erasure request: most notably invoices and financial records, which Dutch bookkeeping law requires every business to retain for seven years, and veterinary-medicine dispensing records, which EU law requires for five years. Those records are kept minimised (stripped down to what the legal obligation actually needs). Deleting them once the legal term has passed is planned but not yet automated; until it is, they are kept longer than the legal minimum, in minimised form. An erasure request is never simply refused because “something” must be kept: only the legally required subset is kept.
- Automatic enforcement: the retention limits in the table below are enforced by automated processes running in production, not by manual housekeeping, except where the table says deletion is planned. The Dutch fiscal seven-year term is a hard lower bound in the platform: it cannot be configured below the legal minimum, so fiscal records are never deleted early.
2. Retention periods at a glance
| Data category | Retention period | Basis |
|---|---|---|
| Fiscal and invoice records (invoices, invoice PDFs, payments, ledger) | At least 7 years; deletion afterwards is planned, not yet automated | Dutch bookkeeping law (fiscal retention obligation) |
| Veterinary-medicine dispensing register (medicine, batch, quantity, animal, keeper name and address, prescriber) | At least 5 years; deletion afterwards is planned, not yet automated | EU Regulation 2019/6 (veterinary medicinal products) |
| Clinical records (patient dossiers) | Retained as lifelong patient history under the clinic’s control; erased on an owner’s request, subject to the statutory terms above | Controller decision; veterinary care |
| Employee records after departure: sickness-absence episode details (dates and any note) and on/offboarding checklists | 2 years after employment ends | Dutch data-protection authority guideline |
| Employee records after departure: employment, contract, leave (including the days recorded as sick leave), working-time and rota records, staff documents | 7 years after employment ends | Dutch wage-tax and fiscal law |
| Notification-delivery log | 2 years | Operations; storage limitation |
| Technical logs (application, security and error logs, including the scrubbed error reports the clinic portal sends to our own servers) | 30 days | Security and operations; storage limitation |
| Web-traffic logs | 90 days | Security; storage limitation |
| Idempotency keys (a short record that stops a payment or credit being booked twice: a user reference, a fingerprint of the request and the resulting record; no other personal details) | 24 hours | Correct bookkeeping; storage limitation |
| Import source files (a clinic’s export from its previous practice system, and uploaded client, price-list and supplier-catalogue files) | 90 days after a successful import; for an import that is never completed, 90 days after upload | Storage limitation; the imported records themselves follow the periods above |
| Uploaded bookkeeping source documents (supplier invoices, delivery notes and similar fiscal uploads) | At least 7 years; not part of the 90-day deletion; deletion afterwards is planned, not yet automated | Dutch bookkeeping law |
| Import error reports (lists of rows that could not be imported) | 90 days after the report is created | Storage limitation |
| Audit records of actions in the platform | 7 years; pseudonymised earlier when the person they concern is erased | Accountability (GDPR Art. 5(2)) |
Veterinary clinical records have no fixed Dutch statutory retention term. The clinic, as controller, keeps them as lifelong patient history (a dossier remains clinically relevant for the animal’s whole life) and erases them when the owner asks, except for the fiscal and medicine-dispensing subsets listed above.
3. What erasure actually does
When a clinic erases a client’s data on the owner’s request, three things happen:
- Immediate deletion of everything the law does not require us to keep: clinical records, pets and their dossiers, non-fiscal documents, messages, contact details, and the person’s platform login (unless the same login is still legitimately in use in another role).
- Minimisation of what must stay. Records under a statutory retention duty (invoices, invoice PDFs and other fiscal documents, payments and the medicine-dispensing register) are kept, but stripped of clinical and free-text detail. What remains is the minimum the legal obligation needs: for example, the name and address that must appear on an invoice, and in the dispensing register the medicine, batch, quantity, animal, keeper name and address and prescriber, without the clinical reason for the medicine.
- Anonymisation of the client record. Seven years after the erasure, the retention process automatically anonymises the name and address left on the client record (no further request needed). Copies of the name and address are held only in the retained invoice PDFs and the medicine-dispensing register; they stay until those records themselves are deleted after their legal terms, which is planned but not yet automated.
Copies of a person’s data inside an import source file are not edited one by one; they are deleted together with the file, at the latest 90 days after the import.
For departed employees, records held in the platform’s HR features follow the same pattern: platform access is removed at offboarding, and the records enter their retention terms (two years for sickness-absence episode details and checklists; seven years for employment, leave, time and rota records and staff documents, which includes the days recorded as sick leave), after which the automated process purges them. Because nearly all employee data after departure has a statutory retention basis, ex-employee erasure requests are answered by this retention schedule rather than by accelerated deletion.
4. Getting data out (portability)
- Clinics: a clinic leaving the platform can request a complete export of all its data (records in a machine-readable format plus stored documents) via a secure, time-limited download. Return or deletion of data on termination is contractually committed in the DPA.
- Pet owners: can download a copy of their own profile data directly in the app: name, email address, phone number, postal address, language preference, loyalty-points balance and account status. Their pets’ records, clinical dossier, appointments, messages and invoices are not in this download; their clinic, which is the controller for them, provides those (GDPR Art. 15 and 20).
5. Review and updates
- This document is reviewed at least annually, and additionally when a legal retention requirement or the platform’s retention behaviour materially changes.
- Material changes are logged on the Updates page.
Contact
- Zoravet: Jensen Software, KvK 96526181, Oanjelaan 32, 1421 AK Uithoorn, Netherlands
- General / privacy: support@zoravet.nl
- Security reports: security@zoravet.nl