1. Purpose

This policy makes sure that Zebrold Private Limited keeps personal data for as long as the law and the care of patients require, and no longer. It applies to all personal data handled for Consult Your Doctor, in any form.

2. Principles

• Data is kept only for a stated purpose and for a stated period.
• Where two countries' laws set different periods, the longer period applies to records that are subject to both.
• Where no legal period applies, the shorter period in the table applies.
• Data that is no longer needed is deleted securely, or made anonymous so that no person can be identified.

3. Retention schedule

The periods below are proposed and must be confirmed by counsel in each country before the policy is approved.

4. Deletion

Each quarter the data protection lead runs a deletion routine for data whose period has ended and records the result. Electronic data is erased from live systems and, within 90 days, from backups. Paper is shredded. Devices are wiped before they are reused or discarded. A legal hold, ordered by the directors, stops deletion of data that is needed for a claim or an investigation.

5. Requests from individuals

A request to erase data is answered within the time the law allows. Medical records that must be kept by law are not erased on request, but they are restricted and the individual is told why.

6. Roles

The data protection lead owns this policy and the retention schedule, and runs the quarterly deletion routine. Each department head confirms every year that the records in their area are covered by the schedule. The technical lead carries out the deletion in systems and backups. The legal adviser advises on legal periods and legal holds.

7. Legal holds

Where a claim, an investigation or a request from an authority is expected or in progress, the directors may order a legal hold on specified records. While a hold is in force, the records are not deleted, even if their period has ended, and the data protection lead keeps a register of holds, which is reviewed every quarter. When the hold ends, the normal period applies from that date.

8. Backups and archives

Backups keep data for no longer than 90 days after the data has been deleted from live systems, and they are encrypted. Archives of medical records are held in a secure, separate system with restricted access, and records in the archive are subject to the same schedule.

9. Records held by third parties

Doctors, diagnostic centres, pharmacies and other partners who hold copies of data must delete or return it at the end of the period, in line with their agreements, and confirm in writing. The company may ask for evidence of deletion and may audit it.

10. Audit

1. Purpose

This policy makes sure that Zebrold Private Limited keeps personal data for as long as the law and the care of patients require, and no longer. It applies to all personal data handled for Consult Your Doctor, in any form.

2. Principles

• Data is kept only for a stated purpose and for a stated period.
• Where two countries' laws set different periods, the longer period applies to records that are subject to both.
• Where no legal period applies, the shorter period in the table applies.
• Data that is no longer needed is deleted securely, or made anonymous so that no person can be identified.

3. Retention schedule

The periods below are proposed and must be confirmed by counsel in each country before the policy is approved.

4. Deletion

Each quarter the data protection lead runs a deletion routine for data whose period has ended and records the result. Electronic data is erased from live systems and, within 90 days, from backups. Paper is shredded. Devices are wiped before they are reused or discarded. A legal hold, ordered by the directors, stops deletion of data that is needed for a claim or an investigation.

5. Requests from individuals

A request to erase data is answered within the time the law allows. Medical records that must be kept by law are not erased on request, but they are restricted and the individual is told why.

6. Roles

The data protection lead owns this policy and the retention schedule, and runs the quarterly deletion routine. Each department head confirms every year that the records in their area are covered by the schedule. The technical lead carries out the deletion in systems and backups. The legal adviser advises on legal periods and legal holds.

7. Legal holds

Where a claim, an investigation or a request from an authority is expected or in progress, the directors may order a legal hold on specified records. While a hold is in force, the records are not deleted, even if their period has ended, and the data protection lead keeps a register of holds, which is reviewed every quarter. When the hold ends, the normal period applies from that date.

8. Backups and archives

Backups keep data for no longer than 90 days after the data has been deleted from live systems, and they are encrypted. Archives of medical records are held in a secure, separate system with restricted access, and records in the archive are subject to the same schedule.

9. Records held by third parties

Doctors, diagnostic centres, pharmacies and other partners who hold copies of data must delete or return it at the end of the period, in line with their agreements, and confirm in writing. The company may ask for evidence of deletion and may audit it.

10. Audit