Data Retention Policy

Why this page exists

In short: Home care records carry multi-year obligations, so 'we delete everything on cancellation' would be the wrong answer.

Agencies are often required to keep visit records for years after the care was delivered. A vendor that wipes your data the day you cancel creates a compliance problem rather than solving one. So we hold records, give you a window to take them, and then delete on a published schedule.

While your account is active

In short: We keep your records for as long as you keep the account.

Visits, schedules, hours, client and caregiver records and the audit trail are retained for the life of the account. We do not age out historical visits, because the older ones are exactly the ones an audit asks about.

You can export everything at any time as CSV and PDF, without asking us and without a fee.

When you cancel

In short: You get 30 days to export everything, then we delete within 60 days.

If you ask us to delete sooner, we will, subject to any legal obligation to retain. Ask at hello@getcareverify.com.

Audit logs

In short: Access records are kept for 6 years, because HIPAA requires it.

The audit log records who accessed which client record and when. HIPAA requires these records to be retained for 6 years, so they outlive the deletion of the underlying records. They remain protected under our business associate agreement for that whole period.

Backups

In short: Backups are encrypted, retained on a rolling schedule, and deleted data disappears from them as they cycle.

We keep encrypted backups so we can recover from a failure. Deleting a record from the live system does not instantly remove it from every backup already taken. Deleted data ages out of backups as they cycle rather than being surgically removed, which is standard practice and the reason deletion is stated as a window rather than an instant.

Marketing website data

In short: Enquiry details are kept for two years. Analytics are kept for the retention period of the analytics tool.

If you contact us through the website, we keep your name, agency name, email and phone number for two years after our last contact so we can pick up where we left off. Ask us and we will delete it sooner.

If we ever shut down

In short: You would get at least 90 days' notice and a full export.

Small vendors sometimes disappear, and pretending otherwise would be dishonest. If CareVerify were ever discontinued, we would give at least 90 days' notice, keep exports working for that whole period, and publish instructions for moving your records elsewhere.