Data Retention Policy
Effective Date: April 2026 · Infohealth Ltd (Company No. 04004930) · Software as a Medical Device (SaMD) — Class I Medical Device
1. Purpose
This Data Retention Policy sets out how Infohealth Ltd, trading as Pharmacy1st.ai, retains, reviews, and disposes of personal data and records in connection with the Pharmacy1st.ai platform.
Pharmacy1st.ai is a Software as a Medical Device (SaMD), classified as a Class I Medical Device, which provides AI-powered clinical decision support to pharmacies participating in the NHS Pharmacy First programme. The Platform processes patient personal data and special category health data on behalf of Customer pharmacies.
This policy ensures that data is retained only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to support clinical governance and audit requirements. It also ensures that data is securely disposed of when retention periods expire.
2. Scope
This policy applies to all personal data and records processed, stored, or generated through the Pharmacy1st.ai platform and associated business operations, including:
- Patient personal data and special category health data processed on behalf of Customer pharmacies
- AI-generated QA documents, clinical triage outputs, and PGD eligibility assessments
- Pharmacist review decisions, annotations, and prescribing records
- Clinical audit trail records
- Pharmacy staff account data and activity logs
- Customer (pharmacy) contractual and commercial records
- Website visitor data and analytics
- Internal business records relating to Platform operations
This policy applies to data in all formats: electronic, paper-based, and any other medium.
3. Data Controller and Data Processor Roles
The data governance model determines who is responsible for retention decisions:
3.1 Patient Clinical Data
Data Controller: The Customer pharmacy. For all purposes and intents, the Customer pharmacy is the data controller for all patient personal data and health data. The Customer pharmacy ultimately determines the retention period for patient clinical data in accordance with its own regulatory obligations, NHS records management guidelines, and GPhC professional standards.
Data Processor:Infohealth Ltd. As data processor, we retain patient clinical data in accordance with the Customer’s documented instructions as set out in the Data Processing Agreement (DPA). The retention periods in this policy represent our standard processing terms; the Customer may specify different periods in the DPA.
3.2 Business and Website Data
Data Controller: Infohealth Ltd. For data relating to website visitors, sales enquiries, and our own business operations, Infohealth Ltd is the data controller and determines retention periods directly.
4. Retention Principles
We apply the following principles to all data retention decisions:
- Purpose Limitation: Data is retained only for as long as necessary to fulfil the specific purpose for which it was collected or processed.
- Data Minimisation: We do not retain more data than is required. Where data can be anonymised or aggregated and still serve its purpose, we will do so.
- Legal and Regulatory Compliance: Where legislation or regulation prescribes a minimum retention period, we comply with the longest applicable requirement.
- Clinical Governance: Patient clinical records and audit trails are retained for periods consistent with NHS and GPhC requirements to support patient safety, clinical accountability, and regulatory inspection.
- Medical Device Obligations: As the manufacturer of a Class I SaMD, we retain technical documentation, risk management records, and post-market surveillance data in accordance with UK Medical Devices Regulations 2002 (as amended) and MHRA guidance.
- Secure Disposal: Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised using methods appropriate to the sensitivity of the data.
5. Data Retention Schedule
The following table sets out the standard retention periods for each category of data. Where the Customer pharmacy specifies a different retention period in the DPA, the DPA prevails for patient data.
| Category | Data Type | Controller | Retention Period | Basis / Authority |
|---|---|---|---|---|
| Patient Clinical Data | Consultation transcripts, clinical responses, symptoms, medical history, allergies, medications | Customer Pharmacy | 10 years from consultation date (or as directed by Customer) | NHS Records Management Code of Practice 2021; GPhC record-keeping standards |
| QA Documents | AI-generated quality-assured clinical decision-support documents, PGD eligibility assessments, red-flag alerts | Customer Pharmacy | 10 years from consultation date (or as directed by Customer) | NHS Records Management Code of Practice 2021; MHRA SaMD post-market surveillance |
| Pharmacist Review Records | Pharmacist prescribing decisions, annotations, approval/rejection records, clinical rationale | Customer Pharmacy | 10 years from consultation date (or as directed by Customer) | GPhC professional standards; PGD governance requirements; NHS Records Management Code |
| Clinical Audit Trail | Timestamped logs of all consultation stages, AI processing steps, pharmacist actions, system events | Customer Pharmacy / Infohealth Ltd (joint for SaMD compliance) | 10 years from consultation date | UK Medical Devices Regulations 2002; MHRA SaMD guidance; NHS clinical governance |
| Pharmacy Staff Accounts | Pharmacist names, GPhC registration numbers, email addresses, login credentials, activity logs | As per DPA (typically Customer Pharmacy) | Duration of subscription + 12 months | Art. 6(1)(b) UK GDPR (contract performance); GPhC record-keeping |
| Customer Commercial Records | Subscription agreements, DPAs, invoices, correspondence, support tickets | Infohealth Ltd | 6 years from end of contract | Limitation Act 1980 (6-year limitation period for contract claims); Companies Act 2006 |
| Website Visitor Data | IP addresses, browser/device information, page views, navigation paths, referral sources | Infohealth Ltd | 12 months from collection | Art. 6(1)(f) UK GDPR (legitimate interests); ICO guidance on analytics |
| Cookie Data | Cookie identifiers, consent preferences, session data | Infohealth Ltd | As specified in Cookie Policy (session to 26 months depending on type) | PECR 2003; ICO cookie guidance |
| Sales and Marketing Data | Contact form submissions, sales enquiry details, marketing consent records | Infohealth Ltd | 3 years from last interaction (or until consent withdrawn) | Art. 6(1)(a) and 6(1)(f) UK GDPR; ICO direct marketing guidance |
| SaMD Technical Documentation | Design history file, risk management file, clinical evaluation, verification and validation records, post-market surveillance reports | Infohealth Ltd (manufacturer) | Lifetime of the device + 10 years after device is withdrawn from market | UK Medical Devices Regulations 2002 (as amended); MHRA guidance; ISO 13485; ISO 14971 |
| Clinical Safety and Incident Records | Adverse event reports, clinical safety incidents, CAPA records, vigilance reports | Infohealth Ltd (manufacturer) | Lifetime of the device + 15 years | UK Medical Devices Regulations 2002; MHRA vigilance reporting; DCB0129 / DCB0160 |
| AI Model Performance Records | Anonymised/aggregated model evaluation data, quality assurance test results, bias monitoring outputs | Infohealth Ltd | Lifetime of the device + 10 years | MHRA SaMD guidance; ISO 13485 quality management; clinical governance |
6. Data Processed on Behalf of Customer Pharmacies
For patient clinical data and associated records where the Customer pharmacy is the data controller:
6.1 Standard Retention Terms
Unless the Customer specifies otherwise in the DPA, Infohealth Ltd retains patient data for a default period of 10 years from the date of the consultation. This is consistent with the NHS Records Management Code of Practice 2021 and GPhC professional record-keeping obligations.
6.2 Customer-Specified Retention
The Customer pharmacy may specify different retention periods in the DPA. Where the Customer specifies a shorter period, we will comply, provided the period does not fall below any legally mandated minimum. Where the Customer specifies a longer period, we will accommodate this subject to agreement on any additional storage costs.
6.3 Data Return on Termination
Upon termination or expiry of the subscription:
- The Customer may request the return of all patient data in a structured, commonly used, machine-readable format within 30 days of termination
- Following the return period (or the Customer’s written confirmation that return is not required), Infohealth Ltd will securely delete all patient data within 90 days, except where retention is required by law or regulation
- A certificate of destruction will be provided to the Customer upon request
6.4 Residual Obligations
Where Infohealth Ltd is required to retain certain data beyond the subscription term (for example, clinical audit trails required for SaMD post-market surveillance or regulatory investigation), we will inform the Customer, restrict processing to the legally required purpose, and apply appropriate security measures.
7. Secure Disposal
When a retention period expires, or when the Customer instructs deletion, data is disposed of securely using methods appropriate to its sensitivity:
| Data Type | Disposal Method | Standard |
|---|---|---|
| Electronic patient/clinical data | Cryptographic erasure or secure overwrite of storage media; deletion from all live systems, backups, and replicas | NCSC Secure Sanitisation guidance; NIST SP 800-88 |
| Database records | Permanent deletion from primary databases and all replicated environments; confirmation that backup retention cycles have expired | UK GDPR Art. 17; DPA Schedule 2 obligations |
| Log files and audit trails (post-retention) | Secure deletion or irreversible anonymisation | ICO guidance on anonymisation; NCSC guidance |
| Paper records (if any) | Cross-cut shredding (DIN 66399 Level P-4 or above) via a certified destruction provider | BS EN 15713:2009 |
| Hardware / storage media | Degaussing or physical destruction via a certified ITAD provider; certificate of destruction retained | NCSC Secure Sanitisation; WEEE Regulations 2013 |
Anonymisation is considered a valid alternative to deletion where it is irreversible and meets the ICO’s Anonymisation Code of Practice. Anonymised data falls outside the scope of UK GDPR and may be retained indefinitely for analytics, research, or service improvement.
8. Backups and Disaster Recovery
Patient data and Platform records are included in regular encrypted backups as part of our business continuity and disaster recovery arrangements. Backups are subject to the following controls:
- Backups are encrypted at rest (AES-256) and access is restricted to authorised personnel
- Backup retention cycles are aligned with the retention periods in Section 5; when a retention period expires, data is removed from backups within the next scheduled backup cycle or within 90 days, whichever is sooner
- Where the Customer requests deletion of specific patient data, we will remove it from live systems immediately and from backups within the next scheduled backup cycle
- Backups are stored within the United Kingdom or, where necessary, in jurisdictions covered by appropriate safeguards as set out in the Privacy Policy
9. Legal Holds and Regulatory Preservation
Notwithstanding the retention periods set out in this policy, data may be preserved beyond the standard retention period where:
- A legal hold is issued in connection with actual or anticipated litigation, regulatory investigation, or disciplinary proceedings
- A regulatory body (GPhC, MHRA, NHS England, ICO) requires data to be preserved for inspection or audit
- A clinical safety investigation is ongoing
Legal holds are managed by the Data Protection Officer in consultation with legal counsel. Data subject to a legal hold is flagged in our systems to prevent routine deletion. The hold is lifted when the triggering event is resolved, and normal retention/disposal processes resume.
10. Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Data Protection Officer | Owns this policy. Conducts annual reviews. Advises on retention periods, legal holds, and disposal. Manages data subject rights requests (where Infohealth is controller). Oversees DPA compliance. |
| Engineering and Infrastructure Team | Implements retention schedules in Platform systems and databases. Executes secure deletion and anonymisation. Manages backup cycles and encryption. Reports disposal completion to the DPO. |
| Clinical Governance Lead | Advises on clinical record retention requirements. Liaises with MHRA and GPhC on SaMD documentation retention. Ensures audit trail completeness. |
| Customer Pharmacy (Data Controller) | Determines retention requirements for patient data and communicates them via the DPA. Handles patient data subject rights requests. Notifies Infohealth of any legal holds affecting patient data. |
| All Staff | Complies with this policy. Reports any concerns about data retention or disposal to the DPO. Does not retain personal data outside approved systems. |
11. Monitoring, Audit, and Review
This policy is subject to the following governance controls:
- Annual review by the Data Protection Officer, with input from the Clinical Governance Lead and Engineering team
- Retention schedules are audited at least annually to confirm that data is being retained and disposed of in accordance with this policy
- Disposal logs are maintained and available for inspection by the DPO and, where applicable, by Customer pharmacies and regulatory bodies
- Any material changes to legislation, regulation, NHS guidance, or MHRA requirements will trigger an ad hoc review
- Findings from audits and reviews are reported to senior management and actioned via the CAPA (Corrective and Preventive Action) process where necessary
12. Related Documents
This policy should be read in conjunction with:
- Pharmacy1st.ai Terms of Use
- Pharmacy1st.ai Privacy Policy
- Pharmacy1st.ai Cookie Policy
- Data Processing Agreement (provided to each Customer pharmacy)
- Information Security Policy
- Clinical Safety Management Plan
- Incident Response and Data Breach Notification Procedure
- ISO 13485 Quality Management System documentation
13. Contact
If you have any questions about this Data Retention Policy, please contact us:
Infohealth Ltd d.b.a Pharmacy1st.ai
1st Floor Offices
28 Chipstead Valley Road
Coulsdon, Surrey, CR5 2RA
Sales
Email: [email protected]
Telephone: 020 8668 4515
Support
Email: [email protected]
Telephone: 020 8668 4515
Data Protection Officer
Email: [email protected]