Data Retention & Destruction Policy

This Data Retention & Destruction Policy (“Policy”) establishes the retention schedules, legal hold procedures, destruction methods, and certification requirements for all data processed by Rymeda, Inc. (“Rymeda,” “we,” “us”) through the Rymeda platform.

This Policy implements the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 CFR Parts 160 and 164; the California Confidentiality of Medical Information Act (“CMIA”), Cal. Civ. Code §56 et seq.; the General Data Protection Regulation (“GDPR”), Articles 5(1)(e) and 17; the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), Cal. Civ. Code §1798.105; and NIST Special Publication 800-88 Rev. 1 (Guidelines for Media Sanitization).

The guiding principle of this Policy is data minimization: we retain data only for as long as necessary to fulfill the purpose for which it was collected, to comply with legal and regulatory obligations, and to support legitimate clinical, operational, and business needs. When retention periods expire and no legal hold applies, data is destroyed using certified methods appropriate to its classification.

1. Definitions

2. Scope

This Policy applies to all data created, received, maintained, or transmitted by or through the Rymeda platform, regardless of format or storage medium. This includes:

• Protected Health Information (PHI) and electronic PHI (ePHI)
• Clinical records, charts, notes, and AI-generated medical reports
• Voice recordings and transcriptions
• Patient demographic and insurance information
• User account data and authentication records
• Financial and billing records (invoices, claims, CPT/ICD-10 codes)
• Audit logs and security event records
• Communications (secure messages, email notifications)
• Provider credentials and verification records
• Operational data (appointments, tasks, runbooks)
• Analytics and platform usage data
• Backup and disaster recovery copies

This Policy applies to all Rymeda workforce members, authorized users, subprocessors, and any third party that stores or processes Rymeda data.

3. Retention Schedule

The following table establishes the minimum retention periods for each data category. Data may be retained longer than the minimum where required by an active legal hold or specific regulatory obligation. Retention periods are measured from the triggering event specified for each category.

4. Retention Period Extensions

Retention periods defined in Section 3 represent minimums. Data may be retained beyond the minimum period in the following circumstances:

• Active Legal Hold: Data subject to a legal hold (Section 5) is retained indefinitely until the hold is released by the Legal department
• Ongoing Investigation: Data relevant to an active compliance investigation, security incident, or breach analysis is retained until the investigation is closed
• Regulatory Request: Data subject to a regulatory inquiry, audit, or examination is retained until the matter is resolved plus any applicable appeal period
• Contractual Obligation: Where a Business Associate Agreement (BAA) or other contractual obligation specifies a longer retention period, the longer period governs
• Clinical Continuity: Clinical records for patients with active treatment plans or ongoing care relationships are not eligible for destruction regardless of the elapsed retention period
• Pending Deletion Request: GDPR or CCPA deletion requests do not override clinical record retention requirements where HIPAA mandates continued retention

5. Legal Hold Procedures

A legal hold is a directive to preserve all potentially relevant data when litigation, governmental investigation, regulatory audit, or other legal proceeding is reasonably anticipated or pending. Legal holds override all standard retention schedules and automated destruction processes.

5.1 Hold Initiation

• Legal holds are issued by the Legal department or Privacy Officer upon reasonable anticipation of litigation, investigation, or regulatory action
• The hold notice specifies: the matter name, data categories subject to the hold, affected organizations or users, and the scope of preservation
• All automated destruction processes for the affected data categories are immediately suspended
• The hold is documented in the compliance system with a unique hold identifier, issue date, and issuing authority

5.2 Hold Scope

• Data Preservation: All data within the hold scope is preserved in its current state, including backups, audit logs, and metadata
• Backup Protection: Backup lifecycle policies are suspended for held data — affected backups are excluded from routine rotation and overwrite
• Access Continuity: Legal holds do not change data access controls. Held data remains accessible only to users with existing authorized access
• Deletion Requests: GDPR Article 17 (Right to Erasure) and CCPA §1798.105 deletion requests for data subject to a legal hold are acknowledged but deferred until the hold is released, as permitted under GDPR Art. 17(3)(e) and CCPA §1798.105(d)(4)

5.3 Hold Release

• Legal holds are released only by the Legal department upon resolution of the underlying matter
• Upon release, data reverts to its standard retention schedule. The retention clock resumes from the point at which it was suspended
• Data that has exceeded its retention period during the hold becomes eligible for destruction immediately upon hold release, subject to the standard destruction process
• Hold release is documented with: release date, releasing authority, and confirmation of resumed destruction eligibility

6. Data Destruction Methods

When a retention period expires and no legal hold applies, data is destroyed using methods appropriate to its classification and storage medium. All destruction methods are designed to render data permanently unrecoverable.

6.1 Temporary Data & Processing Artifacts

Certain data is created as part of processing pipelines and is not subject to long-term retention:

7. Deletion Rights (GDPR & CCPA)

Rymeda honors data subject deletion rights under GDPR Article 17 (Right to Erasure) and CCPA §1798.105 (Right to Delete), subject to applicable legal exceptions.

7.1 Deletion Request Process

• Deletion requests are submitted through the platform or by contacting legal@rymeda.com
• Identity verification is performed before processing any deletion request
• Requests are acknowledged within 3 business days and processed within 30 days (GDPR) or 45 days (CCPA)
• A confirmation of deletion is provided to the data subject upon completion

7.2 Deletion Scope

Upon a verified deletion request, the following actions are taken:

• User profile anonymized (email, name, phone, bio, avatar removed or replaced)
• Associated posts and content soft-deleted
• Message content replaced with “[Deleted]”
• All active sessions invalidated
• GDPR deletion record created with: deletion ID, original email hash (for audit), reason, authorized by, timestamp, and data summary
• Audit log entry created with severity: "critical"

7.3 Exceptions to Deletion

8. Destruction Certification

Every data destruction event is formally certified to maintain a verifiable chain of custody and demonstrate regulatory compliance. Destruction certificates are retained for 6 years per HIPAA §164.530(j).

8.1 Certificate Contents

Each destruction certificate records the following:

8.2 Certificate Retention

• Destruction certificates are retained for a minimum of 6 years from the destruction date
• Certificates are stored in encrypted, append-only storage separate from the data they document
• Certificates are available for regulatory audit upon request
• The certificate register is reviewed quarterly by the Compliance team

9. Backup & Disaster Recovery Data

Backup copies are subject to the same retention and destruction requirements as primary data, with the following considerations:

• Backup Encryption: All backup copies are encrypted with AES-256 using the same per-tenant KMS keys as primary storage. Cryptographic erasure of the primary key also renders backup data unrecoverable
• Backup Rotation: Automated backup lifecycle policies manage retention and rotation. Daily backups are retained for 30 days; weekly backups for 90 days; monthly backups for 1 year
• DR Copies: Disaster recovery copies replicated across AWS regions inherit the retention schedule of their source data
• Destruction Cascading: When primary data is destroyed, the destruction process includes verification that corresponding backup and DR copies are also queued for destruction at the next rotation cycle or via explicit deletion
• Legal Hold on Backups: Backups containing data subject to a legal hold are excluded from rotation until the hold is released

10. Subprocessor Data Retention

Third-party subprocessors that process Rymeda data are contractually bound to retention and destruction requirements consistent with this Policy. For a complete list of subprocessors, see our Subprocessor List.

11. Exceptions

Exceptions to this Policy may be granted in limited circumstances:

• Regulatory Requirement: Where a federal or state regulation requires a retention period different from this Policy, the longer period governs
• Contractual Obligation: Where a customer agreement specifies a longer retention period, the contractual period governs for that customer’s data
• Research Authorization: De-identified data may be retained beyond standard periods for authorized research purposes under a data use agreement and IRB approval
• Technical Limitation: Where immediate destruction is not technically feasible (e.g., data embedded in encrypted backups awaiting rotation), destruction is completed at the earliest technically feasible time

All exceptions must be documented with: the data category, the basis for the exception, the extended retention period, the approving authority (Privacy Officer or Legal), and a review date.

12. Roles & Responsibilities

13. Policy Review & Audit

This Policy is subject to regular review and audit to ensure continued compliance with evolving legal, regulatory, and operational requirements.

• Annual Review: Comprehensive review of all retention schedules, destruction methods, and certification procedures at minimum once per calendar year
• Regulatory Updates: Policy is updated within 30 days of applicable regulatory changes at the federal or state level that affect retention periods or destruction requirements
• Quarterly Certificate Review: The Compliance team reviews all destruction certificates issued in the preceding quarter to verify completeness and accuracy
• Annual Destruction Audit: Internal audit of the destruction process, including sampling of destruction certificates, verification of backup rotation compliance, and legal hold register review
• Subprocessor Review: Annual verification that all subprocessors comply with their contractual data retention and destruction obligations
• Version Control: All policy versions are retained with effective dates, and material changes are communicated to affected stakeholders

Contact

For questions about this Data Retention & Destruction Policy, to submit a data deletion request, or to report a retention concern:

Related Policies