Data Retention Policy

1. How we decide

We keep information only while it is needed to provide Oodesy, and then we delete it. The same 30-day rule applies across Oodesy: when something is deleted or an account ends, it is permanently deleted after 30 days.

2. Family accounts

• Deleting a child. Everything about that child is permanently deleted 30 days after you delete the child. You can undo it at any time during those 30 days.
• Deleting your account. Your account and everything in it, including your children’s information, is permanently deleted 30 days after you ask. You can cancel at any time during those 30 days.
• Notifications. Deleted automatically 30 days after they are sent (90 days for a signature request).

3. Clinics, schools and other organizations

An organization owns the records it creates in Oodesy and is responsible for keeping them for as long as the law requires it to. Export anything you need to keep before it is deleted.

• Free account. Records, including client records and charts, are kept for 30 days after they are created or received, and are then deleted on a rolling basis. What you set up, such as your forms, templates and settings, is kept while the account is open. Clients are not discharged: each client stays on your client list with their care team, intake summary, rewards record and requests to link their family's account. A proposed change to a client's settings that is still waiting for an answer is kept until it is answered, withdrawn or expires, then deleted 30 days later. Audit logs and records of consents and signatures are also kept while the account is open.
• Paid account. Records are kept for as long as the subscription is active, subject to your deletion instructions and your agreements with us. The rolling deletion never applies to a paid account.
• Changing from paid to free. You have 30 days to export everything before the rolling deletion begins.
• Cancelling your account. Everything is permanently deleted 30 days after you cancel. Export anything you need during those 30 days.
• When your agreement ends. You have 30 days to export, and everything is then deleted within the following 30 days.
• Speech practice (Argos). If a child uses Argos with a linked therapist, their recordings and results are kept for that therapist as the law requires for the therapist’s records, even if the family later deletes the child. They are not used to train our models.

When a family shares information with an organization, it becomes part of that organization’s records. Deleting a family account does not delete an organization’s records.

If your Platform Agreement, Data Processing Addendum or Business Associate Agreement says something different, that agreement controls.

4. When we keep something longer

We keep information longer only when a law, a court order or a legal hold requires us to. We also keep the record of each consent and agreement you give, for as long as we need it to show that it was given. When we keep something longer, we keep only what is required and delete it when the requirement ends.

5. Backups

Deleted information can remain in encrypted backups until those backups expire on their normal schedule. We never use a backup to bring back information you deleted.

6. Information that does not identify anyone

Information that has been de-identified or combined so that it cannot identify anyone is not covered by this policy. Our Privacy Policy explains how we use it.

7. Questions and requests

To delete something sooner, or to ask about this policy, email privacy@oodesy.com. This policy is part of our Privacy Policy.