Data Retention & Erasure
This document describes, in plain language, how long data is kept on the Zoravet platform, what happens when someone asks for their data to be deleted, and how data can be taken out of the platform. It is a transparency document; the binding commitments live in the Data Processing Agreement.
Who decides: the clinic is the controller for its client, pet and staff data; Zoravet is the processor. Erasure is therefore a controller decision, carried out by clinic staff — Zoravet builds and operates the mechanism that executes it. For its own platform and business data, Zoravet is itself controller.
1. Principles
- Storage limitation (GDPR Art. 5(1)(e)): personal data is kept no longer than necessary for the purpose it was collected for. Where a fixed legal term exists, that term is the limit; where none exists, the purpose is.
- Right to erasure (GDPR Art. 17): anyone can ask for their data to be deleted, via their clinic. Erasure is real and immediate for everything the law does not require us to keep.
- The statutory-retention exception (Art. 17(3)(b)), stated plainly: some records legally must be kept even after an erasure request — most notably invoices and financial records, which Dutch bookkeeping law requires every business to retain for seven years, and veterinary-medicine dispensing records, which EU law requires for five years. Those records are kept minimised (stripped down to what the legal obligation actually needs) and are deleted or anonymised automatically once the legal clock runs out. An erasure request is never simply refused because “something” must be kept — only the legally required subset is kept, and only for as long as the law requires.
- Automatic enforcement: retention limits are enforced by an automated retention process running in production, not by manual housekeeping. The Dutch fiscal seven-year term is enforced as a hard lower bound in the platform — it cannot be configured below the legal minimum.
2. Retention periods at a glance
| Data category | Retention period | Basis |
|---|---|---|
| Fiscal and invoice records (invoices, payments, ledger) | 7 years | Dutch bookkeeping law (fiscal retention obligation) |
| Veterinary-medicine dispensing records | 5 years | EU Regulation 2019/6 (veterinary medicinal products) |
| Clinical records (patient dossiers) | Retained as lifelong patient history under the clinic’s control; erased on an owner’s request, subject to the statutory terms above | Controller decision; veterinary care |
| Employee records after departure — general HR | 2 years after employment ends | Dutch data-protection authority guideline |
| Employee records after departure — wage-tax and fiscal | 5–7 years after employment ends | Dutch wage-tax and fiscal law |
| Operational and notification-delivery logs | Approximately 2 years | Operations; storage limitation |
| Audit records of actions in the platform | Retained for accountability; pseudonymised when the person they concern is erased | Legitimate interest (GDPR Art. 5(2)) |
Veterinary clinical records have no fixed Dutch statutory retention term. The clinic, as controller, keeps them as lifelong patient history — a dossier remains clinically relevant for the animal’s whole life — and erases them when the owner asks, except for the fiscal and medicine-dispensing subsets listed above.
3. What erasure actually does
When a clinic erases a client’s data on the owner’s request, three things happen:
- Immediate deletion of everything the law does not require us to keep: clinical records, pets and their dossiers, documents, messages, contact details, and the person’s platform login (unless the same login is still legitimately in use in another role).
- Minimisation of what must stay. Records under a statutory retention duty — invoices, payments and the medicine-dispensing trail — are kept, but stripped of clinical and free-text detail. What remains is the minimum the legal obligation needs: for example, the name and address that must appear on an invoice and in the medicine-dispensing record.
- Automatic final anonymisation. When the statutory clock expires (seven years for fiscal records), the retained remainder is automatically anonymised or deleted by the retention process — no further request needed.
For departed employees, records held in the platform’s HR features follow the same pattern: platform access is removed at offboarding, and the records enter their retention terms (two years for general HR data, five to seven years for wage-tax and fiscal data), after which the automated process purges them. Because nearly all employee data after departure has a statutory retention basis, ex-employee erasure requests are answered by this retention schedule rather than by accelerated deletion.
4. Getting data out (portability)
- Clinics: a clinic leaving the platform can request a complete export of all its data — records in a machine-readable format plus stored documents — via a secure, time-limited download. Return or deletion of data on termination is contractually committed in the DPA.
- Pet owners: an individual export of a pet owner’s own personal data and their pets’ records is available for access and portability requests (GDPR Art. 15 and 20), via their clinic.
5. Review and updates
- This document is reviewed at least annually, and additionally when a legal retention requirement or the platform’s retention behaviour materially changes.
- Material changes are logged on the Updates page.
Contact
- Zoravet: Jensen Software, KvK 96526181, Oanjelaan 32, 1421 AK Uithoorn, Netherlands
- General / privacy: support@zoravet.nl
- Security reports: security@zoravet.nl