How we decide what to keep
- The record belongs to the organization. A clinic's clinical and administrative records are kept in its own health record, not copied into our product databases.
- Keep only what is needed. Queues, finished requests, and logs are deleted automatically on a schedule.
Health records live in FHIR
Patients, appointments, coverage, authorizations, claims, and referrals are stored as FHIR R4 records. They are kept for as long as the organization keeps them, as part of its records.
ByteOps
| Data | Kept |
|---|
| The organization's setup: services, places, staff, hours, payers, rules | While the organization uses ByteOps |
| Conversations with patients and the work done on each case | As part of the care record, until the organization or the patient asks for them to be deleted |
| Message delivery queues | 30 days |
| Messages exchanged with insurers | 120 days |
| Emergency details | Until the emergency is resolved; the outcome stays in the record |
| Who did what in the workspace | While the organization uses ByteOps |
ByteNetwork
| Data | Kept |
|---|
| Networks, members, and the services members list | While the network exists |
| Requests, referrals, and emergency alerts that have ended | 30 days |
| A referral with no update after it was accepted or booked | 90 days |
ByteCare
| Data | Kept |
|---|
| Your profile and your family's profiles | Until you ask us to delete them |
| Your chat with the assistant, and the history of each request | As part of your care record, until you ask us to delete it |
| Emergency details | Until the emergency is resolved or you cancel it |
| Voice recordings | Not stored |
ByteEngine
| Data | Kept |
|---|
| FHIR server data | Until you delete the server |
| Request logs (never the content of requests) | 7 days |
| Daily usage totals | 365 days |
Accounts and the website
- Boolbyte accounts (name, email, hashed password, sign-in methods) are kept while the account is open.
- Website enquiries are delivered by email to our team and kept in our mailbox while the conversation is useful.
- Analytics, if you accept it, is kept by Google for the retention period set in our Google Analytics account, no longer than 14 months.
Where data is kept
- Our production services and databases run on a cloud provider that we name, with its region, in each organization's agreement before any of its data is processed.
- The region your data is kept in is set out in your organization's agreement.
- AI models may process data outside Nigeria. Our subprocessors page says where each provider processes data.
Deletion and export
- People can ask for a copy of their data, or for it to be deleted, by emailing [email protected]. We reply within 30 days. For data a clinic controls, we pass the request to the clinic.
- Organizations can ask for their records, which we return as standard FHIR R4, and for all their data to be deleted when they leave, as set out in the data processing agreement.
- Deleted data leaves our live systems when we act on the request.
