Data Retention

Effective September 9, 2026

MamaBPT keeps information only while needed to provide the service, protect accounts, support clinic recordkeeping, resolve disputes, or meet applicable obligations. No single retention period applies to every record, clinic, or territory.

• Active account and care records: kept while the account or clinic relationship is active and afterward when the clinic’s record policy or applicable healthcare, professional, safety, legal-hold, or audit duty requires it.
• Messages and reports: may form part of the care or safety record and can remain after messaging consent is withdrawn or account access ends.
• Sessions and device registrations: subject to revocation through supported sign-out and account-security workflows. A deletion request sent to support does not itself establish that sessions or device registrations have been revoked. Authentication sessions otherwise have a configured 24-hour expiry.
• Short-lived security records: one-time and replay-protection records use bounded technical windows where configured, commonly 24 hours, but operational logs and audit events may have different requirements.
• Device-local copies: protected cache and queued operations may remain until sign-out, account removal, application removal, cache eviction, or successful synchronization, depending on the feature.
• Backups: may retain records for the backup lifecycle and are restored only for continuity or recovery; an exact production backup-deletion interval is not stated until the owner verifies it.

When no obligation or operational purpose remains, records should be deleted or de-identified. Contact your clinic or access@mamabpt.com for the rule applied to a particular record.