The principle
Data is kept for as long as the purpose it was collected for lasts, and then it goes. Storage is cheap, which is exactly why a deliberate end date is necessary — nothing expires on its own.
This schedule is executed, not just published
A scheduled job runs against the database and applies the table below. The windows here and the windows in the code are the same declaration, so they cannot drift apart.
The schedule
| Record | What it holds | Why it is kept | How long | What happens then |
|---|---|---|---|---|
| Website enquiries | Name, email address, subject and the message text. | Answering the question that was asked, and following it up. | 3 months | Deleted — Deleted 90 days after the enquiry, once it can no longer be an open conversation. |
| Newsletter subscriptions (active) | Email address, the date consent was given and how it was given. | Sending the health newsletter that was asked for. | Until it is withdrawn | Kept by design — Kept while the subscription is live. Ends the moment someone unsubscribes. |
| Newsletter opt-outs | Email address and the fact that it opted out. | Making sure an address that left is never re-added by an import. | Until it is withdrawn | Kept by design — A suppression record is kept indefinitely. Deleting it would allow the address to be re-subscribed by mistake, which is the harm the opt-out was meant to prevent. |
| Newsletter send records | Subject, body and the list of addresses a send targeted. | Answering 'what did you send me, and when?'. | 2 years | Identifiers stripped — After two years the addresses are stripped and only the counts and the copy remain, which is enough to answer the question without keeping a mailing list nobody needs. |
| Administrative audit trail | Admin identity, the action taken, IP address and browser string. | Detecting and investigating unauthorised access to the console. | 2 years | Deleted — Two years of security forensics. Longer would keep IP addresses past any plausible investigation. |
| Consent records | What was agreed to, the policy version, the time, and a hashed identifier. | Proving that a consent was freely given, specific and informed. | 3 years | Deleted — Three years. Consent proof has to outlive the consent, because it is needed after a dispute starts, not before. |
| Data-subject requests | The requester's name and email, what they asked for, and what was done. | Showing that rights requests were answered inside the deadline. | 3 years | Deleted — Three years, so a pattern of unanswered requests is visible to an auditor rather than erased by the next sweep. |
Clinical records are separate
Your medical record — consultation notes, prescriptions, laboratory results — is not held on this website and is not covered by the table above. It is kept under the clinic's own record-keeping rules and the duties the Pakistan Medical & Dental Council places on the treating clinician. Medical records are kept substantially longer than website data, because that is what safe continuing care requires: a diabetic patient's readings from five years ago are clinically useful, where a five-year-old contact-form enquiry is not.
To ask about your clinical record, speak to reception or write to privacy@aslam.clinic.
When something is kept longer
A record is held past its window only for a reason we can state, and only for as long as that reason lasts:
- A live complaint, dispute or legal claim, until it is closed.
- A regulator's request, or a lawful order from a court.
- A security investigation into a specific incident.
- A suppression record — an unsubscribed email address — which is kept indefinitely precisely so it is never re-added.
If you ask for deletion and something is held back, we tell you what, and why, rather than quietly keeping it.
Backups
Deleting a record removes it from the live database immediately. Encrypted backups can still hold a copy for a short period until they rotate, which is normal and is not a way of keeping the data — the record is not restored, it is not searched, and it disappears with the backup.