← Help & Documents   Print / save as PDF

Retention & Exit Policy

Status: Draft v0.1 — adopted as the platform's policy direction on 10 November 2026. Before launch: the retention figures and contract clauses in this document must be confirmed by a Nigerian health-law review. The figures below come from professional guidance and prevailing Nigerian provider practice, not from a retention clause read directly in statute text.

Purpose

Hospitals will join this platform and, one day, some will leave. Patients will hold printed reports for years after they are issued. This policy makes sure three things survive that reality:

1. A patient can verify a report for as long as the report itself is meant to exist — regardless of whether the issuing hospital is still a customer.
2. Patient data is kept for a defined, lawful period — no shorter, and no longer.
3. A hospital that leaves takes its data with it, completely, and knows exactly what (very little) the platform keeps afterwards, and why.

Definitions

• Clinical data — DICOM studies and images, signed reports and all their versions, patient and study metadata, and related documents, belonging to one hospital tenant.
• Verification ledger — the platform-level register of report verification records (Section 2). It contains no images and no report body text.
• Tenant exit — the end of a hospital's subscription, for any reason: cancellation, termination, or the hospital closing.
• Legal hold — a suspension of the deletion clock for records involved in a medico-legal case, dispute, or investigation.

1. Principles

• The hospital owns its clinical data. The platform holds it as a custodian/processor under a data-processing agreement with each hospital (Nigeria Data Protection Act 2023).
• Paper outlives subscriptions. Verification is a platform-level duty, independent of any one hospital's subscription status.
• Retention is a schedule, not forever. The NDPA's storage-limitation principle requires data to be kept no longer than necessary, under a defined schedule, and then deleted or anonymised.
• Never delete early. The National Health Act 2014 makes wrongful destruction of health records an offence. Where the schedule and a legal hold conflict, the hold wins.

2. Verification continuity

Every signed report carries a verification code, a QR code, and a SHA-256 hash of its final text. Verification must keep working even if the issuing hospital has left the platform.

What the platform keeps in the verification ledger, per report:

• Verification code and report hash
• Hospital name (as printed on the report)
• Examination name and study date
• Signing radiologist's name and MDCN number
• Current version number and status (current final / superseded by a later version)
• Date and time signed (Africa/Lagos)

Where verification lives:

• The primary verification address is on the platform's main domain (e.g. <platform-domain>/verify). This is the address printed on the report and encoded in the QR code. It does not depend on any hospital's subscription.
• While a hospital is a customer, its own subdomain verify page (e.g. luth.<platform-domain>/verify) resolves the same codes as a second door.
• After a hospital exits, its subdomain becomes a verification-only page — no login, no clinical data — which directs patients to the platform verification address. It stays up for the full retention period of that hospital's reports.

What a public verification shows: whether the report is genuine, the hospital, examination, date, signing radiologist, and whether the copy being checked is the current final version or has been superseded. It never displays the full report text to an unauthenticated visitor.

Platform wind-down protection: the ledger is small and exportable. If the platform itself ever shuts down, each hospital's ledger extract is part of its exit export (Section 4), so hospitals can continue verifying their own reports.

3. Retention schedule

The clock runs per patient, per hospital, from the date of that patient's last study at that hospital.

Basis: the MDCN Code of Medical Ethics and the National Health Act are commonly cited as requiring a minimum of 7 years post-treatment for adult records, with paediatric records kept until age 25. Prevailing Nigerian provider practice is 10 years. This platform adopts the longer, safer figure: 10 years. The NDPA prescribes no number itself; it requires a defined schedule and real deletion at the end of it.

Storage tiers: studies sit in standard (hot) storage for the first 24 months, then move to archive (cold) storage until expiry. Retention is a duty; it is not a reason to pay hot-storage prices for a decade-old study. Cold-storage retrieval target: within 24 hours.

Deletion at expiry: when a record's period expires and no legal hold applies, it is deleted automatically, including from backups within the 90-day backup rotation window. Every deletion is written to a deletion log. Data approaching expiry is flagged to the platform admin 90 days in advance.

4. Tenant exit (offboarding)

Notice: 90 days, per the hospital contract.

During the notice period: service continues in full. The hospital can export its data at any time (self-serve export is a standing platform feature, not an exit favour).

Final export at exit — one complete package, with counts and hashes verified with the hospital:

• All DICOM studies (original files)
• All signed reports and every version (PDF and structured data)
• Patient and study metadata
• The tenant's audit logs
• The hospital's verification ledger extract

Grace window: 90 days from the exit date for the hospital to download and confirm the export.

After confirmed export and the grace window:

• Clinical data is deleted from production systems, and from backups within the backup rotation window.
• The platform issues the hospital a deletion certificate recording what was deleted and when.
• What the platform keeps: only the verification ledger entries for that hospital's reports (Section 2, for the retention period) and billing records required by tax law. No images. No report text.
• The hospital's subdomain converts to the verification-only page described in Section 2.

Patients after a hospital exits: patients verify reports at the platform address printed on the report — this never stops working. Patients who need their actual records are directed to the hospital, which owns the data and holds the export. After the grace window the platform no longer holds clinical data and cannot release what it does not have.

Re-joining: a returning hospital's verification ledger entries reconnect to its new tenant. Historical clinical data re-enters only through the hospital's own export, imported by the hospital.

5. Patient rights (NDPA)

Requests from patients (access, correction, erasure) are decided by the hospital as data controller; the platform assists while the hospital is a customer and logs every request and outcome. An erasure request never overrides the retention schedule in Section 3 or a legal hold — medical records under mandatory retention are explained to the patient on that basis.

6. Enforcement in the product

• The Platform Admin console shows, per tenant: retention-clock status, data approaching expiry, exit state, export confirmations, and deletion certificates.
• Platform Admin never sees clinical content in any of this — counts, dates and statuses only, per the platform's least-privilege design.
• Suspension of a tenant (e.g. for non-payment) is not an exit: no retention clock starts, no data is deleted, and verification continues. Deletion only ever follows a completed exit or a retention expiry.

7. Open items for legal confirmation before launch

1. The exact statutory footing of the 7-year (MDCN/NHA) versus 10-year figures, and the paediatric age-25 rule.
2. Whether state-level limitation laws require any category of record to be kept longer.
3. The patient-facing wording printed on reports about the platform's verification role.
4. NDPC registration and data-processing-agreement wording for the platform as a processor of health data at scale.

Draft v0.1 · 10 November 2026 · Prepared for the Nigeria hospital radiology platform project. Companion documents: MVP-BLUEPRINT.md, DICOM-ENGINE.md, DOMAIN-SHORTLIST.md.