Data Retention Policy

1. Overview

hoito is committed to the principle of data minimisation. We only retain personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to support the legitimate interests of therapists and their clients.

This policy explains what data we keep, how long we keep it, and what happens when retention periods expire or you request deletion.

2. Retention Schedule

The following schedule applies to all data processed through the hoito platform. Retention periods are measured from the date of last relevant activity unless otherwise stated.

3. What Happens When You Cancel

If you cancel your hoito subscription:

• Your data is preserved according to the retention schedule above — cancelling does not trigger deletion.
• Management features (booking, invoicing, notes) are locked, but your directory listing remains visible.
• You may request deletion of your data at any time, subject to the clinical exceptions described below.
• If you resubscribe within the retention period, your data will be fully restored.

4. Deletion Requests

You may request deletion of your personal data at any time by contacting us. When we receive a deletion request:

• Anonymisation, not hard deletion: Where data is part of a clinical or financial record subject to regulatory retention, we anonymise rather than permanently delete it. This ensures compliance while removing personally identifiable information.
• Clinical exceptions: Therapists have a legal and professional obligation to retain clinical records for the periods specified above. If a client requests deletion of clinical notes, the therapist will be notified and given a 30-day window to object on professional or legal grounds.
• 30-day objection window: When a deletion request involves clinical data, the responsible therapist is notified immediately. They have 30 days to confirm or object. If no response is received, the request proceeds.
• Non-clinical data: Account data, directory profiles, and other non-clinical data will be deleted within 30 days of the request being confirmed.

5. Data Export

Therapists and clients have the right to export their data in a machine-readable format before deletion. We support export in JSON and CSV formats. To request an export:

• Therapists: Use the data export feature in your account settings, or contact us directly.
• Clients: Contact your therapist or email us to request an export of your records.

Exports are typically prepared within 30 days of the request, in accordance with your right to data portability under UK GDPR Article 20.

6. Your Rights

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to the clinical exceptions above.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to restriction — request that we limit how your data is processed.
• Right to object — object to processing based on legitimate interests.

To exercise any of these rights, please contact us at privacy@hoito.health.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Contact

For any questions about this data retention policy, or to make a data subject request, please contact: