Clinical Records Retention Policy

1. Purpose and Scope

This policy applies to employed and self-employed staff acting for the clinic. GH PhysioCare will follow any longer period required for a particular record by a contract, insurer, investigation, claim or applicable specialist guidance, and record the reason.

The retention periods below are clinic policy informed by professional and health records guidance; UK GDPR itself does not prescribe one universal number of years.

2. Who Is Responsible

• The clinic director is accountable for adopting and resourcing this policy.
• The designated information governance lead maintains the retention register, records exceptions and approves disposal.
• Admin staff handle booking messages and paper files only within their authorised roles.
• Treating clinicians create timely, accurate clinical notes in the approved patient-record system.

No one may dispose of a record while it is subject to a complaint, claim, subject access request, safeguarding concern, investigation or other preservation hold.

3. Retention Schedule

Record Type	Standard Period	Starting Point & Disposal Action
Adult clinical record, including assessment, treatment notes, relevant correspondence and signed registration or consent forms	Eight years	Count from the final treatment or last clinical entry, whichever is later. Review and securely destroy when due unless a hold or justified exception applies.
Child or young person's clinical record, including signed registration or consent forms	Until the 25th birthday; until the 26th birthday if the patient was 17 when treatment ended	Review at the applicable birthday; keep longer where a specific rule or hold requires it. If treatment continues after the 18th birthday, apply the adult rule from the final adult treatment or last clinical entry if later.
WhatsApp or other booking enquiry that never becomes a clinical record	Three months	Count from the last contact. Delete the active message thread and any unnecessary enquiry copies after a monthly review, unless a complaint, claim or other hold applies.
Booking details that become relevant to a treated patient's care	Same period as the clinical record once entered there	Record the necessary facts in the approved patient-record system. Do not retain the entire WhatsApp thread as a second clinical archive by default. Remove the duplicate chat under the chat-deletion process once it is no longer needed, subject to a hold.
WhatsApp device or cloud backup	Backup process runs every 60 days	Backup copies are for recovery, not a separate indefinite archive. See the backup section.

For any record involving death, a claim, an implant, a specialist treatment category or an insurer's contractual terms, the decision of disposal will be based on the applicable UK guidance and law before applying GH's standard disposal rates. Staff must not assume the table covers every exceptional case.

Clinical Records and Registration Forms

The approved patient-record system is the working clinical record. Clinicians must enter assessments, treatment, consent discussions and material care communications there promptly. Admin staff should add relevant booking facts needed for the appointment and avoid copying unrelated conversation into the record.

Original paper registration, declaration and consent forms are retained as part of the same patient record. File them by patient identifier and date in the designated locked cupboard within the GH PhysioCare premises. Keep the cupboard locked when unattended; restrict keys or access codes to authorised staff; do not leave forms on desks or in reception view. Track any temporary removal and return.

The adult paper forms have the same eight-year period from last treatment or last clinical entry; child forms follow the child period in the table. Scanning a form into the digital record does not by itself authorise early disposal of its original under this policy. If the clinic later wishes to digitise and discard originals, it must first adopt a documented scanning, quality-check and lawful disposal procedure.

WhatsApp Enquiries and Messages

The clinic uses WhatsApp for appointment enquiries and collects a name, age and brief chief complaint for booking. Only authorised admin staff may access the clinic account. Avoid soliciting detailed records or images in chat.

Where a patient sends clinically material information, transfer an accurate, dated summary to the patient record and alert the clinician as appropriate. Important clinical advice or decisions must be documented in the patient record; WhatsApp is not the primary clinical record.

Review unanswered and unconverted enquiries monthly. For enquiries with no treatment, delete the chat and any separate copies three months after the last contact, unless a preservation hold applies. For treated patients, retain only the booking or care information needed in the approved record; remove duplicate chats when their operational purpose ends and after checking for any outstanding complaint or request.

Deletion from the phone must not be represented as immediate deletion from every backup. Do not bulk-export chats to GH's office email. A specific chat may be exported for a documented complaint or legal need into a restricted case file, with its own disposal date and secure handling.

Backups and Restoration

WhatsApp cloud backups are on and run every 60 days. GH will use WhatsApp's end-to-end encrypted backup option with a clinic-controlled cloud account; the account and recovery key are restricted to authorised persons.

The information governance lead will record the backup's actual retention or replacement behaviour in the retention register and privacy notice. Following a restore, admin staff must recheck and remove messages already past their deletion date and apply any active preservation holds.

Backups of the approved clinical-record system must be covered by its own supplier and clinic recovery arrangements; access and deletion schedules must be documented. Backups are protected against loss and unauthorised access and are not kept indefinitely merely because storage is available.

Disposal, Exceptions and Evidence

At least once a month, admin staff review WhatsApp enquiries due for deletion. At least once a year, the information governance lead reviews clinical and paper files reaching their disposal date, confirms that no hold applies, and authorises secure disposal.

Use cross-cut shredding or an approved confidential-waste service for paper, and appropriate deletion controls for digital records. Keep a disposal log with the record identifier, category, date range, reason for any extension, disposal date, method and authorising person; do not put the patient's clinical narrative into the log.

If a complaint, claim, investigation, subject access request or other hold arises, suspend routine deletion of relevant material promptly and record who imposed the hold, its scope and review date. When the hold ends, reassess the record against the applicable period rather than automatically retaining it forever. If data is restored from backup, reapply disposal decisions before routine use.

Review and Patient Information

Review this policy annually and whenever GH changes its clinical system, messaging setup, service scope or relevant guidance. The patient privacy notice should state the applicable clinical and unsuccessful-enquiry periods and accurately describe whether WhatsApp backups are used, their protection and their verified retention.

Staff should receive the process and know how to escalate a deletion or access request.