Data Retention Policy
Last updated: 10 October 2026
This policy describes how long information submitted through NMSL patient survey and appointment services may be retained and how it is securely managed.
Retention Principles
NMSL retains information only for as long as it is reasonably required for patient service delivery, appointment administration, service improvement, audit, security, legal, and regulatory purposes.
Appointment Records
Appointment information, including contact details, scheduling history, room assignments, status changes, notifications, and relevant audit records, is retained for up to seven years for operational follow-up, reporting, dispute resolution, and compliance. After that period, the scheduled retention task anonymises personal appointment details while retaining non-identifying operational statistics.
Survey Records
Survey responses and associated contact or location information may be retained for trend analysis, quality improvement, reporting, and audit. Aggregated or anonymised statistics may be kept longer because they do not directly identify an individual.
When an authorised user deletes a survey response, the application moves it to a restricted recycle bin rather than immediately removing it. The response is excluded from normal reports and analytics, may be restored by a Super User for the configured retention period, and is then permanently purged by a scheduled server task.
Security and Disposal
Profile fields that do not need to remain searchable are encrypted at rest using authenticated encryption. Email and phone details are retained for OTP and patient-contact services and are protected by database and backup encryption at the hosting-provider layer. When retention is no longer necessary, information is securely deleted, anonymised, or otherwise disposed of in accordance with applicable requirements.
Requests and Exceptions
Retention periods may be extended when necessary for legal claims, investigations, regulatory duties, security incidents, or other legitimate operational requirements. Records marked with a legal hold are excluded from automated anonymisation until the hold is removed. Requests about personal information should be made through NMSL using the contact details below and may require identity verification.
Policy Changes
NMSL may update this policy when its services, systems, or legal obligations change. The effective date above identifies the latest version.