Erasing a patient's data, and what is kept

Use patient erasure when a patient asks you to delete their data. It is owner-only. Use archiving when you just want to tidy your list.

How to do it

1. Open the patient, go to Details and scroll to Danger zone.
2. Press Erase patient data.
3. Type the patient's full name to confirm, then press Erase permanently.

This cannot be undone. Check the patient's future appointments first: erasure does not cancel them for you.

If the patient has an active or payable Stripe membership, cancel it first. Erasing a record would not stop its payments. If the app cannot safely check related records, close an online checkout or revoke public links, it stops and asks you to retry.

The app decides which of two things happens

• No retained records found. The patient record is deleted. Records configured to follow it are deleted too; some financial and appointment history can remain with the patient link cleared.
• Retained records found. The patient becomes Erased Patient and is archived. Direct contact and demographic fields are cleared, but retained records remain.

The second outcome is not a guarantee that every retained item is anonymous. Names or dates of birth typed into completed forms can remain, and retained photographs may still identify the patient.

What is removed

The app clears direct patient contact fields, disables marketing consent and revokes public links. It attempts to remove photos and documents that are not needed as signed evidence, scrub message content and removable audit history, and clear related shop-buyer and merge-snapshot details.

When erasure keeps an archived Erased Patient record, it also clears any booking-block reason and the optional note under Automated messages. Retained records can still contain identifying details.

The patient portal account is deleted only if it is not shared with a staff account or another patient record. Otherwise the patient is unlinked from it.

If Mailchimp sync is enabled, the app attempts to remove the audience member before clearing the email address. It keeps the member if another patient record shares that address. A Mailchimp failure does not stop local erasure.

What is kept, and why

The app's retention rules keep signed clinical records and maps, completed form submissions, ID checks and their medical-need overrides, and issued invoices.

Photographs supporting signed evidence can also remain: a signed map's base photograph, vial photographs attached to it and before-and-after photographs attached to signed clinical records.

Other linked history, including future appointments, can remain in the retained-record outcome. Handle future appointments in the diary; their public manage links no longer work.

Read the confirmation, and keep it

The confirmation explains the outcome and, when records are retained, lists their types and reports remaining future appointments. The app stores a separate cleanup record with file-removal problems and other residual details.

If you need the detailed cleanup record or must account for identifying content that remains, contact support before describing the result to the patient. Do not assume a successful confirmation means every file or identifier was removed.

Closing your own clinic account

This is separate. Open Settings > Data & export > Close your account. Take an export first and check what it contains: see One-click full export.