Data Retention Policy

1. Purpose and approach

NexusFit should keep identifiable information only for a defined purpose and period, document the reason, and securely delete or genuinely anonymise it when no longer needed. This policy covers live records, derived copies, photographs, chats, device caches, billing records, audits, provider logs and backups. An archived screen, a hidden row or a soft-deleted record is not erasure.

The schedule below is proposed for approval and implementation. None of its new time limits is represented as already enforced. Before publication, replace proposals with the approved, tested schedule and explain any provider constraints. Anonymisation means preventing re-identification, not merely hiding a name or retaining an account/source identifier.

2. Proposed schedule

Active account identity/contact: retain while needed for the requested account. On a verified closure request, target deletion from ordinary live systems within 30 days after verification, subject to legitimate legal holds and statutory request rules. Keep only minimal billing/claim evidence where separately required.

Health profiles, dated meals/water/sleep/fasting/blood-pressure/Gym Log, plans and progress photographs: retain while the member requests the service and the purpose remains valid. On approved erasure or consent withdrawal, stop the affected optional processing promptly and target live deletion within 30 days where no lawful exception applies. Do not require continued health retention merely because invoice records must be kept.

Assistant current/archived conversations and AI scan/recipe images: proposed maximum rolling retention of 12 months unless a member knowingly requests continued archive storage for an identified purpose. On valid erasure, include both live chat and archives in the deletion operation. Archiving must not reset the retention clock indefinitely.

Staff recipe copies: include source-linked recipes and meal-photo references in erasure and consent reviews. Retain beyond closure only where genuinely anonymised content is lawfully kept under an approved purpose; remove identifying/source links and personal photos unless separately justified. No assumption that a staff copy survives forever.

Operational daily visits, delivery logs and ordinary troubleshooting logs: proposed 90 days unless a specific security/support event requires longer. Sensitive request bodies should not be kept in generic logs by default.

Moderation reports, staff-access/edit audit and complaint evidence: proposed two years after closure of the issue, subject to a documented necessity review. Serious disputes or legal claims may justify a case-specific hold; record its reason, scope, access and review date.

Payment, invoice and tax records: keep the minimum records required by the operator’s actual tax/company obligations. A limited company generally keeps accounting records for six years from the end of the relevant financial year; self-employed rules generally require at least five years after the relevant 31 January submission deadline. Confirm the legal form and accountant’s advice; do not apply a blanket six-year period to health photos or chat.

Unconverted campaign leads: proposed six months after the last meaningful engagement unless a clearly recorded, continuing marketing purpose supports longer. Marketing suppression records: retain the minimum identifier needed to respect an opt-out, with periodic review; do not retain the entire lead profile merely to suppress email.

Tester grants, subscription-change history and entitlement events: retain only as necessary for access administration, dispute/tax evidence and the approved audit period. Staff/creator applications: proposed 12 months after a final unsuccessful decision unless a separate lawful retention reason is recorded.

3. Devices, providers and backups

Browser sessions and preference records have their own expiry/clearing rules. Offline Gym Log records, recovery state and unsynced photos can remain on a device until sync/cleanup/site-data removal. Sign-out invokes account-related cleanup, but we cannot promise to erase exported files, screenshots or a device which is offline or outside our control. Tell members to sync before clearing site data.

Provider prompt/output, infrastructure, email and payment records follow the applicable approved contract/controller obligations. Record actual retention and deletion capabilities for each provider; do not invent a 30-day provider purge. Stripe may keep records for its own regulatory purposes even after a NexusFit account closes.

Verify backup inventory, cycle and file coverage before promising a backup deletion date. Database backup capability does not establish that storage photos are backed up or erased with the same cycle. Deleted information may persist in access-restricted backups until their verified expiry; it must not return to ordinary use. If a backup is restored, reapply erasure/suppression records before reopening the service. Keep a minimal deletion ledger necessary for this purpose without recreating the erased health content.

4. Process, holds and accountability

Assign an owner for retention and requests; verify identity proportionately; map every copy; stop unwanted processing; delete the live and storage records atomically or through a tracked process; notify processors as appropriate; record what was completed, what is retained and why. Give the member the outcome and available challenge rights. Apply the Privacy Policy’s statutory response time rather than treating the proposed schedule as an extension.

A legal hold must be specific and reviewed, not an indefinite “may need it later” exception. Separate finance/claim records from health data, restrict retained copies and delete them when the hold ends. Review this schedule annually and when a new feature, provider, age group or business purpose is added.