Data Retention and Deletion Policy
Effective 21 September 2026 - Cruze Intelligent Systems (U) Ltd, Kampala, Uganda
This policy explains how long Bulamu Medical Facility OS ("Bulamu") keeps information, and exactly what happens to it when a record, a staff account, a Patient Portal account or a whole facility is deleted or closed. It forms part of, and should be read with, our Privacy Policy. It applies to Cruze Intelligent Systems (U) Ltd ("Cruze", "we"), to the medical facilities that use Bulamu, and to patients who use the Patient Portal.
1. Who decides what happens to data
- Clinical records belong to the treating facility, which is the data controller. Cruze is the data processor and keeps and erases those records only as this policy and the facility's instructions require.
- Patient Portal accounts are opened for a patient by the facility that registers them, and the patient may close the account at any time.
- Facility account, billing and security records are held by Cruze for running the Service, meeting financial record-keeping duties and protecting patients and facilities.
2. Retention schedule
| Category | What it includes | How long we keep it | At the end |
|---|---|---|---|
| Clinical records | Patient details, appointments, consultations, prescriptions, lab tests, reproductive health records, referrals and referral letters, hospital admissions, ward notes and observations, discharge summaries and invoices entered by a facility. | While the facility account is active, and afterwards for 5 years from the last entry on the record.* | Permanently erased. |
| Your approvals to share your history | Which facilities asked to see your records from other facilities, and when you approved, declined or stopped sharing. Each time a facility looks at shared history is also recorded, and you can see it in your Patient Portal. | As long as the clinical records they concern. | Permanently erased. |
| Documents | Files attached to a patient record, uploaded by facility staff or by the patient. | With the clinical record. A document that is deleted by the person who uploaded it, or by a facility administrator, is removed immediately and permanently. | Permanently erased with the record. |
| Facility and staff account details | Facility profile, and staff names, email addresses and roles. | While the facility account is active. Staff sign-in is disabled immediately when an account is deactivated or a facility is deleted. After a facility is deleted, these details are kept, restricted, for the same period as the facility’s clinical records. | Permanently erased. |
| Subscription, payment and receipt records | Subscription status, payment references, and receipts (including the free-trial receipt). Card and mobile money details are held by our payment processor, not by Bulamu. | 7 years from the date of the record.* | Permanently erased. |
| Patient Portal account | Email address, phone number, Patient ID, password (stored only in scrambled form) and notification preferences. | Until the patient closes the account. | Erased immediately on closure. See section 4.4. |
| Notifications | The in-app notifications shown to staff and patients. | 90 days. | Permanently erased. |
| Sign-in and verification links and codes | Password set-up and reset links, and one-time verification codes. | Only until they expire: 10 minutes for a verification code, 1 hour for a password reset link, and 72 hours for a Patient Portal invitation link. | Expired items are removed. |
| Staff activity and sign-in records | Which days a staff member used Bulamu, when they were last seen, and whether each sign-in succeeded, failed or was blocked. Used for platform usage statistics. It never records what was viewed or changed, and never includes patient details. | 13 months. | Permanently erased. |
| Audit trail | A record of who created, changed or deleted sensitive records, and when. It identifies records by reference rather than repeating their contents. | 7 years.* | Permanently erased. |
| Backups | Copies of the database taken by our hosting provider for disaster recovery. | For a limited rolling period set by the provider. | Information erased from our live systems disappears from backups as they expire. |
* Where Ugandan law, or the facility's regulator, requires a longer period, the longer period applies.
3. Why records are not erased at once
A medical record is only useful, and only trustworthy, if it is complete. Clinicians rely on a patient's history for their safety, facilities have professional and legal duties to keep health records, and an audit trail must stay accurate to protect both patients and staff. For that reason, deleting something in Bulamu removes it from view straight away but does not erase it from our systems until the retention period in section 2 has ended. During that time it is restricted: it is not shown on any screen, cannot be opened by facility staff, and is accessible only to authorised Bulamu personnel for a lawful, documented purpose such as a legal request or a security investigation.
4. What happens when something is deleted or closed
4.1 A patient record is deleted at a facility
Only a facility administrator can delete a patient record. It disappears from every list, search and report immediately. It is then retained, restricted, for the clinical retention period and permanently erased at the end of it, or earlier where the law requires and permits. The deletion is recorded in the audit trail.
4.2 A staff account is deactivated
The person can no longer sign in, and any session that is already open stops working on its next request. The records they created remain in place and stay attributed to them, so that clinical history and the audit trail stay accurate. Their name and email address remain on the facility's staff list, marked as deactivated, for as long as the facility account is active.
4.3 A facility is deleted
Deleting a facility is carried out only by Cruze and requires the facility's exact name to be confirmed. From that moment all of the facility's staff lose access, and the facility is removed from every directory and listing. Its clinical records are not erased on that day: they are retained, restricted, for the clinical retention period and then permanently erased. A facility that wishes to keep a copy of its data should ask us for an export before deletion (see section 6). Patients who hold Patient Portal accounts can still see their own records in the portal.
4.4 A patient closes their Patient Portal account
A patient can close their account at any time from the Access page of the Patient Portal, by confirming their password. On closure:
- Erased immediately: the email address and phone number held on the account, the password, notification preferences, notifications, and any outstanding sign-in links or verification codes. The email address the facility recorded for portal purposes is also removed from the patient's facility records.
- Deleted immediately: every document the patient uploaded themselves.
- Access ended: every facility's access through the account is revoked, and the account can no longer be used to sign in. The patient receives a confirmation email at their previous address.
- Kept: the clinical records held by each facility, which remain with that facility under section 2 because the facility has a legal duty to keep them. They are no longer linked to a portal account. Appointment requests the patient sent to a facility, and the audit trail entry recording the closure, are also kept.
Closing the account does not, by itself, remove information from a facility's clinical records. A patient who wants their facility to correct or erase clinical information should ask the facility, which decides whether the law allows it.
4.5 A document is deleted
The file and its record are removed permanently and immediately. Only the person who uploaded a document or a facility administrator can delete it, and patients can delete only what they uploaded themselves. Documents that staff attached to a clinical record are managed by the facility.
4.6 A registration is not approved, or a subscription lapses
Details from a facility registration that is not approved are kept only for as long as needed to answer enquiries and to prevent repeat trial registrations, and are erased on request. If a subscription lapses, no data is deleted: existing records remain viewable and only the saving of new records is paused until payment is made.
5. Permanent erasure
When a retention period ends, the information is permanently erased from our live systems. Copies held in backups are removed as those backups expire under our hosting provider's rolling schedule. We keep a minimal record that an erasure took place, without keeping the erased content.
6. Requests to export or erase information
- Patients can close their Patient Portal account themselves. To access, correct or object to the use of clinical information, patients should contact their treating facility, which controls the record.
- Facility administrators can ask us to export their facility's data before closing an account, or to erase information that has passed its retention period.
- To make a request, use the WhatsApp or email icons in the footer of this page. We will verify who is asking before acting, aim to respond within 30 days, and explain clearly if we cannot comply in full and why.
7. When we may keep information longer
We may keep information beyond the periods above, only for as long as necessary, where we are required to by law or by a regulator, where it is needed to establish, exercise or defend a legal claim, or where it is needed to investigate a security incident or protect someone's safety.
8. Protection while information is retained
Retained information stays protected. It is held on encrypted connections and access-controlled systems, it is kept apart from the live facility view, and any access by Cruze personnel is limited to those who need it for a documented purpose and is recorded in the audit trail.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to facility administrators, and the effective date above will be updated.
10. Contact
Use the WhatsApp or email icons in the footer of this page to reach us about data retention and deletion.