This policy defines how long AI VOX retains each category of clinic and patient data, how Covered Entities may request export or deletion, and the schedule by which deletion is carried out. It is designed to satisfy HIPAA documentation retention requirements (45 CFR § 164.316(b)(2)) while limiting privacy exposure.
Default Retention Schedule
| Data category | Retention |
|---|---|
| Call audio recordings | 6 years from date of call (encrypted at rest) |
| Call transcripts | 6 years from date of call |
| Call metadata (sentiment, summary, analysis) | 6 years from date of call |
| Appointment records | 6 years from date of appointment |
| Patient contact information | While the clinic relationship is active, plus 6 years after termination |
| Dashboard user accounts | Deleted within 90 days of relationship termination |
| System audit logs | 6 years |
| Database backups | 30-day rolling window |
| HIPAA documentation | 6 years from last effective date |
Clinic-Controlled Retention
A Covered Entity may request shorter retention (where its own obligations permit) or longer retention (where required by state law or specialty rules). Custom requests are documented in writing and confirmed once in effect.
Data Export
A Covered Entity may request export of its data at any time. Calls, appointments, and metadata are provided as CSV or JSON; audio as WAV or MP3 via a secure, time-limited link; transcripts as plain text or JSON. Standard requests are fulfilled within thirty (30) calendar days.
Deletion on Request
- Within 30 days — requested data is removed from active production systems.
- Within 60 days — data is purged from rolling backups as part of normal aging. Until then it exists only in encrypted disaster-recovery backups, inaccessible to any user or application.
- Within 75 days — AI VOX provides written confirmation the deletion is complete.
If a deletion request conflicts with a legal hold or retention obligation, AI VOX promptly notifies the Covered Entity, identifies the affected data, and proceeds with deletion of the unaffected data.
Termination of Service
On termination, AI VOX offers the Covered Entity an opportunity to export its data, deletes the data from active systems within 90 days and from backups within an additional 30 days, and retains only the HIPAA documentation required for six (6) years. Written confirmation is provided when all deletion obligations are complete.