Retention Schedule
Version: baseline-mvp-2026-10-05-v2.
On a small screen, scroll the table sideways to read all columns.
| Category | Approved handling |
|---|---|
| Unfinished questionnaires | Delete after 30 days at the latest. Browser-only drafts expire after 24 hours. |
| Identifiable intake/health/assessment/programme/private client records | 3 years after the last verified paid BASELINE service. Delete at expiry; no individual-level anonymous archive. |
| Consent/policy acceptance evidence | 3 years after last paid service except a longer legally required period reviewed by the supervisor. |
| Financial/invoices | Legally required accounting/tax period; 5 years operationally where applicable. Bookem/Yoco financial records remain in their provider process. |
| Daily backups | Rolling 30-day retention; no immediate/absolute backup deletion promise. |
| Anonymous aggregate data | Long-term retention only when re-identification is not reasonably possible. Where safe anonymisation is unavailable, the default is deletion. |
Identifiable client and consent/policy records are retained for 3 years after the last verified paid BASELINE service, subject to genuine lawful retention reasons or holds. Booking status alone is not paid-service proof. Unfinished questionnaires are deleted after 30 days at the latest; the browser-only draft expires after 24 hours. Financial/invoice records are handled for 5 years operationally where applicable, subject to applicable obligations. Daily backups have rolling 30-day retention. Anonymous aggregates may be retained only when re-identification is not reasonably possible; no pseudonymous individual archive is treated as anonymous. Where safe anonymisation is unavailable, the default is deletion. See the Retention Schedule.
The service-date anchor must be observed and verified. A scheduled/confirmed appointment is a candidate, not proof a paid service was delivered.
No pseudonymous record is called anonymous: no retained name, email, phone, address, UID, Bookem reference, account identifier, reversible token or mapping. Safe aggregate anonymisation is unavailable, so the implementation deletes instead. Financial/legal holds must be assessed before any destructive execution; unresolved holds stop disposal.
Backups may contain pre-deletion data until they expire.
Request access, correction, objection, consent withdrawal or deletion at howzit@baselineathletics.co.za. We verify identity and assess lawful retention requirements before action. Withdrawal does not invalidate earlier lawful processing and may prevent continued service requiring health information. The supervised Privacy Request Procedure applies. We do not promise instantaneous removal from every backup.