Records retention

There is no retention schedule. Nothing is deleted automatically, nothing expires, and nobody has yet decided how long a health record should live in this system.

A retention period is a legal and clinical determination about Tanzanian health records. It belongs to somebody with the authority to make it, not to an engineer picking a number because the page looked empty without one.

What happens today

Verified against the running system

Clinical records: Never deletedThere is no deletion job, no expiry column and no lifecycle policy. What goes in stays.
The audit log: Append-only, by designEvery read of a record is written down and cannot be removed. That is intended: an audit log that can be edited is not an audit log.
Uploaded files: Never deletedThe nine storage buckets carry size and type limits but not one of them has a deletion policy. An uploaded file stays until somebody removes it by hand.
Closing an account: No mechanismThere is no way for a person to delete their account or ask for their data to be removed. That is a known gap, not a decision.

What is owed

A retention schedule naming each class of record, its period, what triggers deletion and who authorises it. It is required before the first facility connects, together with a way for a person to ask for their data to be removed.